1 /* 2 * NetLabel CIPSO/IPv4 Support 3 * 4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The 5 * NetLabel system manages static and dynamic label mappings for network 6 * protocols such as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #ifndef _NETLABEL_CIPSO_V4 32 #define _NETLABEL_CIPSO_V4 33 34 #include <net/netlabel.h> 35 36 /* 37 * The following NetLabel payloads are supported by the CIPSO subsystem. 38 * 39 * o ADD: 40 * Sent by an application to add a new DOI mapping table. 41 * 42 * Required attributes: 43 * 44 * NLBL_CIPSOV4_A_DOI 45 * NLBL_CIPSOV4_A_MTYPE 46 * NLBL_CIPSOV4_A_TAGLST 47 * 48 * If using CIPSO_V4_MAP_STD the following attributes are required: 49 * 50 * NLBL_CIPSOV4_A_MLSLVLLST 51 * NLBL_CIPSOV4_A_MLSCATLST 52 * 53 * If using CIPSO_V4_MAP_PASS no additional attributes are required. 54 * 55 * o REMOVE: 56 * Sent by an application to remove a specific DOI mapping table from the 57 * CIPSO V4 system. 58 * 59 * Required attributes: 60 * 61 * NLBL_CIPSOV4_A_DOI 62 * 63 * o LIST: 64 * Sent by an application to list the details of a DOI definition. On 65 * success the kernel should send a response using the following format. 66 * 67 * Required attributes: 68 * 69 * NLBL_CIPSOV4_A_DOI 70 * 71 * The valid response message format depends on the type of the DOI mapping, 72 * the defined formats are shown below. 73 * 74 * Required attributes: 75 * 76 * NLBL_CIPSOV4_A_MTYPE 77 * NLBL_CIPSOV4_A_TAGLST 78 * 79 * If using CIPSO_V4_MAP_STD the following attributes are required: 80 * 81 * NLBL_CIPSOV4_A_MLSLVLLST 82 * NLBL_CIPSOV4_A_MLSCATLST 83 * 84 * If using CIPSO_V4_MAP_PASS no additional attributes are required. 85 * 86 * o LISTALL: 87 * This message is sent by an application to list the valid DOIs on the 88 * system. When sent by an application there is no payload and the 89 * NLM_F_DUMP flag should be set. The kernel should respond with a series of 90 * the following messages. 91 * 92 * Required attributes: 93 * 94 * NLBL_CIPSOV4_A_DOI 95 * NLBL_CIPSOV4_A_MTYPE 96 * 97 */ 98 99 /* NetLabel CIPSOv4 commands */ 100 enum { 101 NLBL_CIPSOV4_C_UNSPEC, 102 NLBL_CIPSOV4_C_ADD, 103 NLBL_CIPSOV4_C_REMOVE, 104 NLBL_CIPSOV4_C_LIST, 105 NLBL_CIPSOV4_C_LISTALL, 106 __NLBL_CIPSOV4_C_MAX, 107 }; 108 #define NLBL_CIPSOV4_C_MAX (__NLBL_CIPSOV4_C_MAX - 1) 109 110 /* NetLabel CIPSOv4 attributes */ 111 enum { 112 NLBL_CIPSOV4_A_UNSPEC, 113 NLBL_CIPSOV4_A_DOI, 114 /* (NLA_U32) 115 * the DOI value */ 116 NLBL_CIPSOV4_A_MTYPE, 117 /* (NLA_U32) 118 * the mapping table type (defined in the cipso_ipv4.h header as 119 * CIPSO_V4_MAP_*) */ 120 NLBL_CIPSOV4_A_TAG, 121 /* (NLA_U8) 122 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST 123 * attribute */ 124 NLBL_CIPSOV4_A_TAGLST, 125 /* (NLA_NESTED) 126 * the CIPSO tag list for the DOI, there must be at least one 127 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher 128 * priorirty when sending packets */ 129 NLBL_CIPSOV4_A_MLSLVLLOC, 130 /* (NLA_U32) 131 * the local MLS sensitivity level */ 132 NLBL_CIPSOV4_A_MLSLVLREM, 133 /* (NLA_U32) 134 * the remote MLS sensitivity level */ 135 NLBL_CIPSOV4_A_MLSLVL, 136 /* (NLA_NESTED) 137 * a MLS sensitivity level mapping, must contain only one attribute of 138 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and 139 * NLBL_CIPSOV4_A_MLSLVLREM */ 140 NLBL_CIPSOV4_A_MLSLVLLST, 141 /* (NLA_NESTED) 142 * the CIPSO level mappings, there must be at least one 143 * NLBL_CIPSOV4_A_MLSLVL attribute */ 144 NLBL_CIPSOV4_A_MLSCATLOC, 145 /* (NLA_U32) 146 * the local MLS category */ 147 NLBL_CIPSOV4_A_MLSCATREM, 148 /* (NLA_U32) 149 * the remote MLS category */ 150 NLBL_CIPSOV4_A_MLSCAT, 151 /* (NLA_NESTED) 152 * a MLS category mapping, must contain only one attribute of each of 153 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and 154 * NLBL_CIPSOV4_A_MLSCATREM */ 155 NLBL_CIPSOV4_A_MLSCATLST, 156 /* (NLA_NESTED) 157 * the CIPSO category mappings, there must be at least one 158 * NLBL_CIPSOV4_A_MLSCAT attribute */ 159 __NLBL_CIPSOV4_A_MAX, 160 }; 161 #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1) 162 163 /* NetLabel protocol functions */ 164 int netlbl_cipsov4_genl_init(void); 165 166 #endif 167