1*d15c345fSPaul Moore /* 2*d15c345fSPaul Moore * NetLabel Unlabeled Support 3*d15c345fSPaul Moore * 4*d15c345fSPaul Moore * This file defines functions for dealing with unlabeled packets for the 5*d15c345fSPaul Moore * NetLabel system. The NetLabel system manages static and dynamic label 6*d15c345fSPaul Moore * mappings for network protocols such as CIPSO and RIPSO. 7*d15c345fSPaul Moore * 8*d15c345fSPaul Moore * Author: Paul Moore <paul.moore@hp.com> 9*d15c345fSPaul Moore * 10*d15c345fSPaul Moore */ 11*d15c345fSPaul Moore 12*d15c345fSPaul Moore /* 13*d15c345fSPaul Moore * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14*d15c345fSPaul Moore * 15*d15c345fSPaul Moore * This program is free software; you can redistribute it and/or modify 16*d15c345fSPaul Moore * it under the terms of the GNU General Public License as published by 17*d15c345fSPaul Moore * the Free Software Foundation; either version 2 of the License, or 18*d15c345fSPaul Moore * (at your option) any later version. 19*d15c345fSPaul Moore * 20*d15c345fSPaul Moore * This program is distributed in the hope that it will be useful, 21*d15c345fSPaul Moore * but WITHOUT ANY WARRANTY; without even the implied warranty of 22*d15c345fSPaul Moore * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23*d15c345fSPaul Moore * the GNU General Public License for more details. 24*d15c345fSPaul Moore * 25*d15c345fSPaul Moore * You should have received a copy of the GNU General Public License 26*d15c345fSPaul Moore * along with this program; if not, write to the Free Software 27*d15c345fSPaul Moore * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28*d15c345fSPaul Moore * 29*d15c345fSPaul Moore */ 30*d15c345fSPaul Moore 31*d15c345fSPaul Moore #ifndef _NETLABEL_UNLABELED_H 32*d15c345fSPaul Moore #define _NETLABEL_UNLABELED_H 33*d15c345fSPaul Moore 34*d15c345fSPaul Moore #include <net/netlabel.h> 35*d15c345fSPaul Moore 36*d15c345fSPaul Moore /* 37*d15c345fSPaul Moore * The following NetLabel payloads are supported by the Unlabeled subsystem. 38*d15c345fSPaul Moore * 39*d15c345fSPaul Moore * o ACK: 40*d15c345fSPaul Moore * Sent by the kernel in response to an applications message, applications 41*d15c345fSPaul Moore * should never send this message. 42*d15c345fSPaul Moore * 43*d15c345fSPaul Moore * +----------------------+-----------------------+ 44*d15c345fSPaul Moore * | seq number (32 bits) | return code (32 bits) | 45*d15c345fSPaul Moore * +----------------------+-----------------------+ 46*d15c345fSPaul Moore * 47*d15c345fSPaul Moore * seq number: the sequence number of the original message, taken from the 48*d15c345fSPaul Moore * nlmsghdr structure 49*d15c345fSPaul Moore * return code: return value, based on errno values 50*d15c345fSPaul Moore * 51*d15c345fSPaul Moore * o ACCEPT 52*d15c345fSPaul Moore * This message is sent from an application to specify if the kernel should 53*d15c345fSPaul Moore * allow unlabled packets to pass if they do not match any of the static 54*d15c345fSPaul Moore * mappings defined in the unlabeled module. 55*d15c345fSPaul Moore * 56*d15c345fSPaul Moore * +-----------------+ 57*d15c345fSPaul Moore * | allow (32 bits) | 58*d15c345fSPaul Moore * +-----------------+ 59*d15c345fSPaul Moore * 60*d15c345fSPaul Moore * allow: if true (1) then allow the packets to pass, if false (0) then 61*d15c345fSPaul Moore * reject the packets 62*d15c345fSPaul Moore * 63*d15c345fSPaul Moore * o LIST 64*d15c345fSPaul Moore * This message can be sent either from an application or by the kernel in 65*d15c345fSPaul Moore * response to an application generated LIST message. When sent by an 66*d15c345fSPaul Moore * application there is no payload. The kernel should respond to a LIST 67*d15c345fSPaul Moore * message either with a LIST message on success or an ACK message on 68*d15c345fSPaul Moore * failure. 69*d15c345fSPaul Moore * 70*d15c345fSPaul Moore * +-----------------------+ 71*d15c345fSPaul Moore * | accept flag (32 bits) | 72*d15c345fSPaul Moore * +-----------------------+ 73*d15c345fSPaul Moore * 74*d15c345fSPaul Moore * accept flag: if true (1) then unlabeled packets are allowed to pass, 75*d15c345fSPaul Moore * if false (0) then unlabeled packets are rejected 76*d15c345fSPaul Moore * 77*d15c345fSPaul Moore */ 78*d15c345fSPaul Moore 79*d15c345fSPaul Moore /* NetLabel Unlabeled commands */ 80*d15c345fSPaul Moore enum { 81*d15c345fSPaul Moore NLBL_UNLABEL_C_UNSPEC, 82*d15c345fSPaul Moore NLBL_UNLABEL_C_ACK, 83*d15c345fSPaul Moore NLBL_UNLABEL_C_ACCEPT, 84*d15c345fSPaul Moore NLBL_UNLABEL_C_LIST, 85*d15c345fSPaul Moore __NLBL_UNLABEL_C_MAX, 86*d15c345fSPaul Moore }; 87*d15c345fSPaul Moore #define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1) 88*d15c345fSPaul Moore 89*d15c345fSPaul Moore /* NetLabel protocol functions */ 90*d15c345fSPaul Moore int netlbl_unlabel_genl_init(void); 91*d15c345fSPaul Moore 92*d15c345fSPaul Moore /* Process Unlabeled incoming network packets */ 93*d15c345fSPaul Moore int netlbl_unlabel_getattr(struct netlbl_lsm_secattr *secattr); 94*d15c345fSPaul Moore 95*d15c345fSPaul Moore /* Set the default configuration to allow Unlabeled packets */ 96*d15c345fSPaul Moore int netlbl_unlabel_defconf(void); 97*d15c345fSPaul Moore 98*d15c345fSPaul Moore #endif 99