1 /*
2  * NetLabel CIPSO/IPv4 Support
3  *
4  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
5  * NetLabel system manages static and dynamic label mappings for network
6  * protocols such as CIPSO and RIPSO.
7  *
8  * Author: Paul Moore <paul@paul-moore.com>
9  *
10  */
11 
12 /*
13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14  *
15  * This program is free software;  you can redistribute it and/or modify
16  * it under the terms of the GNU General Public License as published by
17  * the Free Software Foundation; either version 2 of the License, or
18  * (at your option) any later version.
19  *
20  * This program is distributed in the hope that it will be useful,
21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
23  * the GNU General Public License for more details.
24  *
25  * You should have received a copy of the GNU General Public License
26  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
27  *
28  */
29 
30 #ifndef _NETLABEL_CIPSO_V4
31 #define _NETLABEL_CIPSO_V4
32 
33 #include <net/netlabel.h>
34 
35 /*
36  * The following NetLabel payloads are supported by the CIPSO subsystem.
37  *
38  * o ADD:
39  *   Sent by an application to add a new DOI mapping table.
40  *
41  *   Required attributes:
42  *
43  *     NLBL_CIPSOV4_A_DOI
44  *     NLBL_CIPSOV4_A_MTYPE
45  *     NLBL_CIPSOV4_A_TAGLST
46  *
47  *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
48  *
49  *     NLBL_CIPSOV4_A_MLSLVLLST
50  *     NLBL_CIPSOV4_A_MLSCATLST
51  *
52  *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
53  *   are required.
54  *
55  * o REMOVE:
56  *   Sent by an application to remove a specific DOI mapping table from the
57  *   CIPSO V4 system.
58  *
59  *   Required attributes:
60  *
61  *     NLBL_CIPSOV4_A_DOI
62  *
63  * o LIST:
64  *   Sent by an application to list the details of a DOI definition.  On
65  *   success the kernel should send a response using the following format.
66  *
67  *   Required attributes:
68  *
69  *     NLBL_CIPSOV4_A_DOI
70  *
71  *   The valid response message format depends on the type of the DOI mapping,
72  *   the defined formats are shown below.
73  *
74  *   Required attributes:
75  *
76  *     NLBL_CIPSOV4_A_MTYPE
77  *     NLBL_CIPSOV4_A_TAGLST
78  *
79  *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
80  *
81  *     NLBL_CIPSOV4_A_MLSLVLLST
82  *     NLBL_CIPSOV4_A_MLSCATLST
83  *
84  *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
85  *   are required.
86  *
87  * o LISTALL:
88  *   This message is sent by an application to list the valid DOIs on the
89  *   system.  When sent by an application there is no payload and the
90  *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
91  *   the following messages.
92  *
93  *   Required attributes:
94  *
95  *    NLBL_CIPSOV4_A_DOI
96  *    NLBL_CIPSOV4_A_MTYPE
97  *
98  */
99 
100 /* NetLabel CIPSOv4 commands */
101 enum {
102 	NLBL_CIPSOV4_C_UNSPEC,
103 	NLBL_CIPSOV4_C_ADD,
104 	NLBL_CIPSOV4_C_REMOVE,
105 	NLBL_CIPSOV4_C_LIST,
106 	NLBL_CIPSOV4_C_LISTALL,
107 	__NLBL_CIPSOV4_C_MAX,
108 };
109 
110 /* NetLabel CIPSOv4 attributes */
111 enum {
112 	NLBL_CIPSOV4_A_UNSPEC,
113 	NLBL_CIPSOV4_A_DOI,
114 	/* (NLA_U32)
115 	 * the DOI value */
116 	NLBL_CIPSOV4_A_MTYPE,
117 	/* (NLA_U32)
118 	 * the mapping table type (defined in the cipso_ipv4.h header as
119 	 * CIPSO_V4_MAP_*) */
120 	NLBL_CIPSOV4_A_TAG,
121 	/* (NLA_U8)
122 	 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
123 	 * attribute */
124 	NLBL_CIPSOV4_A_TAGLST,
125 	/* (NLA_NESTED)
126 	 * the CIPSO tag list for the DOI, there must be at least one
127 	 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
128 	 * priorirty when sending packets */
129 	NLBL_CIPSOV4_A_MLSLVLLOC,
130 	/* (NLA_U32)
131 	 * the local MLS sensitivity level */
132 	NLBL_CIPSOV4_A_MLSLVLREM,
133 	/* (NLA_U32)
134 	 * the remote MLS sensitivity level */
135 	NLBL_CIPSOV4_A_MLSLVL,
136 	/* (NLA_NESTED)
137 	 * a MLS sensitivity level mapping, must contain only one attribute of
138 	 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
139 	 * NLBL_CIPSOV4_A_MLSLVLREM */
140 	NLBL_CIPSOV4_A_MLSLVLLST,
141 	/* (NLA_NESTED)
142 	 * the CIPSO level mappings, there must be at least one
143 	 * NLBL_CIPSOV4_A_MLSLVL attribute */
144 	NLBL_CIPSOV4_A_MLSCATLOC,
145 	/* (NLA_U32)
146 	 * the local MLS category */
147 	NLBL_CIPSOV4_A_MLSCATREM,
148 	/* (NLA_U32)
149 	 * the remote MLS category */
150 	NLBL_CIPSOV4_A_MLSCAT,
151 	/* (NLA_NESTED)
152 	 * a MLS category mapping, must contain only one attribute of each of
153 	 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
154 	 * NLBL_CIPSOV4_A_MLSCATREM */
155 	NLBL_CIPSOV4_A_MLSCATLST,
156 	/* (NLA_NESTED)
157 	 * the CIPSO category mappings, there must be at least one
158 	 * NLBL_CIPSOV4_A_MLSCAT attribute */
159 	__NLBL_CIPSOV4_A_MAX,
160 };
161 #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
162 
163 /* NetLabel protocol functions */
164 int netlbl_cipsov4_genl_init(void);
165 
166 /* Free the memory associated with a CIPSOv4 DOI definition */
167 void netlbl_cipsov4_doi_free(struct rcu_head *entry);
168 
169 #endif
170