1 /*
2  * NetLabel CIPSO/IPv4 Support
3  *
4  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
5  * NetLabel system manages static and dynamic label mappings for network
6  * protocols such as CIPSO and RIPSO.
7  *
8  * Author: Paul Moore <paul.moore@hp.com>
9  *
10  */
11 
12 /*
13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14  *
15  * This program is free software;  you can redistribute it and/or modify
16  * it under the terms of the GNU General Public License as published by
17  * the Free Software Foundation; either version 2 of the License, or
18  * (at your option) any later version.
19  *
20  * This program is distributed in the hope that it will be useful,
21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
23  * the GNU General Public License for more details.
24  *
25  * You should have received a copy of the GNU General Public License
26  * along with this program;  if not, write to the Free Software
27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28  *
29  */
30 
31 #ifndef _NETLABEL_CIPSO_V4
32 #define _NETLABEL_CIPSO_V4
33 
34 #include <net/netlabel.h>
35 
36 /*
37  * The following NetLabel payloads are supported by the CIPSO subsystem.
38  *
39  * o ADD:
40  *   Sent by an application to add a new DOI mapping table.
41  *
42  *   Required attributes:
43  *
44  *     NLBL_CIPSOV4_A_DOI
45  *     NLBL_CIPSOV4_A_MTYPE
46  *     NLBL_CIPSOV4_A_TAGLST
47  *
48  *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
49  *
50  *     NLBL_CIPSOV4_A_MLSLVLLST
51  *     NLBL_CIPSOV4_A_MLSCATLST
52  *
53  *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
54  *   are required.
55  *
56  * o REMOVE:
57  *   Sent by an application to remove a specific DOI mapping table from the
58  *   CIPSO V4 system.
59  *
60  *   Required attributes:
61  *
62  *     NLBL_CIPSOV4_A_DOI
63  *
64  * o LIST:
65  *   Sent by an application to list the details of a DOI definition.  On
66  *   success the kernel should send a response using the following format.
67  *
68  *   Required attributes:
69  *
70  *     NLBL_CIPSOV4_A_DOI
71  *
72  *   The valid response message format depends on the type of the DOI mapping,
73  *   the defined formats are shown below.
74  *
75  *   Required attributes:
76  *
77  *     NLBL_CIPSOV4_A_MTYPE
78  *     NLBL_CIPSOV4_A_TAGLST
79  *
80  *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
81  *
82  *     NLBL_CIPSOV4_A_MLSLVLLST
83  *     NLBL_CIPSOV4_A_MLSCATLST
84  *
85  *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
86  *   are required.
87  *
88  * o LISTALL:
89  *   This message is sent by an application to list the valid DOIs on the
90  *   system.  When sent by an application there is no payload and the
91  *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
92  *   the following messages.
93  *
94  *   Required attributes:
95  *
96  *    NLBL_CIPSOV4_A_DOI
97  *    NLBL_CIPSOV4_A_MTYPE
98  *
99  */
100 
101 /* NetLabel CIPSOv4 commands */
102 enum {
103 	NLBL_CIPSOV4_C_UNSPEC,
104 	NLBL_CIPSOV4_C_ADD,
105 	NLBL_CIPSOV4_C_REMOVE,
106 	NLBL_CIPSOV4_C_LIST,
107 	NLBL_CIPSOV4_C_LISTALL,
108 	__NLBL_CIPSOV4_C_MAX,
109 };
110 #define NLBL_CIPSOV4_C_MAX (__NLBL_CIPSOV4_C_MAX - 1)
111 
112 /* NetLabel CIPSOv4 attributes */
113 enum {
114 	NLBL_CIPSOV4_A_UNSPEC,
115 	NLBL_CIPSOV4_A_DOI,
116 	/* (NLA_U32)
117 	 * the DOI value */
118 	NLBL_CIPSOV4_A_MTYPE,
119 	/* (NLA_U32)
120 	 * the mapping table type (defined in the cipso_ipv4.h header as
121 	 * CIPSO_V4_MAP_*) */
122 	NLBL_CIPSOV4_A_TAG,
123 	/* (NLA_U8)
124 	 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
125 	 * attribute */
126 	NLBL_CIPSOV4_A_TAGLST,
127 	/* (NLA_NESTED)
128 	 * the CIPSO tag list for the DOI, there must be at least one
129 	 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
130 	 * priorirty when sending packets */
131 	NLBL_CIPSOV4_A_MLSLVLLOC,
132 	/* (NLA_U32)
133 	 * the local MLS sensitivity level */
134 	NLBL_CIPSOV4_A_MLSLVLREM,
135 	/* (NLA_U32)
136 	 * the remote MLS sensitivity level */
137 	NLBL_CIPSOV4_A_MLSLVL,
138 	/* (NLA_NESTED)
139 	 * a MLS sensitivity level mapping, must contain only one attribute of
140 	 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
141 	 * NLBL_CIPSOV4_A_MLSLVLREM */
142 	NLBL_CIPSOV4_A_MLSLVLLST,
143 	/* (NLA_NESTED)
144 	 * the CIPSO level mappings, there must be at least one
145 	 * NLBL_CIPSOV4_A_MLSLVL attribute */
146 	NLBL_CIPSOV4_A_MLSCATLOC,
147 	/* (NLA_U32)
148 	 * the local MLS category */
149 	NLBL_CIPSOV4_A_MLSCATREM,
150 	/* (NLA_U32)
151 	 * the remote MLS category */
152 	NLBL_CIPSOV4_A_MLSCAT,
153 	/* (NLA_NESTED)
154 	 * a MLS category mapping, must contain only one attribute of each of
155 	 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
156 	 * NLBL_CIPSOV4_A_MLSCATREM */
157 	NLBL_CIPSOV4_A_MLSCATLST,
158 	/* (NLA_NESTED)
159 	 * the CIPSO category mappings, there must be at least one
160 	 * NLBL_CIPSOV4_A_MLSCAT attribute */
161 	__NLBL_CIPSOV4_A_MAX,
162 };
163 #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
164 
165 /* NetLabel protocol functions */
166 int netlbl_cipsov4_genl_init(void);
167 
168 /* Free the memory associated with a CIPSOv4 DOI definition */
169 void netlbl_cipsov4_doi_free(struct rcu_head *entry);
170 
171 #endif
172