| /* SPDX-License-Identifier: GPL-2.0-or-later */ | |
| /* | |
| * NetLabel Unlabeled Support | |
| * | |
| * This file defines functions for dealing with unlabeled packets for the | |
| * NetLabel system. The NetLabel system manages static and dynamic label | |
| * mappings for network protocols such as CIPSO and RIPSO. | |
| * | |
| * Author: Paul Moore <paul@paul-moore.com> | |
| */ | |
| /* | |
| * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
| */ | |
| #ifndef _NETLABEL_UNLABELED_H | |
| #define _NETLABEL_UNLABELED_H | |
| #include <net/netlabel.h> | |
| /* | |
| * The following NetLabel payloads are supported by the Unlabeled subsystem. | |
| * | |
| * o STATICADD | |
| * This message is sent from an application to add a new static label for | |
| * incoming unlabeled connections. | |
| * | |
| * Required attributes: | |
| * | |
| * NLBL_UNLABEL_A_IFACE | |
| * NLBL_UNLABEL_A_SECCTX | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o STATICREMOVE | |
| * This message is sent from an application to remove an existing static | |
| * label for incoming unlabeled connections. | |
| * | |
| * Required attributes: | |
| * | |
| * NLBL_UNLABEL_A_IFACE | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o STATICLIST | |
| * This message can be sent either from an application or by the kernel in | |
| * response to an application generated STATICLIST message. When sent by an | |
| * application there is no payload and the NLM_F_DUMP flag should be set. | |
| * The kernel should response with a series of the following messages. | |
| * | |
| * Required attributes: | |
| * | |
| * NLBL_UNLABEL_A_IFACE | |
| * NLBL_UNLABEL_A_SECCTX | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o STATICADDDEF | |
| * This message is sent from an application to set the default static | |
| * label for incoming unlabeled connections. | |
| * | |
| * Required attribute: | |
| * | |
| * NLBL_UNLABEL_A_SECCTX | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o STATICREMOVEDEF | |
| * This message is sent from an application to remove the existing default | |
| * static label for incoming unlabeled connections. | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o STATICLISTDEF | |
| * This message can be sent either from an application or by the kernel in | |
| * response to an application generated STATICLISTDEF message. When sent by | |
| * an application there is no payload and the NLM_F_DUMP flag should be set. | |
| * The kernel should response with the following message. | |
| * | |
| * Required attribute: | |
| * | |
| * NLBL_UNLABEL_A_SECCTX | |
| * | |
| * If IPv4 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV4ADDR | |
| * NLBL_UNLABEL_A_IPV4MASK | |
| * | |
| * If IPv6 is specified the following attributes are required: | |
| * | |
| * NLBL_UNLABEL_A_IPV6ADDR | |
| * NLBL_UNLABEL_A_IPV6MASK | |
| * | |
| * o ACCEPT | |
| * This message is sent from an application to specify if the kernel should | |
| * allow unlabled packets to pass if they do not match any of the static | |
| * mappings defined in the unlabeled module. | |
| * | |
| * Required attributes: | |
| * | |
| * NLBL_UNLABEL_A_ACPTFLG | |
| * | |
| * o LIST | |
| * This message can be sent either from an application or by the kernel in | |
| * response to an application generated LIST message. When sent by an | |
| * application there is no payload. The kernel should respond to a LIST | |
| * message with a LIST message on success. | |
| * | |
| * Required attributes: | |
| * | |
| * NLBL_UNLABEL_A_ACPTFLG | |
| * | |
| */ | |
| /* NetLabel Unlabeled commands */ | |
| enum { | |
| NLBL_UNLABEL_C_UNSPEC, | |
| NLBL_UNLABEL_C_ACCEPT, | |
| NLBL_UNLABEL_C_LIST, | |
| NLBL_UNLABEL_C_STATICADD, | |
| NLBL_UNLABEL_C_STATICREMOVE, | |
| NLBL_UNLABEL_C_STATICLIST, | |
| NLBL_UNLABEL_C_STATICADDDEF, | |
| NLBL_UNLABEL_C_STATICREMOVEDEF, | |
| NLBL_UNLABEL_C_STATICLISTDEF, | |
| __NLBL_UNLABEL_C_MAX, | |
| }; | |
| /* NetLabel Unlabeled attributes */ | |
| enum { | |
| NLBL_UNLABEL_A_UNSPEC, | |
| NLBL_UNLABEL_A_ACPTFLG, | |
| /* (NLA_U8) | |
| * if true then unlabeled packets are allowed to pass, else unlabeled | |
| * packets are rejected */ | |
| NLBL_UNLABEL_A_IPV6ADDR, | |
| /* (NLA_BINARY, struct in6_addr) | |
| * an IPv6 address */ | |
| NLBL_UNLABEL_A_IPV6MASK, | |
| /* (NLA_BINARY, struct in6_addr) | |
| * an IPv6 address mask */ | |
| NLBL_UNLABEL_A_IPV4ADDR, | |
| /* (NLA_BINARY, struct in_addr) | |
| * an IPv4 address */ | |
| NLBL_UNLABEL_A_IPV4MASK, | |
| /* (NLA_BINARY, struct in_addr) | |
| * and IPv4 address mask */ | |
| NLBL_UNLABEL_A_IFACE, | |
| /* (NLA_NULL_STRING) | |
| * network interface */ | |
| NLBL_UNLABEL_A_SECCTX, | |
| /* (NLA_BINARY) | |
| * a LSM specific security context */ | |
| __NLBL_UNLABEL_A_MAX, | |
| }; | |
| #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1) | |
| /* NetLabel protocol functions */ | |
| int netlbl_unlabel_genl_init(void); | |
| /* Unlabeled connection hash table size */ | |
| /* XXX - currently this number is an uneducated guess */ | |
| #define NETLBL_UNLHSH_BITSIZE 7 | |
| /* General Unlabeled init function */ | |
| int netlbl_unlabel_init(u32 size); | |
| /* Static/Fallback label management functions */ | |
| int netlbl_unlhsh_add(struct net *net, | |
| const char *dev_name, | |
| const void *addr, | |
| const void *mask, | |
| u32 addr_len, | |
| u32 secid, | |
| struct netlbl_audit *audit_info); | |
| int netlbl_unlhsh_remove(struct net *net, | |
| const char *dev_name, | |
| const void *addr, | |
| const void *mask, | |
| u32 addr_len, | |
| struct netlbl_audit *audit_info); | |
| /* Process Unlabeled incoming network packets */ | |
| int netlbl_unlabel_getattr(const struct sk_buff *skb, | |
| u16 family, | |
| struct netlbl_lsm_secattr *secattr); | |
| /* Set the default configuration to allow Unlabeled packets */ | |
| int netlbl_unlabel_defconf(void); | |
| #endif |