1 /* 2 * NetLabel CIPSO/IPv4 Support 3 * 4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The 5 * NetLabel system manages static and dynamic label mappings for network 6 * protocols such as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul@paul-moore.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, see <http://www.gnu.org/licenses/>. 27 * 28 */ 29 30 #ifndef _NETLABEL_CIPSO_V4 31 #define _NETLABEL_CIPSO_V4 32 33 #include <net/netlabel.h> 34 35 /* 36 * The following NetLabel payloads are supported by the CIPSO subsystem. 37 * 38 * o ADD: 39 * Sent by an application to add a new DOI mapping table. 40 * 41 * Required attributes: 42 * 43 * NLBL_CIPSOV4_A_DOI 44 * NLBL_CIPSOV4_A_MTYPE 45 * NLBL_CIPSOV4_A_TAGLST 46 * 47 * If using CIPSO_V4_MAP_TRANS the following attributes are required: 48 * 49 * NLBL_CIPSOV4_A_MLSLVLLST 50 * NLBL_CIPSOV4_A_MLSCATLST 51 * 52 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes 53 * are required. 54 * 55 * o REMOVE: 56 * Sent by an application to remove a specific DOI mapping table from the 57 * CIPSO V4 system. 58 * 59 * Required attributes: 60 * 61 * NLBL_CIPSOV4_A_DOI 62 * 63 * o LIST: 64 * Sent by an application to list the details of a DOI definition. On 65 * success the kernel should send a response using the following format. 66 * 67 * Required attributes: 68 * 69 * NLBL_CIPSOV4_A_DOI 70 * 71 * The valid response message format depends on the type of the DOI mapping, 72 * the defined formats are shown below. 73 * 74 * Required attributes: 75 * 76 * NLBL_CIPSOV4_A_MTYPE 77 * NLBL_CIPSOV4_A_TAGLST 78 * 79 * If using CIPSO_V4_MAP_TRANS the following attributes are required: 80 * 81 * NLBL_CIPSOV4_A_MLSLVLLST 82 * NLBL_CIPSOV4_A_MLSCATLST 83 * 84 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes 85 * are required. 86 * 87 * o LISTALL: 88 * This message is sent by an application to list the valid DOIs on the 89 * system. When sent by an application there is no payload and the 90 * NLM_F_DUMP flag should be set. The kernel should respond with a series of 91 * the following messages. 92 * 93 * Required attributes: 94 * 95 * NLBL_CIPSOV4_A_DOI 96 * NLBL_CIPSOV4_A_MTYPE 97 * 98 */ 99 100 /* NetLabel CIPSOv4 commands */ 101 enum { 102 NLBL_CIPSOV4_C_UNSPEC, 103 NLBL_CIPSOV4_C_ADD, 104 NLBL_CIPSOV4_C_REMOVE, 105 NLBL_CIPSOV4_C_LIST, 106 NLBL_CIPSOV4_C_LISTALL, 107 __NLBL_CIPSOV4_C_MAX, 108 }; 109 110 /* NetLabel CIPSOv4 attributes */ 111 enum { 112 NLBL_CIPSOV4_A_UNSPEC, 113 NLBL_CIPSOV4_A_DOI, 114 /* (NLA_U32) 115 * the DOI value */ 116 NLBL_CIPSOV4_A_MTYPE, 117 /* (NLA_U32) 118 * the mapping table type (defined in the cipso_ipv4.h header as 119 * CIPSO_V4_MAP_*) */ 120 NLBL_CIPSOV4_A_TAG, 121 /* (NLA_U8) 122 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST 123 * attribute */ 124 NLBL_CIPSOV4_A_TAGLST, 125 /* (NLA_NESTED) 126 * the CIPSO tag list for the DOI, there must be at least one 127 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher 128 * priorirty when sending packets */ 129 NLBL_CIPSOV4_A_MLSLVLLOC, 130 /* (NLA_U32) 131 * the local MLS sensitivity level */ 132 NLBL_CIPSOV4_A_MLSLVLREM, 133 /* (NLA_U32) 134 * the remote MLS sensitivity level */ 135 NLBL_CIPSOV4_A_MLSLVL, 136 /* (NLA_NESTED) 137 * a MLS sensitivity level mapping, must contain only one attribute of 138 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and 139 * NLBL_CIPSOV4_A_MLSLVLREM */ 140 NLBL_CIPSOV4_A_MLSLVLLST, 141 /* (NLA_NESTED) 142 * the CIPSO level mappings, there must be at least one 143 * NLBL_CIPSOV4_A_MLSLVL attribute */ 144 NLBL_CIPSOV4_A_MLSCATLOC, 145 /* (NLA_U32) 146 * the local MLS category */ 147 NLBL_CIPSOV4_A_MLSCATREM, 148 /* (NLA_U32) 149 * the remote MLS category */ 150 NLBL_CIPSOV4_A_MLSCAT, 151 /* (NLA_NESTED) 152 * a MLS category mapping, must contain only one attribute of each of 153 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and 154 * NLBL_CIPSOV4_A_MLSCATREM */ 155 NLBL_CIPSOV4_A_MLSCATLST, 156 /* (NLA_NESTED) 157 * the CIPSO category mappings, there must be at least one 158 * NLBL_CIPSOV4_A_MLSCAT attribute */ 159 __NLBL_CIPSOV4_A_MAX, 160 }; 161 #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1) 162 163 /* NetLabel protocol functions */ 164 int netlbl_cipsov4_genl_init(void); 165 166 /* Free the memory associated with a CIPSOv4 DOI definition */ 167 void netlbl_cipsov4_doi_free(struct rcu_head *entry); 168 169 #endif 170