Root/
1 | /* |
2 | * NetLabel Unlabeled Support |
3 | * |
4 | * This file defines functions for dealing with unlabeled packets for the |
5 | * NetLabel system. The NetLabel system manages static and dynamic label |
6 | * mappings for network protocols such as CIPSO and RIPSO. |
7 | * |
8 | * Author: Paul Moore <paul.moore@hp.com> |
9 | * |
10 | */ |
11 | |
12 | /* |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 |
14 | * |
15 | * This program is free software; you can redistribute it and/or modify |
16 | * it under the terms of the GNU General Public License as published by |
17 | * the Free Software Foundation; either version 2 of the License, or |
18 | * (at your option) any later version. |
19 | * |
20 | * This program is distributed in the hope that it will be useful, |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
23 | * the GNU General Public License for more details. |
24 | * |
25 | * You should have received a copy of the GNU General Public License |
26 | * along with this program; if not, write to the Free Software |
27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
28 | * |
29 | */ |
30 | |
31 | #ifndef _NETLABEL_UNLABELED_H |
32 | #define _NETLABEL_UNLABELED_H |
33 | |
34 | #include <net/netlabel.h> |
35 | |
36 | /* |
37 | * The following NetLabel payloads are supported by the Unlabeled subsystem. |
38 | * |
39 | * o STATICADD |
40 | * This message is sent from an application to add a new static label for |
41 | * incoming unlabeled connections. |
42 | * |
43 | * Required attributes: |
44 | * |
45 | * NLBL_UNLABEL_A_IFACE |
46 | * NLBL_UNLABEL_A_SECCTX |
47 | * |
48 | * If IPv4 is specified the following attributes are required: |
49 | * |
50 | * NLBL_UNLABEL_A_IPV4ADDR |
51 | * NLBL_UNLABEL_A_IPV4MASK |
52 | * |
53 | * If IPv6 is specified the following attributes are required: |
54 | * |
55 | * NLBL_UNLABEL_A_IPV6ADDR |
56 | * NLBL_UNLABEL_A_IPV6MASK |
57 | * |
58 | * o STATICREMOVE |
59 | * This message is sent from an application to remove an existing static |
60 | * label for incoming unlabeled connections. |
61 | * |
62 | * Required attributes: |
63 | * |
64 | * NLBL_UNLABEL_A_IFACE |
65 | * |
66 | * If IPv4 is specified the following attributes are required: |
67 | * |
68 | * NLBL_UNLABEL_A_IPV4ADDR |
69 | * NLBL_UNLABEL_A_IPV4MASK |
70 | * |
71 | * If IPv6 is specified the following attributes are required: |
72 | * |
73 | * NLBL_UNLABEL_A_IPV6ADDR |
74 | * NLBL_UNLABEL_A_IPV6MASK |
75 | * |
76 | * o STATICLIST |
77 | * This message can be sent either from an application or by the kernel in |
78 | * response to an application generated STATICLIST message. When sent by an |
79 | * application there is no payload and the NLM_F_DUMP flag should be set. |
80 | * The kernel should response with a series of the following messages. |
81 | * |
82 | * Required attributes: |
83 | * |
84 | * NLBL_UNLABEL_A_IFACE |
85 | * NLBL_UNLABEL_A_SECCTX |
86 | * |
87 | * If IPv4 is specified the following attributes are required: |
88 | * |
89 | * NLBL_UNLABEL_A_IPV4ADDR |
90 | * NLBL_UNLABEL_A_IPV4MASK |
91 | * |
92 | * If IPv6 is specified the following attributes are required: |
93 | * |
94 | * NLBL_UNLABEL_A_IPV6ADDR |
95 | * NLBL_UNLABEL_A_IPV6MASK |
96 | * |
97 | * o STATICADDDEF |
98 | * This message is sent from an application to set the default static |
99 | * label for incoming unlabeled connections. |
100 | * |
101 | * Required attribute: |
102 | * |
103 | * NLBL_UNLABEL_A_SECCTX |
104 | * |
105 | * If IPv4 is specified the following attributes are required: |
106 | * |
107 | * NLBL_UNLABEL_A_IPV4ADDR |
108 | * NLBL_UNLABEL_A_IPV4MASK |
109 | * |
110 | * If IPv6 is specified the following attributes are required: |
111 | * |
112 | * NLBL_UNLABEL_A_IPV6ADDR |
113 | * NLBL_UNLABEL_A_IPV6MASK |
114 | * |
115 | * o STATICREMOVEDEF |
116 | * This message is sent from an application to remove the existing default |
117 | * static label for incoming unlabeled connections. |
118 | * |
119 | * If IPv4 is specified the following attributes are required: |
120 | * |
121 | * NLBL_UNLABEL_A_IPV4ADDR |
122 | * NLBL_UNLABEL_A_IPV4MASK |
123 | * |
124 | * If IPv6 is specified the following attributes are required: |
125 | * |
126 | * NLBL_UNLABEL_A_IPV6ADDR |
127 | * NLBL_UNLABEL_A_IPV6MASK |
128 | * |
129 | * o STATICLISTDEF |
130 | * This message can be sent either from an application or by the kernel in |
131 | * response to an application generated STATICLISTDEF message. When sent by |
132 | * an application there is no payload and the NLM_F_DUMP flag should be set. |
133 | * The kernel should response with the following message. |
134 | * |
135 | * Required attribute: |
136 | * |
137 | * NLBL_UNLABEL_A_SECCTX |
138 | * |
139 | * If IPv4 is specified the following attributes are required: |
140 | * |
141 | * NLBL_UNLABEL_A_IPV4ADDR |
142 | * NLBL_UNLABEL_A_IPV4MASK |
143 | * |
144 | * If IPv6 is specified the following attributes are required: |
145 | * |
146 | * NLBL_UNLABEL_A_IPV6ADDR |
147 | * NLBL_UNLABEL_A_IPV6MASK |
148 | * |
149 | * o ACCEPT |
150 | * This message is sent from an application to specify if the kernel should |
151 | * allow unlabled packets to pass if they do not match any of the static |
152 | * mappings defined in the unlabeled module. |
153 | * |
154 | * Required attributes: |
155 | * |
156 | * NLBL_UNLABEL_A_ACPTFLG |
157 | * |
158 | * o LIST |
159 | * This message can be sent either from an application or by the kernel in |
160 | * response to an application generated LIST message. When sent by an |
161 | * application there is no payload. The kernel should respond to a LIST |
162 | * message with a LIST message on success. |
163 | * |
164 | * Required attributes: |
165 | * |
166 | * NLBL_UNLABEL_A_ACPTFLG |
167 | * |
168 | */ |
169 | |
170 | /* NetLabel Unlabeled commands */ |
171 | enum { |
172 | NLBL_UNLABEL_C_UNSPEC, |
173 | NLBL_UNLABEL_C_ACCEPT, |
174 | NLBL_UNLABEL_C_LIST, |
175 | NLBL_UNLABEL_C_STATICADD, |
176 | NLBL_UNLABEL_C_STATICREMOVE, |
177 | NLBL_UNLABEL_C_STATICLIST, |
178 | NLBL_UNLABEL_C_STATICADDDEF, |
179 | NLBL_UNLABEL_C_STATICREMOVEDEF, |
180 | NLBL_UNLABEL_C_STATICLISTDEF, |
181 | __NLBL_UNLABEL_C_MAX, |
182 | }; |
183 | |
184 | /* NetLabel Unlabeled attributes */ |
185 | enum { |
186 | NLBL_UNLABEL_A_UNSPEC, |
187 | NLBL_UNLABEL_A_ACPTFLG, |
188 | /* (NLA_U8) |
189 | * if true then unlabeled packets are allowed to pass, else unlabeled |
190 | * packets are rejected */ |
191 | NLBL_UNLABEL_A_IPV6ADDR, |
192 | /* (NLA_BINARY, struct in6_addr) |
193 | * an IPv6 address */ |
194 | NLBL_UNLABEL_A_IPV6MASK, |
195 | /* (NLA_BINARY, struct in6_addr) |
196 | * an IPv6 address mask */ |
197 | NLBL_UNLABEL_A_IPV4ADDR, |
198 | /* (NLA_BINARY, struct in_addr) |
199 | * an IPv4 address */ |
200 | NLBL_UNLABEL_A_IPV4MASK, |
201 | /* (NLA_BINARY, struct in_addr) |
202 | * and IPv4 address mask */ |
203 | NLBL_UNLABEL_A_IFACE, |
204 | /* (NLA_NULL_STRING) |
205 | * network interface */ |
206 | NLBL_UNLABEL_A_SECCTX, |
207 | /* (NLA_BINARY) |
208 | * a LSM specific security context */ |
209 | __NLBL_UNLABEL_A_MAX, |
210 | }; |
211 | #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1) |
212 | |
213 | /* NetLabel protocol functions */ |
214 | int netlbl_unlabel_genl_init(void); |
215 | |
216 | /* Unlabeled connection hash table size */ |
217 | /* XXX - currently this number is an uneducated guess */ |
218 | #define NETLBL_UNLHSH_BITSIZE 7 |
219 | |
220 | /* General Unlabeled init function */ |
221 | int netlbl_unlabel_init(u32 size); |
222 | |
223 | /* Static/Fallback label management functions */ |
224 | int netlbl_unlhsh_add(struct net *net, |
225 | const char *dev_name, |
226 | const void *addr, |
227 | const void *mask, |
228 | u32 addr_len, |
229 | u32 secid, |
230 | struct netlbl_audit *audit_info); |
231 | int netlbl_unlhsh_remove(struct net *net, |
232 | const char *dev_name, |
233 | const void *addr, |
234 | const void *mask, |
235 | u32 addr_len, |
236 | struct netlbl_audit *audit_info); |
237 | |
238 | /* Process Unlabeled incoming network packets */ |
239 | int netlbl_unlabel_getattr(const struct sk_buff *skb, |
240 | u16 family, |
241 | struct netlbl_lsm_secattr *secattr); |
242 | |
243 | /* Set the default configuration to allow Unlabeled packets */ |
244 | int netlbl_unlabel_defconf(void); |
245 | |
246 | #endif |
247 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9