aboutsummaryrefslogtreecommitdiffstats
path: root/include/net/cipso_ipv4.h
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2006-08-03 19:46:20 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-09-22 17:53:32 -0400
commit11a03f78fbf15a866ba3bf6359a75cdfd1ced703 (patch)
tree49c4c35124c05826a940fba6633dd815985cf8a9 /include/net/cipso_ipv4.h
parent8802f616f6de8576805f32e47602816f141118f2 (diff)
[NetLabel]: core network changes
Changes to the core network stack to support the NetLabel subsystem. This includes changes to the IPv4 option handling to support CIPSO labels. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/cipso_ipv4.h')
-rw-r--r--include/net/cipso_ipv4.h250
1 files changed, 250 insertions, 0 deletions
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
new file mode 100644
index 000000000000..c7175e725804
--- /dev/null
+++ b/include/net/cipso_ipv4.h
@@ -0,0 +1,250 @@
1/*
2 * CIPSO - Commercial IP Security Option
3 *
4 * This is an implementation of the CIPSO 2.2 protocol as specified in
5 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
6 * FIPS-188, copies of both documents can be found in the Documentation
7 * directory. While CIPSO never became a full IETF RFC standard many vendors
8 * have chosen to adopt the protocol and over the years it has become a
9 * de-facto standard for labeled networking.
10 *
11 * Author: Paul Moore <paul.moore@hp.com>
12 *
13 */
14
15/*
16 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License as published by
20 * the Free Software Foundation; either version 2 of the License, or
21 * (at your option) any later version.
22 *
23 * This program is distributed in the hope that it will be useful,
24 * but WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
26 * the GNU General Public License for more details.
27 *
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, write to the Free Software
30 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 *
32 */
33
34#ifndef _CIPSO_IPV4_H
35#define _CIPSO_IPV4_H
36
37#include <linux/types.h>
38#include <linux/rcupdate.h>
39#include <linux/list.h>
40#include <net/netlabel.h>
41
42/* known doi values */
43#define CIPSO_V4_DOI_UNKNOWN 0x00000000
44
45/* tag types */
46#define CIPSO_V4_TAG_INVALID 0
47#define CIPSO_V4_TAG_RBITMAP 1
48#define CIPSO_V4_TAG_ENUM 2
49#define CIPSO_V4_TAG_RANGE 5
50#define CIPSO_V4_TAG_PBITMAP 6
51#define CIPSO_V4_TAG_FREEFORM 7
52
53/* doi mapping types */
54#define CIPSO_V4_MAP_UNKNOWN 0
55#define CIPSO_V4_MAP_STD 1
56#define CIPSO_V4_MAP_PASS 2
57
58/* limits */
59#define CIPSO_V4_MAX_REM_LVLS 256
60#define CIPSO_V4_INV_LVL 0x80000000
61#define CIPSO_V4_MAX_LOC_LVLS (CIPSO_V4_INV_LVL - 1)
62#define CIPSO_V4_MAX_REM_CATS 65536
63#define CIPSO_V4_INV_CAT 0x80000000
64#define CIPSO_V4_MAX_LOC_CATS (CIPSO_V4_INV_CAT - 1)
65
66/*
67 * CIPSO DOI definitions
68 */
69
70/* DOI definition struct */
71#define CIPSO_V4_TAG_MAXCNT 5
72struct cipso_v4_doi {
73 u32 doi;
74 u32 type;
75 union {
76 struct cipso_v4_std_map_tbl *std;
77 } map;
78 u8 tags[CIPSO_V4_TAG_MAXCNT];
79
80 u32 valid;
81 struct list_head list;
82 struct rcu_head rcu;
83 struct list_head dom_list;
84};
85
86/* Standard CIPSO mapping table */
87/* NOTE: the highest order bit (i.e. 0x80000000) is an 'invalid' flag, if the
88 * bit is set then consider that value as unspecified, meaning the
89 * mapping for that particular level/category is invalid */
90struct cipso_v4_std_map_tbl {
91 struct {
92 u32 *cipso;
93 u32 *local;
94 u32 cipso_size;
95 u32 local_size;
96 } lvl;
97 struct {
98 u32 *cipso;
99 u32 *local;
100 u32 cipso_size;
101 u32 local_size;
102 } cat;
103};
104
105/*
106 * Sysctl Variables
107 */
108
109#ifdef CONFIG_NETLABEL
110extern int cipso_v4_cache_enabled;
111extern int cipso_v4_cache_bucketsize;
112extern int cipso_v4_rbm_optfmt;
113extern int cipso_v4_rbm_strictvalid;
114#endif
115
116/*
117 * Helper Functions
118 */
119
120#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
121#define CIPSO_V4_OPTPTR(x) ((x)->nh.raw + IPCB(x)->opt.cipso)
122
123/*
124 * DOI List Functions
125 */
126
127#ifdef CONFIG_NETLABEL
128int cipso_v4_doi_add(struct cipso_v4_doi *doi_def);
129int cipso_v4_doi_remove(u32 doi, void (*callback) (struct rcu_head * head));
130struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
131struct sk_buff *cipso_v4_doi_dump_all(size_t headroom);
132struct sk_buff *cipso_v4_doi_dump(u32 doi, size_t headroom);
133int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain);
134int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
135 const char *domain);
136#else
137static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
138{
139 return -ENOSYS;
140}
141
142static inline int cipso_v4_doi_remove(u32 doi,
143 void (*callback) (struct rcu_head * head))
144{
145 return 0;
146}
147
148static inline struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
149{
150 return NULL;
151}
152
153static inline struct sk_buff *cipso_v4_doi_dump_all(size_t headroom)
154{
155 return NULL;
156}
157
158static inline struct sk_buff *cipso_v4_doi_dump(u32 doi, size_t headroom)
159{
160 return NULL;
161}
162
163static inline int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def,
164 const char *domain)
165{
166 return -ENOSYS;
167}
168
169static inline int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
170 const char *domain)
171{
172 return 0;
173}
174#endif /* CONFIG_NETLABEL */
175
176/*
177 * Label Mapping Cache Functions
178 */
179
180#ifdef CONFIG_NETLABEL
181void cipso_v4_cache_invalidate(void);
182int cipso_v4_cache_add(const struct sk_buff *skb,
183 const struct netlbl_lsm_secattr *secattr);
184#else
185static inline void cipso_v4_cache_invalidate(void)
186{
187 return;
188}
189
190static inline int cipso_v4_cache_add(const struct sk_buff *skb,
191 const struct netlbl_lsm_secattr *secattr)
192{
193 return 0;
194}
195#endif /* CONFIG_NETLABEL */
196
197/*
198 * Protocol Handling Functions
199 */
200
201#ifdef CONFIG_NETLABEL
202void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
203int cipso_v4_socket_setopt(struct socket *sock,
204 unsigned char *opt,
205 u32 opt_len);
206int cipso_v4_socket_setattr(const struct socket *sock,
207 const struct cipso_v4_doi *doi_def,
208 const struct netlbl_lsm_secattr *secattr);
209int cipso_v4_socket_getopt(const struct socket *sock,
210 unsigned char **opt,
211 u32 *opt_len);
212int cipso_v4_socket_getattr(const struct socket *sock,
213 struct netlbl_lsm_secattr *secattr);
214int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
215 struct netlbl_lsm_secattr *secattr);
216int cipso_v4_validate(unsigned char **option);
217#else
218static inline void cipso_v4_error(struct sk_buff *skb,
219 int error,
220 u32 gateway)
221{
222 return;
223}
224
225static inline int cipso_v4_socket_setattr(const struct socket *sock,
226 const struct cipso_v4_doi *doi_def,
227 const struct netlbl_lsm_secattr *secattr)
228{
229 return -ENOSYS;
230}
231
232static inline int cipso_v4_socket_getattr(const struct socket *sock,
233 struct netlbl_lsm_secattr *secattr)
234{
235 return -ENOSYS;
236}
237
238static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
239 struct netlbl_lsm_secattr *secattr)
240{
241 return -ENOSYS;
242}
243
244static inline int cipso_v4_validate(unsigned char **option)
245{
246 return -ENOSYS;
247}
248#endif /* CONFIG_NETLABEL */
249
250#endif /* _CIPSO_IPV4_H */