1/* 2 * NetLabel CIPSO/IPv4 Support 3 * 4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The 5 * NetLabel system manages static and dynamic label mappings for network 6 * protocols such as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12/* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31#ifndef _NETLABEL_CIPSO_V4 32#define _NETLABEL_CIPSO_V4 33 34#include <net/netlabel.h> 35 36/* 37 * The following NetLabel payloads are supported by the CIPSO subsystem. 38 * 39 * o ADD: 40 * Sent by an application to add a new DOI mapping table. 41 * 42 * Required attributes: 43 * 44 * NLBL_CIPSOV4_A_DOI 45 * NLBL_CIPSOV4_A_MTYPE 46 * NLBL_CIPSOV4_A_TAGLST 47 * 48 * If using CIPSO_V4_MAP_TRANS the following attributes are required: 49 * 50 * NLBL_CIPSOV4_A_MLSLVLLST 51 * NLBL_CIPSOV4_A_MLSCATLST 52 * 53 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes 54 * are required. 55 * 56 * o REMOVE: 57 * Sent by an application to remove a specific DOI mapping table from the 58 * CIPSO V4 system. 59 * 60 * Required attributes: 61 * 62 * NLBL_CIPSOV4_A_DOI 63 * 64 * o LIST: 65 * Sent by an application to list the details of a DOI definition. On 66 * success the kernel should send a response using the following format. 67 * 68 * Required attributes: 69 * 70 * NLBL_CIPSOV4_A_DOI 71 * 72 * The valid response message format depends on the type of the DOI mapping, 73 * the defined formats are shown below. 74 * 75 * Required attributes: 76 * 77 * NLBL_CIPSOV4_A_MTYPE 78 * NLBL_CIPSOV4_A_TAGLST 79 * 80 * If using CIPSO_V4_MAP_TRANS the following attributes are required: 81 * 82 * NLBL_CIPSOV4_A_MLSLVLLST 83 * NLBL_CIPSOV4_A_MLSCATLST 84 * 85 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes 86 * are required. 87 * 88 * o LISTALL: 89 * This message is sent by an application to list the valid DOIs on the 90 * system. When sent by an application there is no payload and the 91 * NLM_F_DUMP flag should be set. The kernel should respond with a series of 92 * the following messages. 93 * 94 * Required attributes: 95 * 96 * NLBL_CIPSOV4_A_DOI 97 * NLBL_CIPSOV4_A_MTYPE 98 * 99 */ 100 101/* NetLabel CIPSOv4 commands */ 102enum { 103 NLBL_CIPSOV4_C_UNSPEC, 104 NLBL_CIPSOV4_C_ADD, 105 NLBL_CIPSOV4_C_REMOVE, 106 NLBL_CIPSOV4_C_LIST, 107 NLBL_CIPSOV4_C_LISTALL, 108 __NLBL_CIPSOV4_C_MAX, 109}; 110#define NLBL_CIPSOV4_C_MAX (__NLBL_CIPSOV4_C_MAX - 1) 111 112/* NetLabel CIPSOv4 attributes */ 113enum { 114 NLBL_CIPSOV4_A_UNSPEC, 115 NLBL_CIPSOV4_A_DOI, 116 /* (NLA_U32) 117 * the DOI value */ 118 NLBL_CIPSOV4_A_MTYPE, 119 /* (NLA_U32) 120 * the mapping table type (defined in the cipso_ipv4.h header as 121 * CIPSO_V4_MAP_*) */ 122 NLBL_CIPSOV4_A_TAG, 123 /* (NLA_U8) 124 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST 125 * attribute */ 126 NLBL_CIPSOV4_A_TAGLST, 127 /* (NLA_NESTED) 128 * the CIPSO tag list for the DOI, there must be at least one 129 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher 130 * priorirty when sending packets */ 131 NLBL_CIPSOV4_A_MLSLVLLOC, 132 /* (NLA_U32) 133 * the local MLS sensitivity level */ 134 NLBL_CIPSOV4_A_MLSLVLREM, 135 /* (NLA_U32) 136 * the remote MLS sensitivity level */ 137 NLBL_CIPSOV4_A_MLSLVL, 138 /* (NLA_NESTED) 139 * a MLS sensitivity level mapping, must contain only one attribute of 140 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and 141 * NLBL_CIPSOV4_A_MLSLVLREM */ 142 NLBL_CIPSOV4_A_MLSLVLLST, 143 /* (NLA_NESTED) 144 * the CIPSO level mappings, there must be at least one 145 * NLBL_CIPSOV4_A_MLSLVL attribute */ 146 NLBL_CIPSOV4_A_MLSCATLOC, 147 /* (NLA_U32) 148 * the local MLS category */ 149 NLBL_CIPSOV4_A_MLSCATREM, 150 /* (NLA_U32) 151 * the remote MLS category */ 152 NLBL_CIPSOV4_A_MLSCAT, 153 /* (NLA_NESTED) 154 * a MLS category mapping, must contain only one attribute of each of 155 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and 156 * NLBL_CIPSOV4_A_MLSCATREM */ 157 NLBL_CIPSOV4_A_MLSCATLST, 158 /* (NLA_NESTED) 159 * the CIPSO category mappings, there must be at least one 160 * NLBL_CIPSOV4_A_MLSCAT attribute */ 161 __NLBL_CIPSOV4_A_MAX, 162}; 163#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1) 164 165/* NetLabel protocol functions */ 166int netlbl_cipsov4_genl_init(void); 167 168/* Free the memory associated with a CIPSOv4 DOI definition */ 169void netlbl_cipsov4_doi_free(struct rcu_head *entry); 170 171#endif 172