Blame view
net/netlabel/netlabel_unlabeled.h
6.3 KB
1ccea77e2 treewide: Replace... |
1 |
/* SPDX-License-Identifier: GPL-2.0-or-later */ |
d15c345fe [NetLabel]: core ... |
2 3 4 5 6 7 8 |
/* * NetLabel Unlabeled Support * * This file defines functions for dealing with unlabeled packets for the * NetLabel system. The NetLabel system manages static and dynamic label * mappings for network protocols such as CIPSO and RIPSO. * |
82c21bfab doc: Update the e... |
9 |
* Author: Paul Moore <paul@paul-moore.com> |
d15c345fe [NetLabel]: core ... |
10 11 12 13 |
*/ /* * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 |
d15c345fe [NetLabel]: core ... |
14 15 16 17 18 19 20 21 22 23 |
*/ #ifndef _NETLABEL_UNLABELED_H #define _NETLABEL_UNLABELED_H #include <net/netlabel.h> /* * The following NetLabel payloads are supported by the Unlabeled subsystem. * |
8cc44579d NetLabel: Introdu... |
24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 |
* o STATICADD * This message is sent from an application to add a new static label for * incoming unlabeled connections. * * Required attributes: * * NLBL_UNLABEL_A_IFACE * NLBL_UNLABEL_A_SECCTX * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * * o STATICREMOVE * This message is sent from an application to remove an existing static * label for incoming unlabeled connections. * * Required attributes: * * NLBL_UNLABEL_A_IFACE * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * * o STATICLIST * This message can be sent either from an application or by the kernel in * response to an application generated STATICLIST message. When sent by an * application there is no payload and the NLM_F_DUMP flag should be set. * The kernel should response with a series of the following messages. * * Required attributes: * * NLBL_UNLABEL_A_IFACE * NLBL_UNLABEL_A_SECCTX * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * * o STATICADDDEF * This message is sent from an application to set the default static * label for incoming unlabeled connections. * * Required attribute: * * NLBL_UNLABEL_A_SECCTX * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * * o STATICREMOVEDEF * This message is sent from an application to remove the existing default * static label for incoming unlabeled connections. * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * * o STATICLISTDEF * This message can be sent either from an application or by the kernel in * response to an application generated STATICLISTDEF message. When sent by * an application there is no payload and the NLM_F_DUMP flag should be set. * The kernel should response with the following message. * * Required attribute: * * NLBL_UNLABEL_A_SECCTX * * If IPv4 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV4ADDR * NLBL_UNLABEL_A_IPV4MASK * * If IPv6 is specified the following attributes are required: * * NLBL_UNLABEL_A_IPV6ADDR * NLBL_UNLABEL_A_IPV6MASK * |
d15c345fe [NetLabel]: core ... |
134 135 136 137 138 |
* o ACCEPT * This message is sent from an application to specify if the kernel should * allow unlabled packets to pass if they do not match any of the static * mappings defined in the unlabeled module. * |
fd3858554 [NetLabel]: rewor... |
139 |
* Required attributes: |
d15c345fe [NetLabel]: core ... |
140 |
* |
fd3858554 [NetLabel]: rewor... |
141 |
* NLBL_UNLABEL_A_ACPTFLG |
d15c345fe [NetLabel]: core ... |
142 143 144 145 146 |
* * o LIST * This message can be sent either from an application or by the kernel in * response to an application generated LIST message. When sent by an * application there is no payload. The kernel should respond to a LIST |
fd3858554 [NetLabel]: rewor... |
147 |
* message with a LIST message on success. |
d15c345fe [NetLabel]: core ... |
148 |
* |
fd3858554 [NetLabel]: rewor... |
149 |
* Required attributes: |
d15c345fe [NetLabel]: core ... |
150 |
* |
fd3858554 [NetLabel]: rewor... |
151 |
* NLBL_UNLABEL_A_ACPTFLG |
d15c345fe [NetLabel]: core ... |
152 153 154 155 156 157 |
* */ /* NetLabel Unlabeled commands */ enum { NLBL_UNLABEL_C_UNSPEC, |
d15c345fe [NetLabel]: core ... |
158 159 |
NLBL_UNLABEL_C_ACCEPT, NLBL_UNLABEL_C_LIST, |
8cc44579d NetLabel: Introdu... |
160 161 162 163 164 165 |
NLBL_UNLABEL_C_STATICADD, NLBL_UNLABEL_C_STATICREMOVE, NLBL_UNLABEL_C_STATICLIST, NLBL_UNLABEL_C_STATICADDDEF, NLBL_UNLABEL_C_STATICREMOVEDEF, NLBL_UNLABEL_C_STATICLISTDEF, |
d15c345fe [NetLabel]: core ... |
166 167 |
__NLBL_UNLABEL_C_MAX, }; |
d15c345fe [NetLabel]: core ... |
168 |
|
fd3858554 [NetLabel]: rewor... |
169 170 171 172 173 174 175 |
/* NetLabel Unlabeled attributes */ enum { NLBL_UNLABEL_A_UNSPEC, NLBL_UNLABEL_A_ACPTFLG, /* (NLA_U8) * if true then unlabeled packets are allowed to pass, else unlabeled * packets are rejected */ |
8cc44579d NetLabel: Introdu... |
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 |
NLBL_UNLABEL_A_IPV6ADDR, /* (NLA_BINARY, struct in6_addr) * an IPv6 address */ NLBL_UNLABEL_A_IPV6MASK, /* (NLA_BINARY, struct in6_addr) * an IPv6 address mask */ NLBL_UNLABEL_A_IPV4ADDR, /* (NLA_BINARY, struct in_addr) * an IPv4 address */ NLBL_UNLABEL_A_IPV4MASK, /* (NLA_BINARY, struct in_addr) * and IPv4 address mask */ NLBL_UNLABEL_A_IFACE, /* (NLA_NULL_STRING) * network interface */ NLBL_UNLABEL_A_SECCTX, /* (NLA_BINARY) * a LSM specific security context */ |
fd3858554 [NetLabel]: rewor... |
194 195 196 |
__NLBL_UNLABEL_A_MAX, }; #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1) |
d15c345fe [NetLabel]: core ... |
197 198 |
/* NetLabel protocol functions */ int netlbl_unlabel_genl_init(void); |
8cc44579d NetLabel: Introdu... |
199 200 201 202 203 204 |
/* Unlabeled connection hash table size */ /* XXX - currently this number is an uneducated guess */ #define NETLBL_UNLHSH_BITSIZE 7 /* General Unlabeled init function */ int netlbl_unlabel_init(u32 size); |
6c2e8ac09 netlabel: Update ... |
205 206 207 208 209 210 211 212 213 214 215 216 217 218 |
/* Static/Fallback label management functions */ int netlbl_unlhsh_add(struct net *net, const char *dev_name, const void *addr, const void *mask, u32 addr_len, u32 secid, struct netlbl_audit *audit_info); int netlbl_unlhsh_remove(struct net *net, const char *dev_name, const void *addr, const void *mask, u32 addr_len, struct netlbl_audit *audit_info); |
d15c345fe [NetLabel]: core ... |
219 |
/* Process Unlabeled incoming network packets */ |
8cc44579d NetLabel: Introdu... |
220 221 222 |
int netlbl_unlabel_getattr(const struct sk_buff *skb, u16 family, struct netlbl_lsm_secattr *secattr); |
d15c345fe [NetLabel]: core ... |
223 224 225 226 227 |
/* Set the default configuration to allow Unlabeled packets */ int netlbl_unlabel_defconf(void); #endif |