1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
2 | /* |
3 | * NetLabel CIPSO/IPv4 Support |
4 | * |
5 | * This file defines the CIPSO/IPv4 functions for the NetLabel system. The |
6 | * NetLabel system manages static and dynamic label mappings for network |
7 | * protocols such as CIPSO and RIPSO. |
8 | * |
9 | * Author: Paul Moore <paul@paul-moore.com> |
10 | */ |
11 | |
12 | /* |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 |
14 | */ |
15 | |
16 | #ifndef _NETLABEL_CIPSO_V4 |
17 | #define _NETLABEL_CIPSO_V4 |
18 | |
19 | #include <net/netlabel.h> |
20 | |
21 | /* |
22 | * The following NetLabel payloads are supported by the CIPSO subsystem. |
23 | * |
24 | * o ADD: |
25 | * Sent by an application to add a new DOI mapping table. |
26 | * |
27 | * Required attributes: |
28 | * |
29 | * NLBL_CIPSOV4_A_DOI |
30 | * NLBL_CIPSOV4_A_MTYPE |
31 | * NLBL_CIPSOV4_A_TAGLST |
32 | * |
33 | * If using CIPSO_V4_MAP_TRANS the following attributes are required: |
34 | * |
35 | * NLBL_CIPSOV4_A_MLSLVLLST |
36 | * NLBL_CIPSOV4_A_MLSCATLST |
37 | * |
38 | * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes |
39 | * are required. |
40 | * |
41 | * o REMOVE: |
42 | * Sent by an application to remove a specific DOI mapping table from the |
43 | * CIPSO V4 system. |
44 | * |
45 | * Required attributes: |
46 | * |
47 | * NLBL_CIPSOV4_A_DOI |
48 | * |
49 | * o LIST: |
50 | * Sent by an application to list the details of a DOI definition. On |
51 | * success the kernel should send a response using the following format. |
52 | * |
53 | * Required attributes: |
54 | * |
55 | * NLBL_CIPSOV4_A_DOI |
56 | * |
57 | * The valid response message format depends on the type of the DOI mapping, |
58 | * the defined formats are shown below. |
59 | * |
60 | * Required attributes: |
61 | * |
62 | * NLBL_CIPSOV4_A_MTYPE |
63 | * NLBL_CIPSOV4_A_TAGLST |
64 | * |
65 | * If using CIPSO_V4_MAP_TRANS the following attributes are required: |
66 | * |
67 | * NLBL_CIPSOV4_A_MLSLVLLST |
68 | * NLBL_CIPSOV4_A_MLSCATLST |
69 | * |
70 | * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes |
71 | * are required. |
72 | * |
73 | * o LISTALL: |
74 | * This message is sent by an application to list the valid DOIs on the |
75 | * system. When sent by an application there is no payload and the |
76 | * NLM_F_DUMP flag should be set. The kernel should respond with a series of |
77 | * the following messages. |
78 | * |
79 | * Required attributes: |
80 | * |
81 | * NLBL_CIPSOV4_A_DOI |
82 | * NLBL_CIPSOV4_A_MTYPE |
83 | * |
84 | */ |
85 | |
86 | /* NetLabel CIPSOv4 commands */ |
87 | enum { |
88 | NLBL_CIPSOV4_C_UNSPEC, |
89 | NLBL_CIPSOV4_C_ADD, |
90 | NLBL_CIPSOV4_C_REMOVE, |
91 | NLBL_CIPSOV4_C_LIST, |
92 | NLBL_CIPSOV4_C_LISTALL, |
93 | __NLBL_CIPSOV4_C_MAX, |
94 | }; |
95 | |
96 | /* NetLabel CIPSOv4 attributes */ |
97 | enum { |
98 | NLBL_CIPSOV4_A_UNSPEC, |
99 | NLBL_CIPSOV4_A_DOI, |
100 | /* (NLA_U32) |
101 | * the DOI value */ |
102 | NLBL_CIPSOV4_A_MTYPE, |
103 | /* (NLA_U32) |
104 | * the mapping table type (defined in the cipso_ipv4.h header as |
105 | * CIPSO_V4_MAP_*) */ |
106 | NLBL_CIPSOV4_A_TAG, |
107 | /* (NLA_U8) |
108 | * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST |
109 | * attribute */ |
110 | NLBL_CIPSOV4_A_TAGLST, |
111 | /* (NLA_NESTED) |
112 | * the CIPSO tag list for the DOI, there must be at least one |
113 | * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher |
114 | * priorirty when sending packets */ |
115 | NLBL_CIPSOV4_A_MLSLVLLOC, |
116 | /* (NLA_U32) |
117 | * the local MLS sensitivity level */ |
118 | NLBL_CIPSOV4_A_MLSLVLREM, |
119 | /* (NLA_U32) |
120 | * the remote MLS sensitivity level */ |
121 | NLBL_CIPSOV4_A_MLSLVL, |
122 | /* (NLA_NESTED) |
123 | * a MLS sensitivity level mapping, must contain only one attribute of |
124 | * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and |
125 | * NLBL_CIPSOV4_A_MLSLVLREM */ |
126 | NLBL_CIPSOV4_A_MLSLVLLST, |
127 | /* (NLA_NESTED) |
128 | * the CIPSO level mappings, there must be at least one |
129 | * NLBL_CIPSOV4_A_MLSLVL attribute */ |
130 | NLBL_CIPSOV4_A_MLSCATLOC, |
131 | /* (NLA_U32) |
132 | * the local MLS category */ |
133 | NLBL_CIPSOV4_A_MLSCATREM, |
134 | /* (NLA_U32) |
135 | * the remote MLS category */ |
136 | NLBL_CIPSOV4_A_MLSCAT, |
137 | /* (NLA_NESTED) |
138 | * a MLS category mapping, must contain only one attribute of each of |
139 | * the following types: NLBL_CIPSOV4_A_MLSCATLOC and |
140 | * NLBL_CIPSOV4_A_MLSCATREM */ |
141 | NLBL_CIPSOV4_A_MLSCATLST, |
142 | /* (NLA_NESTED) |
143 | * the CIPSO category mappings, there must be at least one |
144 | * NLBL_CIPSOV4_A_MLSCAT attribute */ |
145 | __NLBL_CIPSOV4_A_MAX, |
146 | }; |
147 | #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1) |
148 | |
149 | /* NetLabel protocol functions */ |
150 | int netlbl_cipsov4_genl_init(void); |
151 | |
152 | #endif |
153 | |