1 /* 2 * NetLabel System 3 * 4 * The NetLabel system manages static and dynamic label mappings for network 5 * protocols such as CIPSO and RIPSO. 6 * 7 * Author: Paul Moore <paul.moore@hp.com> 8 * 9 */ 10 11 /* 12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License as published by 16 * the Free Software Foundation; either version 2 of the License, or 17 * (at your option) any later version. 18 * 19 * This program is distributed in the hope that it will be useful, 20 * but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 22 * the GNU General Public License for more details. 23 * 24 * You should have received a copy of the GNU General Public License 25 * along with this program; if not, write to the Free Software 26 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 27 * 28 */ 29 30 #ifndef _NETLABEL_H 31 #define _NETLABEL_H 32 33 #include <linux/types.h> 34 #include <linux/net.h> 35 #include <linux/skbuff.h> 36 #include <net/netlink.h> 37 38 /* 39 * NetLabel - A management interface for maintaining network packet label 40 * mapping tables for explicit packet labling protocols. 41 * 42 * Network protocols such as CIPSO and RIPSO require a label translation layer 43 * to convert the label on the packet into something meaningful on the host 44 * machine. In the current Linux implementation these mapping tables live 45 * inside the kernel; NetLabel provides a mechanism for user space applications 46 * to manage these mapping tables. 47 * 48 * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to 49 * send messages between kernel and user space. The general format of a 50 * NetLabel message is shown below: 51 * 52 * +-----------------+-------------------+--------- --- -- - 53 * | struct nlmsghdr | struct genlmsghdr | payload 54 * +-----------------+-------------------+--------- --- -- - 55 * 56 * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. 57 * The payload is dependent on the subsystem specified in the 58 * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions 59 * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c 60 * file. All of the fields in the NetLabel payload are NETLINK attributes, the 61 * length of each field is the length of the NETLINK attribute payload, see 62 * include/net/netlink.h for more information on NETLINK attributes. 63 * 64 */ 65 66 /* 67 * NetLabel NETLINK protocol 68 */ 69 70 #define NETLBL_PROTO_VERSION 1 71 72 /* NetLabel NETLINK types/families */ 73 #define NETLBL_NLTYPE_NONE 0 74 #define NETLBL_NLTYPE_MGMT 1 75 #define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT" 76 #define NETLBL_NLTYPE_RIPSO 2 77 #define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO" 78 #define NETLBL_NLTYPE_CIPSOV4 3 79 #define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4" 80 #define NETLBL_NLTYPE_CIPSOV6 4 81 #define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6" 82 #define NETLBL_NLTYPE_UNLABELED 5 83 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" 84 85 /* NetLabel return codes */ 86 #define NETLBL_E_OK 0 87 88 /* 89 * Helper functions 90 */ 91 92 #define NETLBL_LEN_U8 nla_total_size(sizeof(u8)) 93 #define NETLBL_LEN_U16 nla_total_size(sizeof(u16)) 94 #define NETLBL_LEN_U32 nla_total_size(sizeof(u32)) 95 96 /** 97 * netlbl_netlink_alloc_skb - Allocate a NETLINK message buffer 98 * @head: the amount of headroom in bytes 99 * @body: the desired size (minus headroom) in bytes 100 * @gfp_flags: the alloc flags to pass to alloc_skb() 101 * 102 * Description: 103 * Allocate a NETLINK message buffer based on the sizes given in @head and 104 * @body. If @head is greater than zero skb_reserve() is called to reserve 105 * @head bytes at the start of the buffer. Returns a valid sk_buff pointer on 106 * success, NULL on failure. 107 * 108 */ 109 static inline struct sk_buff *netlbl_netlink_alloc_skb(size_t head, 110 size_t body, 111 int gfp_flags) 112 { 113 struct sk_buff *skb; 114 115 skb = alloc_skb(NLMSG_ALIGN(head + body), gfp_flags); 116 if (skb == NULL) 117 return NULL; 118 if (head > 0) { 119 skb_reserve(skb, head); 120 if (skb_tailroom(skb) < body) { 121 kfree_skb(skb); 122 return NULL; 123 } 124 } 125 126 return skb; 127 } 128 129 /* 130 * NetLabel - Kernel API for accessing the network packet label mappings. 131 * 132 * The following functions are provided for use by other kernel modules, 133 * specifically kernel LSM modules, to provide a consistent, transparent API 134 * for dealing with explicit packet labeling protocols such as CIPSO and 135 * RIPSO. The functions defined here are implemented in the 136 * net/netlabel/netlabel_kapi.c file. 137 * 138 */ 139 140 /* Domain mapping definition struct */ 141 struct netlbl_dom_map; 142 143 /* Domain mapping operations */ 144 int netlbl_domhsh_remove(const char *domain); 145 146 /* LSM security attributes */ 147 struct netlbl_lsm_cache { 148 void (*free) (const void *data); 149 void *data; 150 }; 151 struct netlbl_lsm_secattr { 152 char *domain; 153 154 u32 mls_lvl; 155 u32 mls_lvl_vld; 156 unsigned char *mls_cat; 157 size_t mls_cat_len; 158 159 struct netlbl_lsm_cache cache; 160 }; 161 162 /* 163 * LSM security attribute operations 164 */ 165 166 167 /** 168 * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct 169 * @secattr: the struct to initialize 170 * 171 * Description: 172 * Initialize an already allocated netlbl_lsm_secattr struct. Returns zero on 173 * success, negative values on error. 174 * 175 */ 176 static inline int netlbl_secattr_init(struct netlbl_lsm_secattr *secattr) 177 { 178 memset(secattr, 0, sizeof(*secattr)); 179 return 0; 180 } 181 182 /** 183 * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct 184 * @secattr: the struct to clear 185 * @clear_cache: cache clear flag 186 * 187 * Description: 188 * Destroys the @secattr struct, including freeing all of the internal buffers. 189 * If @clear_cache is true then free the cache fields, otherwise leave them 190 * intact. The struct must be reset with a call to netlbl_secattr_init() 191 * before reuse. 192 * 193 */ 194 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr, 195 u32 clear_cache) 196 { 197 if (clear_cache && secattr->cache.data != NULL && secattr->cache.free) 198 secattr->cache.free(secattr->cache.data); 199 kfree(secattr->domain); 200 kfree(secattr->mls_cat); 201 } 202 203 /** 204 * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct 205 * @flags: the memory allocation flags 206 * 207 * Description: 208 * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid 209 * pointer on success, or NULL on failure. 210 * 211 */ 212 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(int flags) 213 { 214 return kzalloc(sizeof(struct netlbl_lsm_secattr), flags); 215 } 216 217 /** 218 * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct 219 * @secattr: the struct to free 220 * @clear_cache: cache clear flag 221 * 222 * Description: 223 * Frees @secattr including all of the internal buffers. If @clear_cache is 224 * true then free the cache fields, otherwise leave them intact. 225 * 226 */ 227 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr, 228 u32 clear_cache) 229 { 230 netlbl_secattr_destroy(secattr, clear_cache); 231 kfree(secattr); 232 } 233 234 /* 235 * LSM protocol operations 236 */ 237 238 #ifdef CONFIG_NETLABEL 239 int netlbl_socket_setattr(const struct socket *sock, 240 const struct netlbl_lsm_secattr *secattr); 241 int netlbl_socket_getattr(const struct socket *sock, 242 struct netlbl_lsm_secattr *secattr); 243 int netlbl_skbuff_getattr(const struct sk_buff *skb, 244 struct netlbl_lsm_secattr *secattr); 245 void netlbl_skbuff_err(struct sk_buff *skb, int error); 246 #else 247 static inline int netlbl_socket_setattr(const struct socket *sock, 248 const struct netlbl_lsm_secattr *secattr) 249 { 250 return -ENOSYS; 251 } 252 253 static inline int netlbl_socket_getattr(const struct socket *sock, 254 struct netlbl_lsm_secattr *secattr) 255 { 256 return -ENOSYS; 257 } 258 259 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, 260 struct netlbl_lsm_secattr *secattr) 261 { 262 return -ENOSYS; 263 } 264 265 static inline void netlbl_skbuff_err(struct sk_buff *skb, int error) 266 { 267 return; 268 } 269 #endif /* CONFIG_NETLABEL */ 270 271 /* 272 * LSM label mapping cache operations 273 */ 274 275 #ifdef CONFIG_NETLABEL 276 void netlbl_cache_invalidate(void); 277 int netlbl_cache_add(const struct sk_buff *skb, 278 const struct netlbl_lsm_secattr *secattr); 279 #else 280 static inline void netlbl_cache_invalidate(void) 281 { 282 return; 283 } 284 285 static inline int netlbl_cache_add(const struct sk_buff *skb, 286 const struct netlbl_lsm_secattr *secattr) 287 { 288 return 0; 289 } 290 #endif /* CONFIG_NETLABEL */ 291 292 #endif /* _NETLABEL_H */ 293