1 /* 2 * NetLabel System 3 * 4 * The NetLabel system manages static and dynamic label mappings for network 5 * protocols such as CIPSO and RIPSO. 6 * 7 * Author: Paul Moore <paul@paul-moore.com> 8 * 9 */ 10 11 /* 12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 13 * 14 * This program is free software; you can redistribute it and/or modify 15 * it under the terms of the GNU General Public License as published by 16 * the Free Software Foundation; either version 2 of the License, or 17 * (at your option) any later version. 18 * 19 * This program is distributed in the hope that it will be useful, 20 * but WITHOUT ANY WARRANTY; without even the implied warranty of 21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 22 * the GNU General Public License for more details. 23 * 24 * You should have received a copy of the GNU General Public License 25 * along with this program; if not, see <http://www.gnu.org/licenses/>. 26 * 27 */ 28 29 #ifndef _NETLABEL_H 30 #define _NETLABEL_H 31 32 #include <linux/types.h> 33 #include <linux/slab.h> 34 #include <linux/net.h> 35 #include <linux/skbuff.h> 36 #include <linux/in.h> 37 #include <linux/in6.h> 38 #include <net/netlink.h> 39 #include <net/request_sock.h> 40 #include <linux/atomic.h> 41 42 struct cipso_v4_doi; 43 44 /* 45 * NetLabel - A management interface for maintaining network packet label 46 * mapping tables for explicit packet labling protocols. 47 * 48 * Network protocols such as CIPSO and RIPSO require a label translation layer 49 * to convert the label on the packet into something meaningful on the host 50 * machine. In the current Linux implementation these mapping tables live 51 * inside the kernel; NetLabel provides a mechanism for user space applications 52 * to manage these mapping tables. 53 * 54 * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to 55 * send messages between kernel and user space. The general format of a 56 * NetLabel message is shown below: 57 * 58 * +-----------------+-------------------+--------- --- -- - 59 * | struct nlmsghdr | struct genlmsghdr | payload 60 * +-----------------+-------------------+--------- --- -- - 61 * 62 * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. 63 * The payload is dependent on the subsystem specified in the 64 * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions 65 * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c 66 * file. All of the fields in the NetLabel payload are NETLINK attributes, see 67 * the include/net/netlink.h file for more information on NETLINK attributes. 68 * 69 */ 70 71 /* 72 * NetLabel NETLINK protocol 73 */ 74 75 /* NetLabel NETLINK protocol version 76 * 1: initial version 77 * 2: added static labels for unlabeled connections 78 * 3: network selectors added to the NetLabel/LSM domain mapping and the 79 * CIPSO_V4_MAP_LOCAL CIPSO mapping was added 80 */ 81 #define NETLBL_PROTO_VERSION 3 82 83 /* NetLabel NETLINK types/families */ 84 #define NETLBL_NLTYPE_NONE 0 85 #define NETLBL_NLTYPE_MGMT 1 86 #define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT" 87 #define NETLBL_NLTYPE_RIPSO 2 88 #define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO" 89 #define NETLBL_NLTYPE_CIPSOV4 3 90 #define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4" 91 #define NETLBL_NLTYPE_CIPSOV6 4 92 #define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6" 93 #define NETLBL_NLTYPE_UNLABELED 5 94 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL" 95 #define NETLBL_NLTYPE_ADDRSELECT 6 96 #define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL" 97 98 /* 99 * NetLabel - Kernel API for accessing the network packet label mappings. 100 * 101 * The following functions are provided for use by other kernel modules, 102 * specifically kernel LSM modules, to provide a consistent, transparent API 103 * for dealing with explicit packet labeling protocols such as CIPSO and 104 * RIPSO. The functions defined here are implemented in the 105 * net/netlabel/netlabel_kapi.c file. 106 * 107 */ 108 109 /* NetLabel audit information */ 110 struct netlbl_audit { 111 u32 secid; 112 kuid_t loginuid; 113 unsigned int sessionid; 114 }; 115 116 /* 117 * LSM security attributes 118 */ 119 120 /** 121 * struct netlbl_lsm_cache - NetLabel LSM security attribute cache 122 * @refcount: atomic reference counter 123 * @free: LSM supplied function to free the cache data 124 * @data: LSM supplied cache data 125 * 126 * Description: 127 * This structure is provided for LSMs which wish to make use of the NetLabel 128 * caching mechanism to store LSM specific data/attributes in the NetLabel 129 * cache. If the LSM has to perform a lot of translation from the NetLabel 130 * security attributes into it's own internal representation then the cache 131 * mechanism can provide a way to eliminate some or all of that translation 132 * overhead on a cache hit. 133 * 134 */ 135 struct netlbl_lsm_cache { 136 atomic_t refcount; 137 void (*free) (const void *data); 138 void *data; 139 }; 140 141 /** 142 * struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap 143 * @startbit: the value of the lowest order bit in the bitmap 144 * @bitmap: the category bitmap 145 * @next: pointer to the next bitmap "node" or NULL 146 * 147 * Description: 148 * This structure is used to represent category bitmaps. Due to the large 149 * number of categories supported by most labeling protocols it is not 150 * practical to transfer a full bitmap internally so NetLabel adopts a sparse 151 * bitmap structure modeled after SELinux's ebitmap structure. 152 * The catmap bitmap field MUST be a power of two in length and large 153 * enough to hold at least 240 bits. Special care (i.e. check the code!) 154 * should be used when changing these values as the LSM implementation 155 * probably has functions which rely on the sizes of these types to speed 156 * processing. 157 * 158 */ 159 #define NETLBL_CATMAP_MAPTYPE u64 160 #define NETLBL_CATMAP_MAPCNT 4 161 #define NETLBL_CATMAP_MAPSIZE (sizeof(NETLBL_CATMAP_MAPTYPE) * 8) 162 #define NETLBL_CATMAP_SIZE (NETLBL_CATMAP_MAPSIZE * \ 163 NETLBL_CATMAP_MAPCNT) 164 #define NETLBL_CATMAP_BIT (NETLBL_CATMAP_MAPTYPE)0x01 165 struct netlbl_lsm_catmap { 166 u32 startbit; 167 NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT]; 168 struct netlbl_lsm_catmap *next; 169 }; 170 171 /** 172 * struct netlbl_lsm_secattr - NetLabel LSM security attributes 173 * @flags: indicate structure attributes, see NETLBL_SECATTR_* 174 * @type: indicate the NLTYPE of the attributes 175 * @domain: the NetLabel LSM domain 176 * @cache: NetLabel LSM specific cache 177 * @attr.mls: MLS sensitivity label 178 * @attr.mls.cat: MLS category bitmap 179 * @attr.mls.lvl: MLS sensitivity level 180 * @attr.secid: LSM specific secid token 181 * 182 * Description: 183 * This structure is used to pass security attributes between NetLabel and the 184 * LSM modules. The flags field is used to specify which fields within the 185 * struct are valid and valid values can be created by bitwise OR'ing the 186 * NETLBL_SECATTR_* defines. The domain field is typically set by the LSM to 187 * specify domain specific configuration settings and is not usually used by 188 * NetLabel itself when returning security attributes to the LSM. 189 * 190 */ 191 struct netlbl_lsm_secattr { 192 u32 flags; 193 /* bitmap values for 'flags' */ 194 #define NETLBL_SECATTR_NONE 0x00000000 195 #define NETLBL_SECATTR_DOMAIN 0x00000001 196 #define NETLBL_SECATTR_DOMAIN_CPY (NETLBL_SECATTR_DOMAIN | \ 197 NETLBL_SECATTR_FREE_DOMAIN) 198 #define NETLBL_SECATTR_CACHE 0x00000002 199 #define NETLBL_SECATTR_MLS_LVL 0x00000004 200 #define NETLBL_SECATTR_MLS_CAT 0x00000008 201 #define NETLBL_SECATTR_SECID 0x00000010 202 /* bitmap meta-values for 'flags' */ 203 #define NETLBL_SECATTR_FREE_DOMAIN 0x01000000 204 #define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ 205 NETLBL_SECATTR_MLS_CAT | \ 206 NETLBL_SECATTR_SECID) 207 u32 type; 208 char *domain; 209 struct netlbl_lsm_cache *cache; 210 struct { 211 struct { 212 struct netlbl_lsm_catmap *cat; 213 u32 lvl; 214 } mls; 215 u32 secid; 216 } attr; 217 }; 218 219 /* 220 * LSM security attribute operations (inline) 221 */ 222 223 /** 224 * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache 225 * @flags: the memory allocation flags 226 * 227 * Description: 228 * Allocate and initialize a netlbl_lsm_cache structure. Returns a pointer 229 * on success, NULL on failure. 230 * 231 */ 232 static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags) 233 { 234 struct netlbl_lsm_cache *cache; 235 236 cache = kzalloc(sizeof(*cache), flags); 237 if (cache) 238 atomic_set(&cache->refcount, 1); 239 return cache; 240 } 241 242 /** 243 * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct 244 * @cache: the struct to free 245 * 246 * Description: 247 * Frees @secattr including all of the internal buffers. 248 * 249 */ 250 static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache) 251 { 252 if (!atomic_dec_and_test(&cache->refcount)) 253 return; 254 255 if (cache->free) 256 cache->free(cache->data); 257 kfree(cache); 258 } 259 260 /** 261 * netlbl_catmap_alloc - Allocate a LSM secattr catmap 262 * @flags: memory allocation flags 263 * 264 * Description: 265 * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL 266 * on failure. 267 * 268 */ 269 static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc(gfp_t flags) 270 { 271 return kzalloc(sizeof(struct netlbl_lsm_catmap), flags); 272 } 273 274 /** 275 * netlbl_catmap_free - Free a LSM secattr catmap 276 * @catmap: the category bitmap 277 * 278 * Description: 279 * Free a LSM secattr catmap. 280 * 281 */ 282 static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap) 283 { 284 struct netlbl_lsm_catmap *iter; 285 286 while (catmap) { 287 iter = catmap; 288 catmap = catmap->next; 289 kfree(iter); 290 } 291 } 292 293 /** 294 * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct 295 * @secattr: the struct to initialize 296 * 297 * Description: 298 * Initialize an already allocated netlbl_lsm_secattr struct. 299 * 300 */ 301 static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr) 302 { 303 memset(secattr, 0, sizeof(*secattr)); 304 } 305 306 /** 307 * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct 308 * @secattr: the struct to clear 309 * 310 * Description: 311 * Destroys the @secattr struct, including freeing all of the internal buffers. 312 * The struct must be reset with a call to netlbl_secattr_init() before reuse. 313 * 314 */ 315 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr) 316 { 317 if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN) 318 kfree(secattr->domain); 319 if (secattr->flags & NETLBL_SECATTR_CACHE) 320 netlbl_secattr_cache_free(secattr->cache); 321 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) 322 netlbl_catmap_free(secattr->attr.mls.cat); 323 } 324 325 /** 326 * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct 327 * @flags: the memory allocation flags 328 * 329 * Description: 330 * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid 331 * pointer on success, or NULL on failure. 332 * 333 */ 334 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(gfp_t flags) 335 { 336 return kzalloc(sizeof(struct netlbl_lsm_secattr), flags); 337 } 338 339 /** 340 * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct 341 * @secattr: the struct to free 342 * 343 * Description: 344 * Frees @secattr including all of the internal buffers. 345 * 346 */ 347 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr) 348 { 349 netlbl_secattr_destroy(secattr); 350 kfree(secattr); 351 } 352 353 #ifdef CONFIG_NETLABEL 354 /* 355 * LSM configuration operations 356 */ 357 int netlbl_cfg_map_del(const char *domain, 358 u16 family, 359 const void *addr, 360 const void *mask, 361 struct netlbl_audit *audit_info); 362 int netlbl_cfg_unlbl_map_add(const char *domain, 363 u16 family, 364 const void *addr, 365 const void *mask, 366 struct netlbl_audit *audit_info); 367 int netlbl_cfg_unlbl_static_add(struct net *net, 368 const char *dev_name, 369 const void *addr, 370 const void *mask, 371 u16 family, 372 u32 secid, 373 struct netlbl_audit *audit_info); 374 int netlbl_cfg_unlbl_static_del(struct net *net, 375 const char *dev_name, 376 const void *addr, 377 const void *mask, 378 u16 family, 379 struct netlbl_audit *audit_info); 380 int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, 381 struct netlbl_audit *audit_info); 382 void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info); 383 int netlbl_cfg_cipsov4_map_add(u32 doi, 384 const char *domain, 385 const struct in_addr *addr, 386 const struct in_addr *mask, 387 struct netlbl_audit *audit_info); 388 /* 389 * LSM security attribute operations 390 */ 391 int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset); 392 int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset); 393 int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, 394 u32 *offset, 395 unsigned long *bitmap); 396 int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, 397 u32 bit, 398 gfp_t flags); 399 int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, 400 u32 start, 401 u32 end, 402 gfp_t flags); 403 int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, 404 u32 offset, 405 unsigned long bitmap, 406 gfp_t flags); 407 408 /* 409 * LSM protocol operations (NetLabel LSM/kernel API) 410 */ 411 int netlbl_enabled(void); 412 int netlbl_sock_setattr(struct sock *sk, 413 u16 family, 414 const struct netlbl_lsm_secattr *secattr); 415 void netlbl_sock_delattr(struct sock *sk); 416 int netlbl_sock_getattr(struct sock *sk, 417 struct netlbl_lsm_secattr *secattr); 418 int netlbl_conn_setattr(struct sock *sk, 419 struct sockaddr *addr, 420 const struct netlbl_lsm_secattr *secattr); 421 int netlbl_req_setattr(struct request_sock *req, 422 const struct netlbl_lsm_secattr *secattr); 423 void netlbl_req_delattr(struct request_sock *req); 424 int netlbl_skbuff_setattr(struct sk_buff *skb, 425 u16 family, 426 const struct netlbl_lsm_secattr *secattr); 427 int netlbl_skbuff_getattr(const struct sk_buff *skb, 428 u16 family, 429 struct netlbl_lsm_secattr *secattr); 430 void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway); 431 432 /* 433 * LSM label mapping cache operations 434 */ 435 void netlbl_cache_invalidate(void); 436 int netlbl_cache_add(const struct sk_buff *skb, 437 const struct netlbl_lsm_secattr *secattr); 438 439 /* 440 * Protocol engine operations 441 */ 442 struct audit_buffer *netlbl_audit_start(int type, 443 struct netlbl_audit *audit_info); 444 #else 445 static inline int netlbl_cfg_map_del(const char *domain, 446 u16 family, 447 const void *addr, 448 const void *mask, 449 struct netlbl_audit *audit_info) 450 { 451 return -ENOSYS; 452 } 453 static inline int netlbl_cfg_unlbl_map_add(const char *domain, 454 u16 family, 455 void *addr, 456 void *mask, 457 struct netlbl_audit *audit_info) 458 { 459 return -ENOSYS; 460 } 461 static inline int netlbl_cfg_unlbl_static_add(struct net *net, 462 const char *dev_name, 463 const void *addr, 464 const void *mask, 465 u16 family, 466 u32 secid, 467 struct netlbl_audit *audit_info) 468 { 469 return -ENOSYS; 470 } 471 static inline int netlbl_cfg_unlbl_static_del(struct net *net, 472 const char *dev_name, 473 const void *addr, 474 const void *mask, 475 u16 family, 476 struct netlbl_audit *audit_info) 477 { 478 return -ENOSYS; 479 } 480 static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, 481 struct netlbl_audit *audit_info) 482 { 483 return -ENOSYS; 484 } 485 static inline void netlbl_cfg_cipsov4_del(u32 doi, 486 struct netlbl_audit *audit_info) 487 { 488 return; 489 } 490 static inline int netlbl_cfg_cipsov4_map_add(u32 doi, 491 const char *domain, 492 const struct in_addr *addr, 493 const struct in_addr *mask, 494 struct netlbl_audit *audit_info) 495 { 496 return -ENOSYS; 497 } 498 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, 499 u32 offset) 500 { 501 return -ENOENT; 502 } 503 static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, 504 u32 offset) 505 { 506 return -ENOENT; 507 } 508 static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, 509 u32 *offset, 510 unsigned long *bitmap) 511 { 512 return 0; 513 } 514 static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, 515 u32 bit, 516 gfp_t flags) 517 { 518 return 0; 519 } 520 static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, 521 u32 start, 522 u32 end, 523 gfp_t flags) 524 { 525 return 0; 526 } 527 static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, 528 u32 offset, 529 unsigned long bitmap, 530 gfp_t flags) 531 { 532 return 0; 533 } 534 static inline int netlbl_enabled(void) 535 { 536 return 0; 537 } 538 static inline int netlbl_sock_setattr(struct sock *sk, 539 u16 family, 540 const struct netlbl_lsm_secattr *secattr) 541 { 542 return -ENOSYS; 543 } 544 static inline void netlbl_sock_delattr(struct sock *sk) 545 { 546 } 547 static inline int netlbl_sock_getattr(struct sock *sk, 548 struct netlbl_lsm_secattr *secattr) 549 { 550 return -ENOSYS; 551 } 552 static inline int netlbl_conn_setattr(struct sock *sk, 553 struct sockaddr *addr, 554 const struct netlbl_lsm_secattr *secattr) 555 { 556 return -ENOSYS; 557 } 558 static inline int netlbl_req_setattr(struct request_sock *req, 559 const struct netlbl_lsm_secattr *secattr) 560 { 561 return -ENOSYS; 562 } 563 static inline void netlbl_req_delattr(struct request_sock *req) 564 { 565 return; 566 } 567 static inline int netlbl_skbuff_setattr(struct sk_buff *skb, 568 u16 family, 569 const struct netlbl_lsm_secattr *secattr) 570 { 571 return -ENOSYS; 572 } 573 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, 574 u16 family, 575 struct netlbl_lsm_secattr *secattr) 576 { 577 return -ENOSYS; 578 } 579 static inline void netlbl_skbuff_err(struct sk_buff *skb, 580 int error, 581 int gateway) 582 { 583 return; 584 } 585 static inline void netlbl_cache_invalidate(void) 586 { 587 return; 588 } 589 static inline int netlbl_cache_add(const struct sk_buff *skb, 590 const struct netlbl_lsm_secattr *secattr) 591 { 592 return 0; 593 } 594 static inline struct audit_buffer *netlbl_audit_start(int type, 595 struct netlbl_audit *audit_info) 596 { 597 return NULL; 598 } 599 #endif /* CONFIG_NETLABEL */ 600 601 #endif /* _NETLABEL_H */ 602