xref: /linux/include/net/netlabel.h (revision cc04a46f11ea046ed53e2c832ae29e4790f7e35f)
1 /*
2  * NetLabel System
3  *
4  * The NetLabel system manages static and dynamic label mappings for network
5  * protocols such as CIPSO and RIPSO.
6  *
7  * Author: Paul Moore <paul@paul-moore.com>
8  *
9  */
10 
11 /*
12  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
13  *
14  * This program is free software;  you can redistribute it and/or modify
15  * it under the terms of the GNU General Public License as published by
16  * the Free Software Foundation; either version 2 of the License, or
17  * (at your option) any later version.
18  *
19  * This program is distributed in the hope that it will be useful,
20  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
22  * the GNU General Public License for more details.
23  *
24  * You should have received a copy of the GNU General Public License
25  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
26  *
27  */
28 
29 #ifndef _NETLABEL_H
30 #define _NETLABEL_H
31 
32 #include <linux/types.h>
33 #include <linux/slab.h>
34 #include <linux/net.h>
35 #include <linux/skbuff.h>
36 #include <linux/in.h>
37 #include <linux/in6.h>
38 #include <net/netlink.h>
39 #include <net/request_sock.h>
40 #include <linux/atomic.h>
41 
42 struct cipso_v4_doi;
43 
44 /*
45  * NetLabel - A management interface for maintaining network packet label
46  *            mapping tables for explicit packet labling protocols.
47  *
48  * Network protocols such as CIPSO and RIPSO require a label translation layer
49  * to convert the label on the packet into something meaningful on the host
50  * machine.  In the current Linux implementation these mapping tables live
51  * inside the kernel; NetLabel provides a mechanism for user space applications
52  * to manage these mapping tables.
53  *
54  * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to
55  * send messages between kernel and user space.  The general format of a
56  * NetLabel message is shown below:
57  *
58  *  +-----------------+-------------------+--------- --- -- -
59  *  | struct nlmsghdr | struct genlmsghdr | payload
60  *  +-----------------+-------------------+--------- --- -- -
61  *
62  * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal.
63  * The payload is dependent on the subsystem specified in the
64  * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions
65  * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c
66  * file.  All of the fields in the NetLabel payload are NETLINK attributes, see
67  * the include/net/netlink.h file for more information on NETLINK attributes.
68  *
69  */
70 
71 /*
72  * NetLabel NETLINK protocol
73  */
74 
75 /* NetLabel NETLINK protocol version
76  *  1: initial version
77  *  2: added static labels for unlabeled connections
78  *  3: network selectors added to the NetLabel/LSM domain mapping and the
79  *     CIPSO_V4_MAP_LOCAL CIPSO mapping was added
80  */
81 #define NETLBL_PROTO_VERSION            3
82 
83 /* NetLabel NETLINK types/families */
84 #define NETLBL_NLTYPE_NONE              0
85 #define NETLBL_NLTYPE_MGMT              1
86 #define NETLBL_NLTYPE_MGMT_NAME         "NLBL_MGMT"
87 #define NETLBL_NLTYPE_RIPSO             2
88 #define NETLBL_NLTYPE_RIPSO_NAME        "NLBL_RIPSO"
89 #define NETLBL_NLTYPE_CIPSOV4           3
90 #define NETLBL_NLTYPE_CIPSOV4_NAME      "NLBL_CIPSOv4"
91 #define NETLBL_NLTYPE_CIPSOV6           4
92 #define NETLBL_NLTYPE_CIPSOV6_NAME      "NLBL_CIPSOv6"
93 #define NETLBL_NLTYPE_UNLABELED         5
94 #define NETLBL_NLTYPE_UNLABELED_NAME    "NLBL_UNLBL"
95 #define NETLBL_NLTYPE_ADDRSELECT        6
96 #define NETLBL_NLTYPE_ADDRSELECT_NAME   "NLBL_ADRSEL"
97 
98 /*
99  * NetLabel - Kernel API for accessing the network packet label mappings.
100  *
101  * The following functions are provided for use by other kernel modules,
102  * specifically kernel LSM modules, to provide a consistent, transparent API
103  * for dealing with explicit packet labeling protocols such as CIPSO and
104  * RIPSO.  The functions defined here are implemented in the
105  * net/netlabel/netlabel_kapi.c file.
106  *
107  */
108 
109 /* NetLabel audit information */
110 struct netlbl_audit {
111 	u32 secid;
112 	kuid_t loginuid;
113 	unsigned int sessionid;
114 };
115 
116 /*
117  * LSM security attributes
118  */
119 
120 /**
121  * struct netlbl_lsm_cache - NetLabel LSM security attribute cache
122  * @refcount: atomic reference counter
123  * @free: LSM supplied function to free the cache data
124  * @data: LSM supplied cache data
125  *
126  * Description:
127  * This structure is provided for LSMs which wish to make use of the NetLabel
128  * caching mechanism to store LSM specific data/attributes in the NetLabel
129  * cache.  If the LSM has to perform a lot of translation from the NetLabel
130  * security attributes into it's own internal representation then the cache
131  * mechanism can provide a way to eliminate some or all of that translation
132  * overhead on a cache hit.
133  *
134  */
135 struct netlbl_lsm_cache {
136 	atomic_t refcount;
137 	void (*free) (const void *data);
138 	void *data;
139 };
140 
141 /**
142  * struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap
143  * @startbit: the value of the lowest order bit in the bitmap
144  * @bitmap: the category bitmap
145  * @next: pointer to the next bitmap "node" or NULL
146  *
147  * Description:
148  * This structure is used to represent category bitmaps.  Due to the large
149  * number of categories supported by most labeling protocols it is not
150  * practical to transfer a full bitmap internally so NetLabel adopts a sparse
151  * bitmap structure modeled after SELinux's ebitmap structure.
152  * The catmap bitmap field MUST be a power of two in length and large
153  * enough to hold at least 240 bits.  Special care (i.e. check the code!)
154  * should be used when changing these values as the LSM implementation
155  * probably has functions which rely on the sizes of these types to speed
156  * processing.
157  *
158  */
159 #define NETLBL_CATMAP_MAPTYPE           u64
160 #define NETLBL_CATMAP_MAPCNT            4
161 #define NETLBL_CATMAP_MAPSIZE           (sizeof(NETLBL_CATMAP_MAPTYPE) * 8)
162 #define NETLBL_CATMAP_SIZE              (NETLBL_CATMAP_MAPSIZE * \
163 					 NETLBL_CATMAP_MAPCNT)
164 #define NETLBL_CATMAP_BIT               (NETLBL_CATMAP_MAPTYPE)0x01
165 struct netlbl_lsm_catmap {
166 	u32 startbit;
167 	NETLBL_CATMAP_MAPTYPE bitmap[NETLBL_CATMAP_MAPCNT];
168 	struct netlbl_lsm_catmap *next;
169 };
170 
171 /**
172  * struct netlbl_lsm_secattr - NetLabel LSM security attributes
173  * @flags: indicate structure attributes, see NETLBL_SECATTR_*
174  * @type: indicate the NLTYPE of the attributes
175  * @domain: the NetLabel LSM domain
176  * @cache: NetLabel LSM specific cache
177  * @attr.mls: MLS sensitivity label
178  * @attr.mls.cat: MLS category bitmap
179  * @attr.mls.lvl: MLS sensitivity level
180  * @attr.secid: LSM specific secid token
181  *
182  * Description:
183  * This structure is used to pass security attributes between NetLabel and the
184  * LSM modules.  The flags field is used to specify which fields within the
185  * struct are valid and valid values can be created by bitwise OR'ing the
186  * NETLBL_SECATTR_* defines.  The domain field is typically set by the LSM to
187  * specify domain specific configuration settings and is not usually used by
188  * NetLabel itself when returning security attributes to the LSM.
189  *
190  */
191 struct netlbl_lsm_secattr {
192 	u32 flags;
193 	/* bitmap values for 'flags' */
194 #define NETLBL_SECATTR_NONE             0x00000000
195 #define NETLBL_SECATTR_DOMAIN           0x00000001
196 #define NETLBL_SECATTR_DOMAIN_CPY       (NETLBL_SECATTR_DOMAIN | \
197 					 NETLBL_SECATTR_FREE_DOMAIN)
198 #define NETLBL_SECATTR_CACHE            0x00000002
199 #define NETLBL_SECATTR_MLS_LVL          0x00000004
200 #define NETLBL_SECATTR_MLS_CAT          0x00000008
201 #define NETLBL_SECATTR_SECID            0x00000010
202 	/* bitmap meta-values for 'flags' */
203 #define NETLBL_SECATTR_FREE_DOMAIN      0x01000000
204 #define NETLBL_SECATTR_CACHEABLE        (NETLBL_SECATTR_MLS_LVL | \
205 					 NETLBL_SECATTR_MLS_CAT | \
206 					 NETLBL_SECATTR_SECID)
207 	u32 type;
208 	char *domain;
209 	struct netlbl_lsm_cache *cache;
210 	struct {
211 		struct {
212 			struct netlbl_lsm_catmap *cat;
213 			u32 lvl;
214 		} mls;
215 		u32 secid;
216 	} attr;
217 };
218 
219 /*
220  * LSM security attribute operations (inline)
221  */
222 
223 /**
224  * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache
225  * @flags: the memory allocation flags
226  *
227  * Description:
228  * Allocate and initialize a netlbl_lsm_cache structure.  Returns a pointer
229  * on success, NULL on failure.
230  *
231  */
232 static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
233 {
234 	struct netlbl_lsm_cache *cache;
235 
236 	cache = kzalloc(sizeof(*cache), flags);
237 	if (cache)
238 		atomic_set(&cache->refcount, 1);
239 	return cache;
240 }
241 
242 /**
243  * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct
244  * @cache: the struct to free
245  *
246  * Description:
247  * Frees @secattr including all of the internal buffers.
248  *
249  */
250 static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
251 {
252 	if (!atomic_dec_and_test(&cache->refcount))
253 		return;
254 
255 	if (cache->free)
256 		cache->free(cache->data);
257 	kfree(cache);
258 }
259 
260 /**
261  * netlbl_catmap_alloc - Allocate a LSM secattr catmap
262  * @flags: memory allocation flags
263  *
264  * Description:
265  * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL
266  * on failure.
267  *
268  */
269 static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc(gfp_t flags)
270 {
271 	return kzalloc(sizeof(struct netlbl_lsm_catmap), flags);
272 }
273 
274 /**
275  * netlbl_catmap_free - Free a LSM secattr catmap
276  * @catmap: the category bitmap
277  *
278  * Description:
279  * Free a LSM secattr catmap.
280  *
281  */
282 static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap)
283 {
284 	struct netlbl_lsm_catmap *iter;
285 
286 	while (catmap) {
287 		iter = catmap;
288 		catmap = catmap->next;
289 		kfree(iter);
290 	}
291 }
292 
293 /**
294  * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct
295  * @secattr: the struct to initialize
296  *
297  * Description:
298  * Initialize an already allocated netlbl_lsm_secattr struct.
299  *
300  */
301 static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr)
302 {
303 	memset(secattr, 0, sizeof(*secattr));
304 }
305 
306 /**
307  * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct
308  * @secattr: the struct to clear
309  *
310  * Description:
311  * Destroys the @secattr struct, including freeing all of the internal buffers.
312  * The struct must be reset with a call to netlbl_secattr_init() before reuse.
313  *
314  */
315 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr)
316 {
317 	if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN)
318 		kfree(secattr->domain);
319 	if (secattr->flags & NETLBL_SECATTR_CACHE)
320 		netlbl_secattr_cache_free(secattr->cache);
321 	if (secattr->flags & NETLBL_SECATTR_MLS_CAT)
322 		netlbl_catmap_free(secattr->attr.mls.cat);
323 }
324 
325 /**
326  * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct
327  * @flags: the memory allocation flags
328  *
329  * Description:
330  * Allocate and initialize a netlbl_lsm_secattr struct.  Returns a valid
331  * pointer on success, or NULL on failure.
332  *
333  */
334 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(gfp_t flags)
335 {
336 	return kzalloc(sizeof(struct netlbl_lsm_secattr), flags);
337 }
338 
339 /**
340  * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct
341  * @secattr: the struct to free
342  *
343  * Description:
344  * Frees @secattr including all of the internal buffers.
345  *
346  */
347 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
348 {
349 	netlbl_secattr_destroy(secattr);
350 	kfree(secattr);
351 }
352 
353 #ifdef CONFIG_NETLABEL
354 /*
355  * LSM configuration operations
356  */
357 int netlbl_cfg_map_del(const char *domain,
358 		       u16 family,
359 		       const void *addr,
360 		       const void *mask,
361 		       struct netlbl_audit *audit_info);
362 int netlbl_cfg_unlbl_map_add(const char *domain,
363 			     u16 family,
364 			     const void *addr,
365 			     const void *mask,
366 			     struct netlbl_audit *audit_info);
367 int netlbl_cfg_unlbl_static_add(struct net *net,
368 				const char *dev_name,
369 				const void *addr,
370 				const void *mask,
371 				u16 family,
372 				u32 secid,
373 				struct netlbl_audit *audit_info);
374 int netlbl_cfg_unlbl_static_del(struct net *net,
375 				const char *dev_name,
376 				const void *addr,
377 				const void *mask,
378 				u16 family,
379 				struct netlbl_audit *audit_info);
380 int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
381 			   struct netlbl_audit *audit_info);
382 void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);
383 int netlbl_cfg_cipsov4_map_add(u32 doi,
384 			       const char *domain,
385 			       const struct in_addr *addr,
386 			       const struct in_addr *mask,
387 			       struct netlbl_audit *audit_info);
388 /*
389  * LSM security attribute operations
390  */
391 int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset);
392 int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset);
393 int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
394 			  u32 *offset,
395 			  unsigned long *bitmap);
396 int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
397 			 u32 bit,
398 			 gfp_t flags);
399 int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
400 			 u32 start,
401 			 u32 end,
402 			 gfp_t flags);
403 int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
404 			  u32 offset,
405 			  unsigned long bitmap,
406 			  gfp_t flags);
407 
408 /*
409  * LSM protocol operations (NetLabel LSM/kernel API)
410  */
411 int netlbl_enabled(void);
412 int netlbl_sock_setattr(struct sock *sk,
413 			u16 family,
414 			const struct netlbl_lsm_secattr *secattr);
415 void netlbl_sock_delattr(struct sock *sk);
416 int netlbl_sock_getattr(struct sock *sk,
417 			struct netlbl_lsm_secattr *secattr);
418 int netlbl_conn_setattr(struct sock *sk,
419 			struct sockaddr *addr,
420 			const struct netlbl_lsm_secattr *secattr);
421 int netlbl_req_setattr(struct request_sock *req,
422 		       const struct netlbl_lsm_secattr *secattr);
423 void netlbl_req_delattr(struct request_sock *req);
424 int netlbl_skbuff_setattr(struct sk_buff *skb,
425 			  u16 family,
426 			  const struct netlbl_lsm_secattr *secattr);
427 int netlbl_skbuff_getattr(const struct sk_buff *skb,
428 			  u16 family,
429 			  struct netlbl_lsm_secattr *secattr);
430 void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway);
431 
432 /*
433  * LSM label mapping cache operations
434  */
435 void netlbl_cache_invalidate(void);
436 int netlbl_cache_add(const struct sk_buff *skb,
437 		     const struct netlbl_lsm_secattr *secattr);
438 
439 /*
440  * Protocol engine operations
441  */
442 struct audit_buffer *netlbl_audit_start(int type,
443 					struct netlbl_audit *audit_info);
444 #else
445 static inline int netlbl_cfg_map_del(const char *domain,
446 				     u16 family,
447 				     const void *addr,
448 				     const void *mask,
449 				     struct netlbl_audit *audit_info)
450 {
451 	return -ENOSYS;
452 }
453 static inline int netlbl_cfg_unlbl_map_add(const char *domain,
454 					   u16 family,
455 					   void *addr,
456 					   void *mask,
457 					   struct netlbl_audit *audit_info)
458 {
459 	return -ENOSYS;
460 }
461 static inline int netlbl_cfg_unlbl_static_add(struct net *net,
462 					      const char *dev_name,
463 					      const void *addr,
464 					      const void *mask,
465 					      u16 family,
466 					      u32 secid,
467 					      struct netlbl_audit *audit_info)
468 {
469 	return -ENOSYS;
470 }
471 static inline int netlbl_cfg_unlbl_static_del(struct net *net,
472 					      const char *dev_name,
473 					      const void *addr,
474 					      const void *mask,
475 					      u16 family,
476 					      struct netlbl_audit *audit_info)
477 {
478 	return -ENOSYS;
479 }
480 static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
481 					 struct netlbl_audit *audit_info)
482 {
483 	return -ENOSYS;
484 }
485 static inline void netlbl_cfg_cipsov4_del(u32 doi,
486 					  struct netlbl_audit *audit_info)
487 {
488 	return;
489 }
490 static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
491 					     const char *domain,
492 					     const struct in_addr *addr,
493 					     const struct in_addr *mask,
494 					     struct netlbl_audit *audit_info)
495 {
496 	return -ENOSYS;
497 }
498 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
499 				     u32 offset)
500 {
501 	return -ENOENT;
502 }
503 static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap,
504 					u32 offset)
505 {
506 	return -ENOENT;
507 }
508 static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
509 					u32 *offset,
510 					unsigned long *bitmap)
511 {
512 	return 0;
513 }
514 static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
515 				       u32 bit,
516 				       gfp_t flags)
517 {
518 	return 0;
519 }
520 static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
521 				       u32 start,
522 				       u32 end,
523 				       gfp_t flags)
524 {
525 	return 0;
526 }
527 static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
528 					u32 offset,
529 					unsigned long bitmap,
530 					gfp_t flags)
531 {
532 	return 0;
533 }
534 static inline int netlbl_enabled(void)
535 {
536 	return 0;
537 }
538 static inline int netlbl_sock_setattr(struct sock *sk,
539 				      u16 family,
540 				      const struct netlbl_lsm_secattr *secattr)
541 {
542 	return -ENOSYS;
543 }
544 static inline void netlbl_sock_delattr(struct sock *sk)
545 {
546 }
547 static inline int netlbl_sock_getattr(struct sock *sk,
548 				      struct netlbl_lsm_secattr *secattr)
549 {
550 	return -ENOSYS;
551 }
552 static inline int netlbl_conn_setattr(struct sock *sk,
553 				      struct sockaddr *addr,
554 				      const struct netlbl_lsm_secattr *secattr)
555 {
556 	return -ENOSYS;
557 }
558 static inline int netlbl_req_setattr(struct request_sock *req,
559 				     const struct netlbl_lsm_secattr *secattr)
560 {
561 	return -ENOSYS;
562 }
563 static inline void netlbl_req_delattr(struct request_sock *req)
564 {
565 	return;
566 }
567 static inline int netlbl_skbuff_setattr(struct sk_buff *skb,
568 				      u16 family,
569 				      const struct netlbl_lsm_secattr *secattr)
570 {
571 	return -ENOSYS;
572 }
573 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb,
574 					u16 family,
575 					struct netlbl_lsm_secattr *secattr)
576 {
577 	return -ENOSYS;
578 }
579 static inline void netlbl_skbuff_err(struct sk_buff *skb,
580 				     int error,
581 				     int gateway)
582 {
583 	return;
584 }
585 static inline void netlbl_cache_invalidate(void)
586 {
587 	return;
588 }
589 static inline int netlbl_cache_add(const struct sk_buff *skb,
590 				   const struct netlbl_lsm_secattr *secattr)
591 {
592 	return 0;
593 }
594 static inline struct audit_buffer *netlbl_audit_start(int type,
595 						struct netlbl_audit *audit_info)
596 {
597 	return NULL;
598 }
599 #endif /* CONFIG_NETLABEL */
600 
601 #endif /* _NETLABEL_H */
602