1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * 25 * from "tndb.h 7.34 01/08/31 SMI; TSOL 2.x" 26 */ 27 28 #ifndef _SYS_TSOL_TNDB_H 29 #define _SYS_TSOL_TNDB_H 30 31 #include <sys/types.h> 32 #include <sys/zone.h> 33 #include <sys/tsol/label.h> 34 #include <sys/tsol/label_macro.h> 35 #include <net/if.h> 36 37 #ifdef _KERNEL 38 #include <net/route.h> 39 #endif 40 41 #ifdef __cplusplus 42 extern "C" { 43 #endif 44 45 /* same on ILP32 and LP64 */ 46 typedef union tnaddr { 47 struct sockaddr_in ip_addr_v4; 48 struct sockaddr_in6 ip_addr_v6; 49 } tnaddr_t; 50 51 #define ta_family ip_addr_v4.sin_family 52 #define ta_addr_v4 ip_addr_v4.sin_addr 53 #define ta_addr_v6 ip_addr_v6.sin6_addr 54 #define ta_port_v4 ip_addr_v4.sin_port 55 #define ta_port_v6 ip_addr_v6.sin6_port 56 57 #define TNADDR_EQ(addr1, addr2) \ 58 (((addr1)->ta_family == AF_INET && (addr2)->ta_family == AF_INET && \ 59 (addr1)->ta_addr_v4.s_addr == (addr2)->ta_addr_v4.s_addr) || \ 60 ((addr1)->ta_family == AF_INET6 && (addr2)->ta_family == AF_INET6 && \ 61 IN6_ARE_ADDR_EQUAL(&(addr1)->ta_addr_v6, &(addr2)->ta_addr_v6))) 62 63 /* 64 * structure for TN database access routines and TN system calls 65 */ 66 67 typedef enum tsol_dbops { 68 TNDB_NOOP = 0, 69 TNDB_LOAD = 1, 70 TNDB_DELETE = 2, 71 TNDB_FLUSH = 3, 72 TNDB_GET = 5 73 } tsol_dbops_t; 74 75 #define TNTNAMSIZ ZONENAME_MAX /* template name size */ 76 #define IP_STR_SIZE 200 /* string ip address size */ 77 78 #define TNRHDB_NCOL 2 /* # of columns in tnrhdb */ 79 80 /* 81 * For tnrhdb access library routines and tnrh(2TSOL) 82 * same for both ILP32 and LP64. 83 */ 84 typedef struct tsol_rhent { 85 short rh_prefix; /* length of subnet mask */ 86 short rh_unused; /* padding */ 87 tnaddr_t rh_address; /* IP address */ 88 char rh_template[TNTNAMSIZ]; /* template name */ 89 } tsol_rhent_t; 90 91 typedef struct tsol_rhstr_s { 92 int family; 93 char *address; 94 char *template; 95 } tsol_rhstr_t; 96 97 /* 98 * host types recognized by tsol hosts 99 */ 100 typedef enum { 101 UNLABELED = 1, 102 SUN_CIPSO = 3 103 } tsol_host_type_t; 104 105 typedef enum { 106 OPT_NONE = 0, 107 OPT_CIPSO = 1 108 } tsol_ip_label_t; 109 110 typedef struct cipso_tag_type_1 { 111 uchar_t tag_type; /* Tag Type (1) */ 112 uchar_t tag_length; /* Length of Tag */ 113 uchar_t tag_align; /* Alignment Octet */ 114 uchar_t tag_sl; /* Sensitivity Level */ 115 uchar_t tag_cat[1]; /* Categories */ 116 } cipso_tag_type_1_t; 117 118 #define TSOL_CIPSO_MIN_LENGTH 6 119 #define TSOL_CIPSO_MAX_LENGTH IP_MAX_OPT_LENGTH 120 #define TSOL_TT1_MIN_LENGTH 4 121 #define TSOL_TT1_MAX_LENGTH 34 122 123 #define TSOL_CIPSO_DOI_OFFSET 2 124 #define TSOL_CIPSO_TAG_OFFSET 6 125 126 typedef struct cipso_option { 127 uchar_t cipso_type; /* Type of option (134) */ 128 uchar_t cipso_length; /* Length of option */ 129 uchar_t cipso_doi[4]; /* Domain of Interpretation */ 130 uchar_t cipso_tag_type[1]; /* variable length */ 131 } cipso_option_t; 132 133 /* 134 * RIPSO classifications 135 */ 136 #define TSOL_CL_TOP_SECRET 0x3d 137 #define TSOL_CL_SECRET 0x5a 138 #define TSOL_CL_CONFIDENTIAL 0x96 139 #define TSOL_CL_UNCLASSIFIED 0xab 140 141 /* 142 * RIPSO protection authorities 143 */ 144 #define TSOL_PA_GENSER 0x80 145 #define TSOL_PA_SIOP_ESI 0x40 146 #define TSOL_PA_SCI 0x20 147 #define TSOL_PA_NSA 0x10 148 #define TSOL_PA_DOE 0x08 149 150 /* 151 * this mask is only used for tndb structures, and is different 152 * from t6mask_t bits definitions 153 */ 154 155 typedef unsigned int tnmask_t; 156 157 /* 158 * unlabeled host structure for the tnrhtp template. 159 * same for both ILP32 and LP64. 160 */ 161 struct tsol_unl { 162 tnmask_t mask; /* tells which attributes are returned by the library */ 163 bslabel_t def_label; /* default label */ 164 brange_t gw_sl_range; /* for routing only */ 165 blset_t sl_set; /* label set */ 166 }; 167 168 /* 169 * CIPSO host structure for the tnrhtp template 170 * same for both ILP32 and LP64. 171 */ 172 struct tsol_cipso { 173 tnmask_t mask; /* tells which attributes are returned by the library */ 174 bclear_t def_cl; /* default clearance */ 175 brange_t sl_range; /* min/max SL range */ 176 blset_t sl_set; /* label set */ 177 }; 178 179 /* 180 * Valid keys and values of the key=value pairs for tnrhtp 181 */ 182 #define TP_UNLABELED "unlabeled" 183 #define TP_CIPSO "cipso" 184 #define TP_ZONE "zone" 185 #define TP_HOSTTYPE "host_type" 186 #define TP_DOI "doi" 187 #define TP_DEFLABEL "def_label" 188 #define TP_MINLABEL "min_sl" 189 #define TP_MAXLABEL "max_sl" 190 #define TP_SET "sl_set" 191 192 #define TP_COMMA "," 193 194 #define TNRHTP_NCOL 2 /* # of columns in tnrhtp */ 195 196 /* 197 * For tnrhtp access library routines and tnrhtp(2TSOL) 198 * same for both ILP32 and LP64. 199 */ 200 typedef struct tsol_tpent { 201 char name[TNTNAMSIZ]; /* template name */ 202 tsol_host_type_t host_type; /* specifies host type */ 203 int tp_doi; /* Domain of Interpretation */ 204 #define tp_cipso_doi_unl tp_doi 205 #define tp_cipso_doi_cipso tp_doi 206 union { 207 struct tsol_unl unl; /* template for unlabeled */ 208 #define tp_mask_unl un.unl.mask 209 #define tp_def_label un.unl.def_label 210 #define tp_gw_sl_range un.unl.gw_sl_range 211 #define tp_gw_sl_set un.unl.sl_set 212 213 struct tsol_cipso cipso; /* template for CIPSO */ 214 #define tp_mask_cipso un.cipso.mask 215 #define tp_def_cl_cipso un.cipso.def_cl 216 #define tp_sl_range_cipso un.cipso.sl_range 217 #define tp_sl_set_cipso un.cipso.sl_set 218 } un; 219 } tsol_tpent_t; 220 221 typedef struct tsol_tpstr_s { 222 char *template; 223 char *attrs; 224 } tsol_tpstr_t; 225 226 /* 227 * For tnmlp(2TSOL); same for both ILP32 and LP64. 228 */ 229 typedef struct tsol_mlpent { 230 zoneid_t tsme_zoneid; 231 uint_t tsme_flags; /* TSOL_MEF_* */ 232 tsol_mlp_t tsme_mlp; 233 } tsol_mlpent_t; 234 235 #define TSOL_MEF_SHARED 0x00000001 /* MLP defined on shared addresses */ 236 237 /* 238 * For tnzonecfg access library routines. 239 * List of MLPs ends with null entry, where protocol and port are both zero. 240 */ 241 typedef struct tsol_zcent { 242 char zc_name[ZONENAME_MAX]; 243 int zc_doi; 244 bslabel_t zc_label; 245 int zc_match; 246 tsol_mlp_t *zc_private_mlp; 247 tsol_mlp_t *zc_shared_mlp; 248 } tsol_zcent_t; 249 #define TSOL_MLP_END(mlp) ((mlp)->mlp_ipp == 0 && (mlp)->mlp_port == 0) 250 251 typedef struct tsol_tpc { 252 kmutex_t tpc_lock; /* lock for structure */ 253 uint_t tpc_refcnt; /* reference count */ 254 boolean_t tpc_invalid; /* entry has been deleted */ 255 struct tsol_tpent tpc_tp; /* template */ 256 } tsol_tpc_t; 257 258 typedef struct tsol_tnrhc { 259 struct tsol_tnrhc *rhc_next; /* link to next entry */ 260 kmutex_t rhc_lock; /* lock for structure */ 261 tnaddr_t rhc_host; /* IPv4/IPv6 host address */ 262 tsol_tpc_t *rhc_tpc; /* pointer to template */ 263 uint_t rhc_refcnt; /* Number of references */ 264 char rhc_invalid; /* out-of-date rhc */ 265 char rhc_isbcast; /* broadcast address */ 266 char rhc_local; /* loopback or local interace */ 267 } tsol_tnrhc_t; 268 269 /* Size of remote host hash tables in kernel */ 270 #define TNRHC_SIZE 256 271 #define TSOL_MASK_TABLE_SIZE 33 272 #define TSOL_MASK_TABLE_SIZE_V6 129 273 274 #ifdef _KERNEL 275 #define TNRHC_HOLD(a) { \ 276 mutex_enter(&(a)->rhc_lock); \ 277 (a)->rhc_refcnt++; \ 278 ASSERT((a)->rhc_refcnt > 0); \ 279 mutex_exit(&(a)->rhc_lock); \ 280 } 281 #define TNRHC_RELE(a) { \ 282 mutex_enter(&(a)->rhc_lock); \ 283 ASSERT((a)->rhc_refcnt > 0); \ 284 if (--(a)->rhc_refcnt <= 0) \ 285 tnrhc_free(a); \ 286 else \ 287 mutex_exit(&(a)->rhc_lock); \ 288 } 289 extern void tnrhc_free(tsol_tnrhc_t *); 290 #define TPC_HOLD(a) { \ 291 mutex_enter(&(a)->tpc_lock); \ 292 (a)->tpc_refcnt++; \ 293 ASSERT((a)->tpc_refcnt > 0); \ 294 mutex_exit(&(a)->tpc_lock); \ 295 } 296 #define TPC_RELE(a) { \ 297 mutex_enter(&(a)->tpc_lock); \ 298 ASSERT((a)->tpc_refcnt > 0); \ 299 if (--(a)->tpc_refcnt <= 0) \ 300 tpc_free(a); \ 301 else \ 302 mutex_exit(&(a)->tpc_lock); \ 303 } 304 extern void tpc_free(tsol_tpc_t *); 305 #endif /* _KERNEL */ 306 307 /* 308 * The next three hashing macros are copied from macros in ip_ire.h. 309 */ 310 #define TSOL_ADDR_HASH(addr, table_size) \ 311 (((((addr) >> 16) ^ (addr)) ^ ((((addr) >> 16) ^ (addr))>> 8)) \ 312 % (table_size)) 313 314 #define TSOL_ADDR_HASH_V6(addr, table_size) \ 315 (((addr).s6_addr8[8] ^ (addr).s6_addr8[9] ^ \ 316 (addr).s6_addr8[10] ^ (addr).s6_addr8[13] ^ \ 317 (addr).s6_addr8[14] ^ (addr).s6_addr8[15]) % (table_size)) 318 319 /* This assumes that table_size is a power of 2. */ 320 #define TSOL_ADDR_MASK_HASH_V6(addr, mask, table_size) \ 321 ((((addr).s6_addr8[8] & (mask).s6_addr8[8]) ^ \ 322 ((addr).s6_addr8[9] & (mask).s6_addr8[9]) ^ \ 323 ((addr).s6_addr8[10] & (mask).s6_addr8[10]) ^ \ 324 ((addr).s6_addr8[13] & (mask).s6_addr8[13]) ^ \ 325 ((addr).s6_addr8[14] & (mask).s6_addr8[14]) ^ \ 326 ((addr).s6_addr8[15] & (mask).s6_addr8[15])) & ((table_size) - 1)) 327 328 329 /* 330 * Constants used for getting the mask value in struct tsol_tpent 331 */ 332 enum { 333 TNT_DEF_LABEL, 334 TNT_DEF_CL, 335 TNT_SL_RANGE_TSOL, /* use this for both unl and zone */ 336 TNT_CIPSO_DOI 337 }; 338 339 /* 340 * mask definitions 341 */ 342 #define tsol_tntmask(value) ((unsigned int)(1<<(value))) 343 344 #define TSOL_MSK_DEF_LABEL tsol_tntmask(TNT_DEF_LABEL) 345 #define TSOL_MSK_DEF_CL tsol_tntmask(TNT_DEF_CL) 346 #define TSOL_MSK_SL_RANGE_TSOL tsol_tntmask(TNT_SL_RANGE_TSOL) 347 #define TSOL_MSK_CIPSO_DOI tsol_tntmask(TNT_CIPSO_DOI) 348 349 /* 350 * TN errors 351 */ 352 #define TSOL_PARSE_ERANGE 1 /* result buffer not allocated */ 353 #define TSOL_NOT_SUPPORTED 2 /* address family not supported */ 354 #define TSOL_NOT_FOUND 3 /* search by * routines target not found */ 355 356 /* 357 * Structure used to hold a list of IP addresses. 358 */ 359 typedef struct tsol_address { 360 struct tsol_address *next; 361 in_addr_t ip_address; 362 } tsol_address_t; 363 364 /* This is shared between tcache and mdb */ 365 typedef struct tnrhc_hash_s { 366 tsol_tnrhc_t *tnrh_list; 367 kmutex_t tnrh_lock; 368 } tnrhc_hash_t; 369 370 #ifdef _KERNEL 371 typedef enum { 372 mlptSingle, 373 mlptPrivate, 374 mlptShared, 375 mlptBoth 376 } mlp_type_t; 377 378 extern tsol_tpc_t *find_tpc(const void *, uchar_t, boolean_t); 379 extern void tcache_init(void); 380 extern in_port_t tsol_next_port(zone_t *, in_port_t, int, boolean_t); 381 extern mlp_type_t tsol_mlp_port_type(zone_t *, uchar_t, uint16_t, mlp_type_t); 382 extern zoneid_t tsol_mlp_findzone(uchar_t, uint16_t); 383 extern int tsol_mlp_anon(zone_t *, mlp_type_t, uchar_t, uint16_t, boolean_t); 384 extern void tsol_print_label(const blevel_t *, const char *); 385 386 struct tsol_gc_s; 387 struct tsol_gcgrp_s; 388 struct tsol_gcgrp_addr_s; 389 390 extern struct tsol_gc_s *gc_create(struct rtsa_s *, struct tsol_gcgrp_s *, 391 boolean_t *); 392 extern void gc_inactive(struct tsol_gc_s *); 393 extern int rtsa_validate(const struct rtsa_s *); 394 extern struct tsol_gcgrp_s *gcgrp_lookup(struct tsol_gcgrp_addr_s *, boolean_t); 395 extern void gcgrp_inactive(struct tsol_gcgrp_s *); 396 extern int tnrh_load(const tsol_rhent_t *); 397 #endif /* _KERNEL */ 398 399 #ifdef __cplusplus 400 } 401 #endif 402 403 #endif /* _SYS_TSOL_TNDB_H */ 404