1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3 * NetLabel Management Support
4 *
5 * This file defines the management functions for the NetLabel system. The
6 * NetLabel system manages static and dynamic label mappings for network
7 * protocols such as CIPSO and RIPSO.
8 *
9 * Author: Paul Moore <paul@paul-moore.com>
10 */
11
12 /*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 */
15
16 #ifndef _NETLABEL_MGMT_H
17 #define _NETLABEL_MGMT_H
18
19 #include <net/netlabel.h>
20 #include <linux/atomic.h>
21
22 /*
23 * The following NetLabel payloads are supported by the management interface.
24 *
25 * o ADD:
26 * Sent by an application to add a domain mapping to the NetLabel system.
27 *
28 * Required attributes:
29 *
30 * NLBL_MGMT_A_DOMAIN
31 * NLBL_MGMT_A_PROTOCOL
32 *
33 * If IPv4 is specified the following attributes are required:
34 *
35 * NLBL_MGMT_A_IPV4ADDR
36 * NLBL_MGMT_A_IPV4MASK
37 *
38 * If IPv6 is specified the following attributes are required:
39 *
40 * NLBL_MGMT_A_IPV6ADDR
41 * NLBL_MGMT_A_IPV6MASK
42 *
43 * If using NETLBL_NLTYPE_CIPSOV4 the following attributes are required:
44 *
45 * NLBL_MGMT_A_CV4DOI
46 *
47 * If using NETLBL_NLTYPE_UNLABELED no other attributes are required,
48 * however the following attribute may optionally be sent:
49 *
50 * NLBL_MGMT_A_FAMILY
51 *
52 * o REMOVE:
53 * Sent by an application to remove a domain mapping from the NetLabel
54 * system.
55 *
56 * Required attributes:
57 *
58 * NLBL_MGMT_A_DOMAIN
59 *
60 * o LISTALL:
61 * This message can be sent either from an application or by the kernel in
62 * response to an application generated LISTALL message. When sent by an
63 * application there is no payload and the NLM_F_DUMP flag should be set.
64 * The kernel should respond with a series of the following messages.
65 *
66 * Required attributes:
67 *
68 * NLBL_MGMT_A_DOMAIN
69 * NLBL_MGMT_A_FAMILY
70 *
71 * If the IP address selectors are not used the following attribute is
72 * required:
73 *
74 * NLBL_MGMT_A_PROTOCOL
75 *
76 * If the IP address selectors are used then the following attritbute is
77 * required:
78 *
79 * NLBL_MGMT_A_SELECTORLIST
80 *
81 * If the mapping is using the NETLBL_NLTYPE_CIPSOV4 type then the following
82 * attributes are required:
83 *
84 * NLBL_MGMT_A_CV4DOI
85 *
86 * If the mapping is using the NETLBL_NLTYPE_UNLABELED type no other
87 * attributes are required.
88 *
89 * o ADDDEF:
90 * Sent by an application to set the default domain mapping for the NetLabel
91 * system.
92 *
93 * Required attributes:
94 *
95 * NLBL_MGMT_A_PROTOCOL
96 *
97 * If using NETLBL_NLTYPE_CIPSOV4 the following attributes are required:
98 *
99 * NLBL_MGMT_A_CV4DOI
100 *
101 * If using NETLBL_NLTYPE_UNLABELED no other attributes are required,
102 * however the following attribute may optionally be sent:
103 *
104 * NLBL_MGMT_A_FAMILY
105 *
106 * o REMOVEDEF:
107 * Sent by an application to remove the default domain mapping from the
108 * NetLabel system, there is no payload.
109 *
110 * o LISTDEF:
111 * This message can be sent either from an application or by the kernel in
112 * response to an application generated LISTDEF message. When sent by an
113 * application there may be an optional payload.
114 *
115 * NLBL_MGMT_A_FAMILY
116 *
117 * On success the kernel should send a response using the following format:
118 *
119 * If the IP address selectors are not used the following attributes are
120 * required:
121 *
122 * NLBL_MGMT_A_PROTOCOL
123 * NLBL_MGMT_A_FAMILY
124 *
125 * If the IP address selectors are used then the following attritbute is
126 * required:
127 *
128 * NLBL_MGMT_A_SELECTORLIST
129 *
130 * If the mapping is using the NETLBL_NLTYPE_CIPSOV4 type then the following
131 * attributes are required:
132 *
133 * NLBL_MGMT_A_CV4DOI
134 *
135 * If the mapping is using the NETLBL_NLTYPE_UNLABELED type no other
136 * attributes are required.
137 *
138 * o PROTOCOLS:
139 * Sent by an application to request a list of configured NetLabel protocols
140 * in the kernel. When sent by an application there is no payload and the
141 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
142 * the following messages.
143 *
144 * Required attributes:
145 *
146 * NLBL_MGMT_A_PROTOCOL
147 *
148 * o VERSION:
149 * Sent by an application to request the NetLabel version. When sent by an
150 * application there is no payload. This message type is also used by the
151 * kernel to respond to an VERSION request.
152 *
153 * Required attributes:
154 *
155 * NLBL_MGMT_A_VERSION
156 *
157 */
158
159 /* NetLabel Management commands */
160 enum {
161 NLBL_MGMT_C_UNSPEC,
162 NLBL_MGMT_C_ADD,
163 NLBL_MGMT_C_REMOVE,
164 NLBL_MGMT_C_LISTALL,
165 NLBL_MGMT_C_ADDDEF,
166 NLBL_MGMT_C_REMOVEDEF,
167 NLBL_MGMT_C_LISTDEF,
168 NLBL_MGMT_C_PROTOCOLS,
169 NLBL_MGMT_C_VERSION,
170 __NLBL_MGMT_C_MAX,
171 };
172
173 /* NetLabel Management attributes */
174 enum {
175 NLBL_MGMT_A_UNSPEC,
176 NLBL_MGMT_A_DOMAIN,
177 /* (NLA_NUL_STRING)
178 * the NULL terminated LSM domain string */
179 NLBL_MGMT_A_PROTOCOL,
180 /* (NLA_U32)
181 * the NetLabel protocol type (defined by NETLBL_NLTYPE_*) */
182 NLBL_MGMT_A_VERSION,
183 /* (NLA_U32)
184 * the NetLabel protocol version number (defined by
185 * NETLBL_PROTO_VERSION) */
186 NLBL_MGMT_A_CV4DOI,
187 /* (NLA_U32)
188 * the CIPSOv4 DOI value */
189 NLBL_MGMT_A_IPV6ADDR,
190 /* (NLA_BINARY, struct in6_addr)
191 * an IPv6 address */
192 NLBL_MGMT_A_IPV6MASK,
193 /* (NLA_BINARY, struct in6_addr)
194 * an IPv6 address mask */
195 NLBL_MGMT_A_IPV4ADDR,
196 /* (NLA_BINARY, struct in_addr)
197 * an IPv4 address */
198 NLBL_MGMT_A_IPV4MASK,
199 /* (NLA_BINARY, struct in_addr)
200 * and IPv4 address mask */
201 NLBL_MGMT_A_ADDRSELECTOR,
202 /* (NLA_NESTED)
203 * an IP address selector, must contain an address, mask, and protocol
204 * attribute plus any protocol specific attributes */
205 NLBL_MGMT_A_SELECTORLIST,
206 /* (NLA_NESTED)
207 * the selector list, there must be at least one
208 * NLBL_MGMT_A_ADDRSELECTOR attribute */
209 NLBL_MGMT_A_FAMILY,
210 /* (NLA_U16)
211 * The address family */
212 NLBL_MGMT_A_CLPDOI,
213 /* (NLA_U32)
214 * the CALIPSO DOI value */
215 __NLBL_MGMT_A_MAX,
216 };
217 #define NLBL_MGMT_A_MAX (__NLBL_MGMT_A_MAX - 1)
218
219 /* NetLabel protocol functions */
220 int netlbl_mgmt_genl_init(void);
221
222 /* NetLabel configured protocol reference counter */
223 extern atomic_t netlabel_mgmt_protocount;
224
225 #endif