Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695/* SPDX-License-Identifier: GPL-2.0-or-later *//* * NetLabel System * * The NetLabel system manages static and dynamic label mappings for network * protocols such as CIPSO and RIPSO. * * Author: Paul Moore <paul@paul-moore.com> */
/* * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 */
#ifndef _NETLABEL_H#define _NETLABEL_H
#include <linux/types.h>#include <linux/slab.h>#include <linux/net.h>#include <linux/skbuff.h>#include <linux/in.h>#include <linux/in6.h>#include <net/netlink.h>#include <net/request_sock.h>#include <linux/refcount.h>
struct cipso_v4_doi;struct calipso_doi;
/* * NetLabel - A management interface for maintaining network packet label * mapping tables for explicit packet labeling protocols. * * Network protocols such as CIPSO and RIPSO require a label translation layer * to convert the label on the packet into something meaningful on the host * machine. In the current Linux implementation these mapping tables live * inside the kernel; NetLabel provides a mechanism for user space applications * to manage these mapping tables. * * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to * send messages between kernel and user space. The general format of a * NetLabel message is shown below: * * +-----------------+-------------------+--------- --- -- - * | struct nlmsghdr | struct genlmsghdr | payload * +-----------------+-------------------+--------- --- -- - * * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal. * The payload is dependent on the subsystem specified in the * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c * file. All of the fields in the NetLabel payload are NETLINK attributes, see * the include/net/netlink.h file for more information on NETLINK attributes. * */
/* * NetLabel NETLINK protocol */
/* NetLabel NETLINK protocol version * 1: initial version * 2: added static labels for unlabeled connections * 3: network selectors added to the NetLabel/LSM domain mapping and the * CIPSO_V4_MAP_LOCAL CIPSO mapping was added */#define NETLBL_PROTO_VERSION 3
/* NetLabel NETLINK types/families */#define NETLBL_NLTYPE_NONE 0#define NETLBL_NLTYPE_MGMT 1#define NETLBL_NLTYPE_MGMT_NAME "NLBL_MGMT"#define NETLBL_NLTYPE_RIPSO 2#define NETLBL_NLTYPE_RIPSO_NAME "NLBL_RIPSO"#define NETLBL_NLTYPE_CIPSOV4 3#define NETLBL_NLTYPE_CIPSOV4_NAME "NLBL_CIPSOv4"#define NETLBL_NLTYPE_CIPSOV6 4#define NETLBL_NLTYPE_CIPSOV6_NAME "NLBL_CIPSOv6"#define NETLBL_NLTYPE_UNLABELED 5#define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL"#define NETLBL_NLTYPE_ADDRSELECT 6#define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL"#define NETLBL_NLTYPE_CALIPSO 7#define NETLBL_NLTYPE_CALIPSO_NAME "NLBL_CALIPSO"
/* * NetLabel - Kernel API for accessing the network packet label mappings. * * The following functions are provided for use by other kernel modules, * specifically kernel LSM modules, to provide a consistent, transparent API * for dealing with explicit packet labeling protocols such as CIPSO and * RIPSO. The functions defined here are implemented in the * net/netlabel/netlabel_kapi.c file. * */
/* NetLabel audit information */struct netlbl_audit { struct lsm_prop prop; kuid_t loginuid; unsigned int sessionid;};
/* * LSM security attributes */
/** * struct netlbl_lsm_cache - NetLabel LSM security attribute cache * @refcount: atomic reference counter * @free: LSM supplied function to free the cache data * @data: LSM supplied cache data * * Description: * This structure is provided for LSMs which wish to make use of the NetLabel * caching mechanism to store LSM specific data/attributes in the NetLabel * cache. If the LSM has to perform a lot of translation from the NetLabel * security attributes into it's own internal representation then the cache * mechanism can provide a way to eliminate some or all of that translation * overhead on a cache hit. * */struct netlbl_lsm_cache { refcount_t refcount; void (*free) (const void *data); void *data;};
/** * struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap * @startbit: the value of the lowest order bit in the bitmap * @bitmap: the category bitmap * @next: pointer to the next bitmap "node" or NULL * * Description: * This structure is used to represent category bitmaps. Due to the large * number of categories supported by most labeling protocols it is not * practical to transfer a full bitmap internally so NetLabel adopts a sparse * bitmap structure modeled after SELinux's ebitmap structure. * The catmap bitmap field MUST be a power of two in length and large * enough to hold at least 240 bits. Special care (i.e. check the code!) * should be used when changing these values as the LSM implementation * probably has functions which rely on the sizes of these types to speed * processing. * */#define NETLBL_CATMAP_MAPCNT 4#define NETLBL_CATMAP_MAPSIZE (sizeof(u64) * 8)#define NETLBL_CATMAP_SIZE (NETLBL_CATMAP_MAPSIZE * \ NETLBL_CATMAP_MAPCNT)#define NETLBL_CATMAP_BIT ((u64)0x01)struct netlbl_lsm_catmap { u32 startbit; u64 bitmap[NETLBL_CATMAP_MAPCNT]; struct netlbl_lsm_catmap *next;};
/** * struct netlbl_lsm_secattr - NetLabel LSM security attributes * @flags: indicate structure attributes, see NETLBL_SECATTR_* * @type: indicate the NLTYPE of the attributes * @domain: the NetLabel LSM domain * @cache: NetLabel LSM specific cache * @attr.mls: MLS sensitivity label * @attr.mls.cat: MLS category bitmap * @attr.mls.lvl: MLS sensitivity level * @attr.secid: LSM specific secid token * * Description: * This structure is used to pass security attributes between NetLabel and the * LSM modules. The flags field is used to specify which fields within the * struct are valid and valid values can be created by bitwise OR'ing the * NETLBL_SECATTR_* defines. The domain field is typically set by the LSM to * specify domain specific configuration settings and is not usually used by * NetLabel itself when returning security attributes to the LSM. * */struct netlbl_lsm_secattr { u32 flags; /* bitmap values for 'flags' */#define NETLBL_SECATTR_NONE 0x00000000#define NETLBL_SECATTR_DOMAIN 0x00000001#define NETLBL_SECATTR_DOMAIN_CPY (NETLBL_SECATTR_DOMAIN | \ NETLBL_SECATTR_FREE_DOMAIN)#define NETLBL_SECATTR_CACHE 0x00000002#define NETLBL_SECATTR_MLS_LVL 0x00000004#define NETLBL_SECATTR_MLS_CAT 0x00000008#define NETLBL_SECATTR_SECID 0x00000010 /* bitmap meta-values for 'flags' */#define NETLBL_SECATTR_FREE_DOMAIN 0x01000000#define NETLBL_SECATTR_CACHEABLE (NETLBL_SECATTR_MLS_LVL | \ NETLBL_SECATTR_MLS_CAT | \ NETLBL_SECATTR_SECID) u32 type; char *domain; struct netlbl_lsm_cache *cache; struct { struct { struct netlbl_lsm_catmap *cat; u32 lvl; } mls; u32 secid; } attr;};
/** * struct netlbl_calipso_ops - NetLabel CALIPSO operations * @doi_add: add a CALIPSO DOI * @doi_free: free a CALIPSO DOI * @doi_remove: remove a CALIPSO DOI * @doi_getdef: returns a reference to a DOI * @doi_putdef: releases a reference of a DOI * @doi_walk: enumerate the DOI list * @sock_getattr: retrieve the socket's attr * @sock_setattr: set the socket's attr * @sock_delattr: remove the socket's attr * @req_setattr: set the req socket's attr * @req_delattr: remove the req socket's attr * @opt_getattr: retrieve attr from memory block * @skbuff_optptr: find option in packet * @skbuff_setattr: set the skbuff's attr * @skbuff_delattr: remove the skbuff's attr * @cache_invalidate: invalidate cache * @cache_add: add cache entry * * Description: * This structure is filled out by the CALIPSO engine and passed * to the NetLabel core via a call to netlbl_calipso_ops_register(). * It enables the CALIPSO engine (and hence IPv6) to be compiled * as a module. */struct netlbl_calipso_ops { int (*doi_add)(struct calipso_doi *doi_def, struct netlbl_audit *audit_info); void (*doi_free)(struct calipso_doi *doi_def); int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info); struct calipso_doi *(*doi_getdef)(u32 doi); void (*doi_putdef)(struct calipso_doi *doi_def); int (*doi_walk)(u32 *skip_cnt, int (*callback)(struct calipso_doi *doi_def, void *arg), void *cb_arg); int (*sock_getattr)(struct sock *sk, struct netlbl_lsm_secattr *secattr); int (*sock_setattr)(struct sock *sk, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); void (*sock_delattr)(struct sock *sk); int (*req_setattr)(struct request_sock *req, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); void (*req_delattr)(struct request_sock *req); int (*opt_getattr)(const unsigned char *calipso, struct netlbl_lsm_secattr *secattr); unsigned char *(*skbuff_optptr)(const struct sk_buff *skb); int (*skbuff_setattr)(struct sk_buff *skb, const struct calipso_doi *doi_def, const struct netlbl_lsm_secattr *secattr); int (*skbuff_delattr)(struct sk_buff *skb); void (*cache_invalidate)(void); int (*cache_add)(const unsigned char *calipso_ptr, const struct netlbl_lsm_secattr *secattr);};
/* * LSM security attribute operations (inline) */
/** * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache * @flags: the memory allocation flags * * Description: * Allocate and initialize a netlbl_lsm_cache structure. Returns a pointer * on success, NULL on failure. * */static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc_noprof(gfp_t flags){ struct netlbl_lsm_cache *cache;
cache = kzalloc_noprof(sizeof(*cache), flags); if (cache) refcount_set(&cache->refcount, 1); return cache;}#define netlbl_secattr_cache_alloc(...) \ alloc_hooks(netlbl_secattr_cache_alloc_noprof(__VA_ARGS__))
/** * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct * @cache: the struct to free * * Description: * Frees @secattr including all of the internal buffers. * */static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache){ if (!refcount_dec_and_test(&cache->refcount)) return;
if (cache->free) cache->free(cache->data); kfree(cache);}
/** * netlbl_catmap_alloc - Allocate a LSM secattr catmap * @flags: memory allocation flags * * Description: * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL * on failure. * */static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc_noprof(gfp_t flags){ return kzalloc_noprof(sizeof(struct netlbl_lsm_catmap), flags);}#define netlbl_catmap_alloc(...) alloc_hooks(netlbl_catmap_alloc_noprof(__VA_ARGS__))
/** * netlbl_catmap_free - Free a LSM secattr catmap * @catmap: the category bitmap * * Description: * Free a LSM secattr catmap. * */static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap){ struct netlbl_lsm_catmap *iter;
while (catmap) { iter = catmap; catmap = catmap->next; kfree(iter); }}
/** * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct * @secattr: the struct to initialize * * Description: * Initialize an already allocated netlbl_lsm_secattr struct. * */static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr){ memset(secattr, 0, sizeof(*secattr));}
/** * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct * @secattr: the struct to clear * * Description: * Destroys the @secattr struct, including freeing all of the internal buffers. * The struct must be reset with a call to netlbl_secattr_init() before reuse. * */static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr){ if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN) kfree(secattr->domain); if (secattr->flags & NETLBL_SECATTR_CACHE) netlbl_secattr_cache_free(secattr->cache); if (secattr->flags & NETLBL_SECATTR_MLS_CAT) netlbl_catmap_free(secattr->attr.mls.cat);}
/** * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct * @flags: the memory allocation flags * * Description: * Allocate and initialize a netlbl_lsm_secattr struct. Returns a valid * pointer on success, or NULL on failure. * */static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc_noprof(gfp_t flags){ return kzalloc_noprof(sizeof(struct netlbl_lsm_secattr), flags);}#define netlbl_secattr_alloc(...) alloc_hooks(netlbl_secattr_alloc_noprof(__VA_ARGS__))
/** * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct * @secattr: the struct to free * * Description: * Frees @secattr including all of the internal buffers. * */static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr){ netlbl_secattr_destroy(secattr); kfree(secattr);}
#ifdef CONFIG_NETLABEL/* * LSM configuration operations */int netlbl_cfg_map_del(const char *domain, u16 family, const void *addr, const void *mask, struct netlbl_audit *audit_info);int netlbl_cfg_unlbl_map_add(const char *domain, u16 family, const void *addr, const void *mask, struct netlbl_audit *audit_info);int netlbl_cfg_unlbl_static_add(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, u32 secid, struct netlbl_audit *audit_info);int netlbl_cfg_unlbl_static_del(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, struct netlbl_audit *audit_info);int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, struct netlbl_audit *audit_info);void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);int netlbl_cfg_cipsov4_map_add(u32 doi, const char *domain, const struct in_addr *addr, const struct in_addr *mask, struct netlbl_audit *audit_info);int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info);void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);int netlbl_cfg_calipso_map_add(u32 doi, const char *domain, const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info);/* * LSM security attribute operations */int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset);int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset);int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, u32 *offset, unsigned long *bitmap);int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, u32 bit, gfp_t flags);int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, u32 start, u32 end, gfp_t flags);int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, u32 offset, unsigned long bitmap, gfp_t flags);
/* Bitmap functions */int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, u32 offset, u8 state);void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state);
/* * LSM protocol operations (NetLabel LSM/kernel API) */int netlbl_enabled(void);int netlbl_sock_setattr(struct sock *sk, u16 family, const struct netlbl_lsm_secattr *secattr, bool sk_locked);void netlbl_sock_delattr(struct sock *sk);int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr);int netlbl_req_setattr(struct request_sock *req, const struct netlbl_lsm_secattr *secattr);void netlbl_req_delattr(struct request_sock *req);int netlbl_skbuff_setattr(struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr);int netlbl_skbuff_getattr(const struct sk_buff *skb, u16 family, struct netlbl_lsm_secattr *secattr);void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway);bool netlbl_sk_lock_check(struct sock *sk);
/* * LSM label mapping cache operations */void netlbl_cache_invalidate(void);int netlbl_cache_add(const struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr);
/* * Protocol engine operations */struct audit_buffer *netlbl_audit_start(int type, struct netlbl_audit *audit_info);#elsestatic inline int netlbl_cfg_map_del(const char *domain, u16 family, const void *addr, const void *mask, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_cfg_unlbl_map_add(const char *domain, u16 family, void *addr, void *mask, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_cfg_unlbl_static_add(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, u32 secid, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_cfg_unlbl_static_del(struct net *net, const char *dev_name, const void *addr, const void *mask, u16 family, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info){ return;}static inline int netlbl_cfg_cipsov4_map_add(u32 doi, const char *domain, const struct in_addr *addr, const struct in_addr *mask, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info){ return;}static inline int netlbl_cfg_calipso_map_add(u32 doi, const char *domain, const struct in6_addr *addr, const struct in6_addr *mask, struct netlbl_audit *audit_info){ return -ENOSYS;}static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset){ return -ENOENT;}static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset){ return -ENOENT;}static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, u32 *offset, unsigned long *bitmap){ return 0;}static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, u32 bit, gfp_t flags){ return 0;}static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, u32 start, u32 end, gfp_t flags){ return 0;}static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, u32 offset, unsigned long bitmap, gfp_t flags){ return 0;}static inline int netlbl_enabled(void){ return 0;}static inline int netlbl_sock_setattr(struct sock *sk, u16 family, const struct netlbl_lsm_secattr *secattr, bool sk_locked){ return -ENOSYS;}static inline void netlbl_sock_delattr(struct sock *sk){}static inline int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr){ return -ENOSYS;}static inline int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr){ return -ENOSYS;}static inline int netlbl_req_setattr(struct request_sock *req, const struct netlbl_lsm_secattr *secattr){ return -ENOSYS;}static inline void netlbl_req_delattr(struct request_sock *req){ return;}static inline int netlbl_skbuff_setattr(struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr){ return -ENOSYS;}static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, u16 family, struct netlbl_lsm_secattr *secattr){ return -ENOSYS;}static inline void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway){ return;}static inline void netlbl_cache_invalidate(void){ return;}static inline int netlbl_cache_add(const struct sk_buff *skb, u16 family, const struct netlbl_lsm_secattr *secattr){ return 0;}static inline struct audit_buffer *netlbl_audit_start(int type, struct netlbl_audit *audit_info){ return NULL;}
static inline bool netlbl_sk_lock_check(struct sock *sk){ return true;}#endif /* CONFIG_NETLABEL */
const struct netlbl_calipso_ops *netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops);
#endif /* _NETLABEL_H */