ba6ff9f2b5
The current NetLabel code has some redundant APIs which allow both "struct socket" and "struct sock" types to be used; this may have made sense at some point but it is wasteful now. Remove the functions that operate on sockets and convert the callers. Not only does this make the code smaller and more consistent but it pushes the locking burden up to the caller which can be more intelligent about the locks. Also, perform the same conversion (socket to sock) on the SELinux/NetLabel glue code where it make sense. Signed-off-by: Paul Moore <paul.moore@hp.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>
247 lines
6.2 KiB
C
247 lines
6.2 KiB
C
/*
|
|
* CIPSO - Commercial IP Security Option
|
|
*
|
|
* This is an implementation of the CIPSO 2.2 protocol as specified in
|
|
* draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
|
|
* FIPS-188, copies of both documents can be found in the Documentation
|
|
* directory. While CIPSO never became a full IETF RFC standard many vendors
|
|
* have chosen to adopt the protocol and over the years it has become a
|
|
* de-facto standard for labeled networking.
|
|
*
|
|
* Author: Paul Moore <paul.moore@hp.com>
|
|
*
|
|
*/
|
|
|
|
/*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
|
|
* the GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
*/
|
|
|
|
#ifndef _CIPSO_IPV4_H
|
|
#define _CIPSO_IPV4_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <linux/list.h>
|
|
#include <linux/net.h>
|
|
#include <linux/skbuff.h>
|
|
#include <net/netlabel.h>
|
|
|
|
/* known doi values */
|
|
#define CIPSO_V4_DOI_UNKNOWN 0x00000000
|
|
|
|
/* tag types */
|
|
#define CIPSO_V4_TAG_INVALID 0
|
|
#define CIPSO_V4_TAG_RBITMAP 1
|
|
#define CIPSO_V4_TAG_ENUM 2
|
|
#define CIPSO_V4_TAG_RANGE 5
|
|
#define CIPSO_V4_TAG_PBITMAP 6
|
|
#define CIPSO_V4_TAG_FREEFORM 7
|
|
|
|
/* doi mapping types */
|
|
#define CIPSO_V4_MAP_UNKNOWN 0
|
|
#define CIPSO_V4_MAP_STD 1
|
|
#define CIPSO_V4_MAP_PASS 2
|
|
|
|
/* limits */
|
|
#define CIPSO_V4_MAX_REM_LVLS 255
|
|
#define CIPSO_V4_INV_LVL 0x80000000
|
|
#define CIPSO_V4_MAX_LOC_LVLS (CIPSO_V4_INV_LVL - 1)
|
|
#define CIPSO_V4_MAX_REM_CATS 65534
|
|
#define CIPSO_V4_INV_CAT 0x80000000
|
|
#define CIPSO_V4_MAX_LOC_CATS (CIPSO_V4_INV_CAT - 1)
|
|
|
|
/*
|
|
* CIPSO DOI definitions
|
|
*/
|
|
|
|
/* DOI definition struct */
|
|
#define CIPSO_V4_TAG_MAXCNT 5
|
|
struct cipso_v4_doi {
|
|
u32 doi;
|
|
u32 type;
|
|
union {
|
|
struct cipso_v4_std_map_tbl *std;
|
|
} map;
|
|
u8 tags[CIPSO_V4_TAG_MAXCNT];
|
|
|
|
u32 valid;
|
|
struct list_head list;
|
|
struct rcu_head rcu;
|
|
struct list_head dom_list;
|
|
};
|
|
|
|
/* Standard CIPSO mapping table */
|
|
/* NOTE: the highest order bit (i.e. 0x80000000) is an 'invalid' flag, if the
|
|
* bit is set then consider that value as unspecified, meaning the
|
|
* mapping for that particular level/category is invalid */
|
|
struct cipso_v4_std_map_tbl {
|
|
struct {
|
|
u32 *cipso;
|
|
u32 *local;
|
|
u32 cipso_size;
|
|
u32 local_size;
|
|
} lvl;
|
|
struct {
|
|
u32 *cipso;
|
|
u32 *local;
|
|
u32 cipso_size;
|
|
u32 local_size;
|
|
} cat;
|
|
};
|
|
|
|
/*
|
|
* Sysctl Variables
|
|
*/
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
extern int cipso_v4_cache_enabled;
|
|
extern int cipso_v4_cache_bucketsize;
|
|
extern int cipso_v4_rbm_optfmt;
|
|
extern int cipso_v4_rbm_strictvalid;
|
|
#endif
|
|
|
|
/*
|
|
* Helper Functions
|
|
*/
|
|
|
|
#define CIPSO_V4_OPTEXIST(x) (IPCB(x)->opt.cipso != 0)
|
|
#define CIPSO_V4_OPTPTR(x) (skb_network_header(x) + IPCB(x)->opt.cipso)
|
|
|
|
/*
|
|
* DOI List Functions
|
|
*/
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
int cipso_v4_doi_add(struct cipso_v4_doi *doi_def);
|
|
int cipso_v4_doi_remove(u32 doi,
|
|
struct netlbl_audit *audit_info,
|
|
void (*callback) (struct rcu_head * head));
|
|
struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
|
|
int cipso_v4_doi_walk(u32 *skip_cnt,
|
|
int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
|
|
void *cb_arg);
|
|
int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain);
|
|
int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
|
|
const char *domain);
|
|
#else
|
|
static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
|
|
static inline int cipso_v4_doi_remove(u32 doi,
|
|
struct netlbl_audit *audit_info,
|
|
void (*callback) (struct rcu_head * head))
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline int cipso_v4_doi_walk(u32 *skip_cnt,
|
|
int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
|
|
void *cb_arg)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def,
|
|
const char *domain)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
|
|
static inline int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
|
|
const char *domain)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_NETLABEL */
|
|
|
|
/*
|
|
* Label Mapping Cache Functions
|
|
*/
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void cipso_v4_cache_invalidate(void);
|
|
int cipso_v4_cache_add(const struct sk_buff *skb,
|
|
const struct netlbl_lsm_secattr *secattr);
|
|
#else
|
|
static inline void cipso_v4_cache_invalidate(void)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int cipso_v4_cache_add(const struct sk_buff *skb,
|
|
const struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_NETLABEL */
|
|
|
|
/*
|
|
* Protocol Handling Functions
|
|
*/
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
|
|
int cipso_v4_sock_setattr(struct sock *sk,
|
|
const struct cipso_v4_doi *doi_def,
|
|
const struct netlbl_lsm_secattr *secattr);
|
|
int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
|
|
int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int cipso_v4_validate(unsigned char **option);
|
|
#else
|
|
static inline void cipso_v4_error(struct sk_buff *skb,
|
|
int error,
|
|
u32 gateway)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int cipso_v4_sock_setattr(struct sock *sk,
|
|
const struct cipso_v4_doi *doi_def,
|
|
const struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
|
|
static inline int cipso_v4_sock_getattr(struct sock *sk,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
|
|
static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
|
|
static inline int cipso_v4_validate(unsigned char **option)
|
|
{
|
|
return -ENOSYS;
|
|
}
|
|
#endif /* CONFIG_NETLABEL */
|
|
|
|
#endif /* _CIPSO_IPV4_H */
|