Commit | Line | Data |
---|---|---|
1ccea77e | 1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
11a03f78 PM |
2 | /* |
3 | * CIPSO - Commercial IP Security Option | |
4 | * | |
5 | * This is an implementation of the CIPSO 2.2 protocol as specified in | |
6 | * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in | |
7 | * FIPS-188, copies of both documents can be found in the Documentation | |
8 | * directory. While CIPSO never became a full IETF RFC standard many vendors | |
9 | * have chosen to adopt the protocol and over the years it has become a | |
10 | * de-facto standard for labeled networking. | |
11 | * | |
82c21bfa | 12 | * Author: Paul Moore <paul@paul-moore.com> |
11a03f78 PM |
13 | */ |
14 | ||
15 | /* | |
16 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
11a03f78 PM |
17 | */ |
18 | ||
19 | #ifndef _CIPSO_IPV4_H | |
20 | #define _CIPSO_IPV4_H | |
21 | ||
22 | #include <linux/types.h> | |
23 | #include <linux/rcupdate.h> | |
24 | #include <linux/list.h> | |
7a0e1d60 PM |
25 | #include <linux/net.h> |
26 | #include <linux/skbuff.h> | |
11a03f78 | 27 | #include <net/netlabel.h> |
389fb800 | 28 | #include <net/request_sock.h> |
60063497 | 29 | #include <linux/atomic.h> |
f6a6fede | 30 | #include <linux/refcount.h> |
20e2a864 | 31 | #include <asm/unaligned.h> |
11a03f78 PM |
32 | |
33 | /* known doi values */ | |
34 | #define CIPSO_V4_DOI_UNKNOWN 0x00000000 | |
35 | ||
15c45f7b | 36 | /* standard tag types */ |
11a03f78 PM |
37 | #define CIPSO_V4_TAG_INVALID 0 |
38 | #define CIPSO_V4_TAG_RBITMAP 1 | |
39 | #define CIPSO_V4_TAG_ENUM 2 | |
40 | #define CIPSO_V4_TAG_RANGE 5 | |
41 | #define CIPSO_V4_TAG_PBITMAP 6 | |
42 | #define CIPSO_V4_TAG_FREEFORM 7 | |
43 | ||
15c45f7b PM |
44 | /* non-standard tag types (tags > 127) */ |
45 | #define CIPSO_V4_TAG_LOCAL 128 | |
46 | ||
11a03f78 PM |
47 | /* doi mapping types */ |
48 | #define CIPSO_V4_MAP_UNKNOWN 0 | |
15c45f7b | 49 | #define CIPSO_V4_MAP_TRANS 1 |
11a03f78 | 50 | #define CIPSO_V4_MAP_PASS 2 |
15c45f7b | 51 | #define CIPSO_V4_MAP_LOCAL 3 |
11a03f78 PM |
52 | |
53 | /* limits */ | |
c6b1677a | 54 | #define CIPSO_V4_MAX_REM_LVLS 255 |
11a03f78 PM |
55 | #define CIPSO_V4_INV_LVL 0x80000000 |
56 | #define CIPSO_V4_MAX_LOC_LVLS (CIPSO_V4_INV_LVL - 1) | |
c6b1677a | 57 | #define CIPSO_V4_MAX_REM_CATS 65534 |
11a03f78 PM |
58 | #define CIPSO_V4_INV_CAT 0x80000000 |
59 | #define CIPSO_V4_MAX_LOC_CATS (CIPSO_V4_INV_CAT - 1) | |
60 | ||
61 | /* | |
62 | * CIPSO DOI definitions | |
63 | */ | |
64 | ||
65 | /* DOI definition struct */ | |
66 | #define CIPSO_V4_TAG_MAXCNT 5 | |
67 | struct cipso_v4_doi { | |
68 | u32 doi; | |
69 | u32 type; | |
70 | union { | |
71 | struct cipso_v4_std_map_tbl *std; | |
72 | } map; | |
73 | u8 tags[CIPSO_V4_TAG_MAXCNT]; | |
74 | ||
f6a6fede | 75 | refcount_t refcount; |
11a03f78 PM |
76 | struct list_head list; |
77 | struct rcu_head rcu; | |
11a03f78 PM |
78 | }; |
79 | ||
80 | /* Standard CIPSO mapping table */ | |
81 | /* NOTE: the highest order bit (i.e. 0x80000000) is an 'invalid' flag, if the | |
82 | * bit is set then consider that value as unspecified, meaning the | |
83 | * mapping for that particular level/category is invalid */ | |
84 | struct cipso_v4_std_map_tbl { | |
85 | struct { | |
86 | u32 *cipso; | |
87 | u32 *local; | |
88 | u32 cipso_size; | |
89 | u32 local_size; | |
90 | } lvl; | |
91 | struct { | |
92 | u32 *cipso; | |
93 | u32 *local; | |
94 | u32 cipso_size; | |
95 | u32 local_size; | |
96 | } cat; | |
97 | }; | |
98 | ||
99 | /* | |
100 | * Sysctl Variables | |
101 | */ | |
102 | ||
103 | #ifdef CONFIG_NETLABEL | |
104 | extern int cipso_v4_cache_enabled; | |
105 | extern int cipso_v4_cache_bucketsize; | |
106 | extern int cipso_v4_rbm_optfmt; | |
107 | extern int cipso_v4_rbm_strictvalid; | |
108 | #endif | |
109 | ||
11a03f78 PM |
110 | /* |
111 | * DOI List Functions | |
112 | */ | |
113 | ||
114 | #ifdef CONFIG_NETLABEL | |
6c2e8ac0 PM |
115 | int cipso_v4_doi_add(struct cipso_v4_doi *doi_def, |
116 | struct netlbl_audit *audit_info); | |
b1edeb10 PM |
117 | void cipso_v4_doi_free(struct cipso_v4_doi *doi_def); |
118 | int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info); | |
11a03f78 | 119 | struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi); |
b1edeb10 | 120 | void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def); |
fcd48280 PM |
121 | int cipso_v4_doi_walk(u32 *skip_cnt, |
122 | int (*callback) (struct cipso_v4_doi *doi_def, void *arg), | |
123 | void *cb_arg); | |
11a03f78 | 124 | #else |
6c2e8ac0 PM |
125 | static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def, |
126 | struct netlbl_audit *audit_info) | |
11a03f78 PM |
127 | { |
128 | return -ENOSYS; | |
129 | } | |
130 | ||
b1edeb10 PM |
131 | static inline void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) |
132 | { | |
133 | return; | |
134 | } | |
135 | ||
11a03f78 | 136 | static inline int cipso_v4_doi_remove(u32 doi, |
b1edeb10 | 137 | struct netlbl_audit *audit_info) |
11a03f78 PM |
138 | { |
139 | return 0; | |
140 | } | |
141 | ||
142 | static inline struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi) | |
143 | { | |
144 | return NULL; | |
145 | } | |
146 | ||
fcd48280 PM |
147 | static inline int cipso_v4_doi_walk(u32 *skip_cnt, |
148 | int (*callback) (struct cipso_v4_doi *doi_def, void *arg), | |
149 | void *cb_arg) | |
11a03f78 | 150 | { |
fcd48280 | 151 | return 0; |
11a03f78 | 152 | } |
11a03f78 PM |
153 | #endif /* CONFIG_NETLABEL */ |
154 | ||
155 | /* | |
156 | * Label Mapping Cache Functions | |
157 | */ | |
158 | ||
159 | #ifdef CONFIG_NETLABEL | |
160 | void cipso_v4_cache_invalidate(void); | |
04f81f01 | 161 | int cipso_v4_cache_add(const unsigned char *cipso_ptr, |
11a03f78 PM |
162 | const struct netlbl_lsm_secattr *secattr); |
163 | #else | |
164 | static inline void cipso_v4_cache_invalidate(void) | |
165 | { | |
166 | return; | |
167 | } | |
168 | ||
04f81f01 | 169 | static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr, |
11a03f78 PM |
170 | const struct netlbl_lsm_secattr *secattr) |
171 | { | |
172 | return 0; | |
173 | } | |
174 | #endif /* CONFIG_NETLABEL */ | |
175 | ||
176 | /* | |
177 | * Protocol Handling Functions | |
178 | */ | |
179 | ||
180 | #ifdef CONFIG_NETLABEL | |
181 | void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway); | |
04f81f01 PM |
182 | int cipso_v4_getattr(const unsigned char *cipso, |
183 | struct netlbl_lsm_secattr *secattr); | |
ba6ff9f2 PM |
184 | int cipso_v4_sock_setattr(struct sock *sk, |
185 | const struct cipso_v4_doi *doi_def, | |
186 | const struct netlbl_lsm_secattr *secattr); | |
014ab19a | 187 | void cipso_v4_sock_delattr(struct sock *sk); |
14a72f53 | 188 | int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); |
389fb800 PM |
189 | int cipso_v4_req_setattr(struct request_sock *req, |
190 | const struct cipso_v4_doi *doi_def, | |
191 | const struct netlbl_lsm_secattr *secattr); | |
192 | void cipso_v4_req_delattr(struct request_sock *req); | |
948bf85c PM |
193 | int cipso_v4_skbuff_setattr(struct sk_buff *skb, |
194 | const struct cipso_v4_doi *doi_def, | |
195 | const struct netlbl_lsm_secattr *secattr); | |
196 | int cipso_v4_skbuff_delattr(struct sk_buff *skb); | |
11a03f78 PM |
197 | int cipso_v4_skbuff_getattr(const struct sk_buff *skb, |
198 | struct netlbl_lsm_secattr *secattr); | |
04f81f01 | 199 | unsigned char *cipso_v4_optptr(const struct sk_buff *skb); |
15c45f7b | 200 | int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option); |
11a03f78 PM |
201 | #else |
202 | static inline void cipso_v4_error(struct sk_buff *skb, | |
203 | int error, | |
204 | u32 gateway) | |
205 | { | |
206 | return; | |
207 | } | |
208 | ||
04f81f01 PM |
209 | static inline int cipso_v4_getattr(const unsigned char *cipso, |
210 | struct netlbl_lsm_secattr *secattr) | |
211 | { | |
212 | return -ENOSYS; | |
213 | } | |
214 | ||
ba6ff9f2 PM |
215 | static inline int cipso_v4_sock_setattr(struct sock *sk, |
216 | const struct cipso_v4_doi *doi_def, | |
217 | const struct netlbl_lsm_secattr *secattr) | |
11a03f78 PM |
218 | { |
219 | return -ENOSYS; | |
220 | } | |
221 | ||
014ab19a PM |
222 | static inline void cipso_v4_sock_delattr(struct sock *sk) |
223 | { | |
224 | } | |
225 | ||
14a72f53 PM |
226 | static inline int cipso_v4_sock_getattr(struct sock *sk, |
227 | struct netlbl_lsm_secattr *secattr) | |
228 | { | |
229 | return -ENOSYS; | |
230 | } | |
231 | ||
389fb800 PM |
232 | static inline int cipso_v4_req_setattr(struct request_sock *req, |
233 | const struct cipso_v4_doi *doi_def, | |
234 | const struct netlbl_lsm_secattr *secattr) | |
235 | { | |
236 | return -ENOSYS; | |
237 | } | |
238 | ||
239 | static inline void cipso_v4_req_delattr(struct request_sock *req) | |
240 | { | |
241 | return; | |
242 | } | |
243 | ||
948bf85c PM |
244 | static inline int cipso_v4_skbuff_setattr(struct sk_buff *skb, |
245 | const struct cipso_v4_doi *doi_def, | |
246 | const struct netlbl_lsm_secattr *secattr) | |
247 | { | |
248 | return -ENOSYS; | |
249 | } | |
250 | ||
251 | static inline int cipso_v4_skbuff_delattr(struct sk_buff *skb) | |
252 | { | |
253 | return -ENOSYS; | |
254 | } | |
255 | ||
11a03f78 PM |
256 | static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb, |
257 | struct netlbl_lsm_secattr *secattr) | |
258 | { | |
259 | return -ENOSYS; | |
260 | } | |
261 | ||
04f81f01 PM |
262 | static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb) |
263 | { | |
264 | return NULL; | |
265 | } | |
266 | ||
15c45f7b PM |
267 | static inline int cipso_v4_validate(const struct sk_buff *skb, |
268 | unsigned char **option) | |
11a03f78 | 269 | { |
20e2a864 PM |
270 | unsigned char *opt = *option; |
271 | unsigned char err_offset = 0; | |
272 | u8 opt_len = opt[1]; | |
273 | u8 opt_iter; | |
f2e5ddcc | 274 | u8 tag_len; |
20e2a864 PM |
275 | |
276 | if (opt_len < 8) { | |
277 | err_offset = 1; | |
278 | goto out; | |
279 | } | |
280 | ||
281 | if (get_unaligned_be32(&opt[2]) == 0) { | |
282 | err_offset = 2; | |
283 | goto out; | |
284 | } | |
285 | ||
286 | for (opt_iter = 6; opt_iter < opt_len;) { | |
d71b7896 ED |
287 | if (opt_iter + 1 == opt_len) { |
288 | err_offset = opt_iter; | |
289 | goto out; | |
290 | } | |
f2e5ddcc | 291 | tag_len = opt[opt_iter + 1]; |
10ae76fa | 292 | if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { |
20e2a864 PM |
293 | err_offset = opt_iter + 1; |
294 | goto out; | |
295 | } | |
f2e5ddcc | 296 | opt_iter += tag_len; |
20e2a864 PM |
297 | } |
298 | ||
299 | out: | |
300 | *option = opt + err_offset; | |
301 | return err_offset; | |
302 | ||
11a03f78 PM |
303 | } |
304 | #endif /* CONFIG_NETLABEL */ | |
305 | ||
306 | #endif /* _CIPSO_IPV4_H */ |