History

netlabel: Initial support for the CALIPSO netlink protocol.

CALIPSO is a packet labelling protocol for IPv6 which is very similar to CIPSO. It is specified in RFC 5570. Much of the code is based on the current CIPSO code. This adds support for adding passthrough-type CALIPSO DOIs through the NLBL_CALIPSO_C_ADD command. It requires attributes: NLBL_CALIPSO_A_TYPE which must be CALIPSO_MAP_PASS. NLBL_CALIPSO_A_DOI. In passthrough mode the CALIPSO engine will map MLS secattr levels and categories directly to the packet label. At this stage, the major difference between this and the CIPSO code is that IPv6 may be compiled as a module. To allow for this the CALIPSO functions are registered at module init time.

Huw Davies committed 10 years ago

Commit cb72d381 parent 8f18e6712 files · +604 −2Browse files

Unified · Split

12 files
  1. include/net/calipso.h +79 −0
  2. include/net/netlabel.h +23 −0
  3. include/uapi/linux/audit.h +2 −0
  4. net/ipv6/Makefile +1 −0
  5. net/ipv6/af_inet6.c +8 −1
  6. net/ipv6/calipso.c +169 −0
  7. net/netlabel/Makefile +1 −1
  8. net/netlabel/netlabel_calipso.c +216 −0
  9. net/netlabel/netlabel_calipso.h +90 −0
  10. net/netlabel/netlabel_kapi.c +1 −0
  11. net/netlabel/netlabel_mgmt.c +9 −0
  12. net/netlabel/netlabel_user.c +5 −0
include/net/calipso.h+79−0
@@ -0,0 +1,79 @@
1+/*
2+ * CALIPSO - Common Architecture Label IPv6 Security Option
3+ *
4+ * This is an implementation of the CALIPSO protocol as specified in
5+ * RFC 5570.
6+ *
7+ * Authors: Paul Moore <paul@paul-moore.com>
8+ * Huw Davies <huw@codeweavers.com>
9+ *
10+ */
11+
12+/*
13+ * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14+ * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15+ *
16+ * This program is free software; you can redistribute it and/or modify
17+ * it under the terms of the GNU General Public License as published by
18+ * the Free Software Foundation; either version 2 of the License, or
19+ * (at your option) any later version.
20+ *
21+ * This program is distributed in the hope that it will be useful,
22+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
23+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24+ * the GNU General Public License for more details.
25+ *
26+ * You should have received a copy of the GNU General Public License
27+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
28+ *
29+ */
30+
31+#ifndef _CALIPSO_H
32+#define _CALIPSO_H
33+
34+#include <linux/types.h>
35+#include <linux/rcupdate.h>
36+#include <linux/list.h>
37+#include <linux/net.h>
38+#include <linux/skbuff.h>
39+#include <net/netlabel.h>
40+#include <net/request_sock.h>
41+#include <linux/atomic.h>
42+#include <asm/unaligned.h>
43+
44+/* known doi values */
45+#define CALIPSO_DOI_UNKNOWN 0x00000000
46+
47+/* doi mapping types */
48+#define CALIPSO_MAP_UNKNOWN 0
49+#define CALIPSO_MAP_PASS 2
50+
51+/*
52+ * CALIPSO DOI definitions
53+ */
54+
55+/* DOI definition struct */
56+struct calipso_doi {
57+ u32 doi;
58+ u32 type;
59+
60+ atomic_t refcount;
61+ struct list_head list;
62+ struct rcu_head rcu;
63+};
64+
65+#ifdef CONFIG_NETLABEL
66+int __init calipso_init(void);
67+void calipso_exit(void);
68+#else
69+static inline int __init calipso_init(void)
70+{
71+ return 0;
72+}
73+
74+static inline void calipso_exit(void)
75+{
76+}
77+#endif /* CONFIG_NETLABEL */
78+
79+#endif /* _CALIPSO_H */
include/net/netlabel.h+23−0
@@ -40,6 +40,7 @@ · 39 unmodified lines
4040 #include <linux/atomic.h>
4141
4242 struct cipso_v4_doi;
43+struct calipso_doi;
4344
4445 /*
4546 * NetLabel - A management interface for maintaining network packet label
@@ -94,6 +95,8 @@ struct cipso_v4_doi; · 48 unmodified lines
9495 #define NETLBL_NLTYPE_UNLABELED_NAME "NLBL_UNLBL"
9596 #define NETLBL_NLTYPE_ADDRSELECT 6
9697 #define NETLBL_NLTYPE_ADDRSELECT_NAME "NLBL_ADRSEL"
98+#define NETLBL_NLTYPE_CALIPSO 7
99+#define NETLBL_NLTYPE_CALIPSO_NAME "NLBL_CALIPSO"
97100
98101 /*
99102 * NetLabel - Kernel API for accessing the network packet label mappings.
@@ -216,6 +219,23 @@ struct netlbl_lsm_secattr { · 116 unmodified lines
216219 } attr;
217220 };
218221
222+/**
223+ * struct netlbl_calipso_ops - NetLabel CALIPSO operations
224+ * @doi_add: add a CALIPSO DOI
225+ * @doi_free: free a CALIPSO DOI
226+ *
227+ * Description:
228+ * This structure is filled out by the CALIPSO engine and passed
229+ * to the NetLabel core via a call to netlbl_calipso_ops_register().
230+ * It enables the CALIPSO engine (and hence IPv6) to be compiled
231+ * as a module.
232+ */
233+struct netlbl_calipso_ops {
234+ int (*doi_add)(struct calipso_doi *doi_def,
235+ struct netlbl_audit *audit_info);
236+ void (*doi_free)(struct calipso_doi *doi_def);
237+};
238+
219239 /*
220240 * LSM security attribute operations (inline)
221241 */
@@ -598,4 +618,7 @@ static inline struct audit_buffer *netlbl_audit_start(int type, · 376 unmodified lines
598618 }
599619 #endif /* CONFIG_NETLABEL */
600620
621+const struct netlbl_calipso_ops *
622+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops);
623+
601624 #endif /* _NETLABEL_H */
include/uapi/linux/audit.h+2−0
@@ -130,6 +130,8 @@ · 129 unmodified lines
130130 #define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit an IPSec event */
131131 #define AUDIT_MAC_UNLBL_STCADD 1416 /* NetLabel: add a static label */
132132 #define AUDIT_MAC_UNLBL_STCDEL 1417 /* NetLabel: del a static label */
133+#define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */
134+#define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */
133135
134136 #define AUDIT_FIRST_KERN_ANOM_MSG 1700
135137 #define AUDIT_LAST_KERN_ANOM_MSG 1799
net/ipv6/Makefile+1−0
@@ -21,6 +21,7 @@ ipv6-$(CONFIG_NETFILTER) += netfilter.o · 20 unmodified lines
2121 ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o
2222 ipv6-$(CONFIG_PROC_FS) += proc.o
2323 ipv6-$(CONFIG_SYN_COOKIES) += syncookies.o
24+ipv6-$(CONFIG_NETLABEL) += calipso.o
2425
2526 ipv6-objs += $(ipv6-y)
2627
net/ipv6/af_inet6.c+8−1
@@ -60,6 +60,7 @@ · 59 unmodified lines
6060 #ifdef CONFIG_IPV6_TUNNEL
6161 #include <net/ip6_tunnel.h>
6262 #endif
63+#include <net/calipso.h>
6364
6465 #include <asm/uaccess.h>
6566 #include <linux/mroute6.h>
@@ -970,6 +971,10 @@ static int __init inet6_init(void) · 904 unmodified lines
970971 if (err)
971972 goto pingv6_fail;
972973
974+ err = calipso_init();
975+ if (err)
976+ goto calipso_fail;
977+
973978 #ifdef CONFIG_SYSCTL
974979 err = ipv6_sysctl_register();
975980 if (err)
@@ -980,8 +985,10 @@ out: · 4 unmodified lines
980985
981986 #ifdef CONFIG_SYSCTL
982987 sysctl_fail:
983− pingv6_exit();
988+ calipso_exit();
984989 #endif
990+calipso_fail:
991+ pingv6_exit();
985992 pingv6_fail:
986993 ipv6_packet_cleanup();
987994 ipv6_packet_fail:
net/ipv6/calipso.c+169−0
@@ -0,0 +1,169 @@
1+/*
2+ * CALIPSO - Common Architecture Label IPv6 Security Option
3+ *
4+ * This is an implementation of the CALIPSO protocol as specified in
5+ * RFC 5570.
6+ *
7+ * Authors: Paul Moore <paul.moore@hp.com>
8+ * Huw Davies <huw@codeweavers.com>
9+ *
10+ */
11+
12+/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
13+ * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
14+ *
15+ * This program is free software; you can redistribute it and/or modify
16+ * it under the terms of the GNU General Public License as published by
17+ * the Free Software Foundation; either version 2 of the License, or
18+ * (at your option) any later version.
19+ *
20+ * This program is distributed in the hope that it will be useful,
21+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
22+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23+ * the GNU General Public License for more details.
24+ *
25+ * You should have received a copy of the GNU General Public License
26+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
27+ *
28+ */
29+
30+#include <linux/init.h>
31+#include <linux/types.h>
32+#include <linux/rcupdate.h>
33+#include <linux/list.h>
34+#include <linux/spinlock.h>
35+#include <linux/string.h>
36+#include <linux/jhash.h>
37+#include <linux/audit.h>
38+#include <linux/slab.h>
39+#include <net/ip.h>
40+#include <net/icmp.h>
41+#include <net/tcp.h>
42+#include <net/netlabel.h>
43+#include <net/calipso.h>
44+#include <linux/atomic.h>
45+#include <linux/bug.h>
46+#include <asm/unaligned.h>
47+
48+/* List of available DOI definitions */
49+static DEFINE_SPINLOCK(calipso_doi_list_lock);
50+static LIST_HEAD(calipso_doi_list);
51+
52+/* DOI List Functions
53+ */
54+
55+/**
56+ * calipso_doi_search - Searches for a DOI definition
57+ * @doi: the DOI to search for
58+ *
59+ * Description:
60+ * Search the DOI definition list for a DOI definition with a DOI value that
61+ * matches @doi. The caller is responsible for calling rcu_read_[un]lock().
62+ * Returns a pointer to the DOI definition on success and NULL on failure.
63+ */
64+static struct calipso_doi *calipso_doi_search(u32 doi)
65+{
66+ struct calipso_doi *iter;
67+
68+ list_for_each_entry_rcu(iter, &calipso_doi_list, list)
69+ if (iter->doi == doi && atomic_read(&iter->refcount))
70+ return iter;
71+ return NULL;
72+}
73+
74+/**
75+ * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
76+ * @doi_def: the DOI structure
77+ * @audit_info: NetLabel audit information
78+ *
79+ * Description:
80+ * The caller defines a new DOI for use by the CALIPSO engine and calls this
81+ * function to add it to the list of acceptable domains. The caller must
82+ * ensure that the mapping table specified in @doi_def->map meets all of the
83+ * requirements of the mapping type (see calipso.h for details). Returns
84+ * zero on success and non-zero on failure.
85+ *
86+ */
87+static int calipso_doi_add(struct calipso_doi *doi_def,
88+ struct netlbl_audit *audit_info)
89+{
90+ int ret_val = -EINVAL;
91+ u32 doi;
92+ u32 doi_type;
93+ struct audit_buffer *audit_buf;
94+
95+ doi = doi_def->doi;
96+ doi_type = doi_def->type;
97+
98+ if (doi_def->doi == CALIPSO_DOI_UNKNOWN)
99+ goto doi_add_return;
100+
101+ atomic_set(&doi_def->refcount, 1);
102+
103+ spin_lock(&calipso_doi_list_lock);
104+ if (calipso_doi_search(doi_def->doi)) {
105+ spin_unlock(&calipso_doi_list_lock);
106+ ret_val = -EEXIST;
107+ goto doi_add_return;
108+ }
109+ list_add_tail_rcu(&doi_def->list, &calipso_doi_list);
110+ spin_unlock(&calipso_doi_list_lock);
111+ ret_val = 0;
112+
113+doi_add_return:
114+ audit_buf = netlbl_audit_start(AUDIT_MAC_CALIPSO_ADD, audit_info);
115+ if (audit_buf) {
116+ const char *type_str;
117+
118+ switch (doi_type) {
119+ case CALIPSO_MAP_PASS:
120+ type_str = "pass";
121+ break;
122+ default:
123+ type_str = "(unknown)";
124+ }
125+ audit_log_format(audit_buf,
126+ " calipso_doi=%u calipso_type=%s res=%u",
127+ doi, type_str, ret_val == 0 ? 1 : 0);
128+ audit_log_end(audit_buf);
129+ }
130+
131+ return ret_val;
132+}
133+
134+/**
135+ * calipso_doi_free - Frees a DOI definition
136+ * @doi_def: the DOI definition
137+ *
138+ * Description:
139+ * This function frees all of the memory associated with a DOI definition.
140+ *
141+ */
142+static void calipso_doi_free(struct calipso_doi *doi_def)
143+{
144+ kfree(doi_def);
145+}
146+
147+static const struct netlbl_calipso_ops ops = {
148+ .doi_add = calipso_doi_add,
149+ .doi_free = calipso_doi_free,
150+};
151+
152+/**
153+ * calipso_init - Initialize the CALIPSO module
154+ *
155+ * Description:
156+ * Initialize the CALIPSO module and prepare it for use. Returns zero on
157+ * success and negative values on failure.
158+ *
159+ */
160+int __init calipso_init(void)
161+{
162+ netlbl_calipso_ops_register(&ops);
163+ return 0;
164+}
165+
166+void calipso_exit(void)
167+{
168+ netlbl_calipso_ops_register(NULL);
169+}
net/netlabel/Makefile+1−1
@@ -12,4 +12,4 @@ obj-y += netlabel_mgmt.o · 11 unmodified lines
1212 # protocol modules
1313 obj-y += netlabel_unlabeled.o
1414 obj-y += netlabel_cipso_v4.o
15−
15+obj-$(subst m,y,$(CONFIG_IPV6)) += netlabel_calipso.o
net/netlabel/netlabel_calipso.c+216−0
@@ -0,0 +1,216 @@
1+/*
2+ * NetLabel CALIPSO/IPv6 Support
3+ *
4+ * This file defines the CALIPSO/IPv6 functions for the NetLabel system. The
5+ * NetLabel system manages static and dynamic label mappings for network
6+ * protocols such as CIPSO and CALIPSO.
7+ *
8+ * Authors: Paul Moore <paul@paul-moore.com>
9+ * Huw Davies <huw@codeweavers.com>
10+ *
11+ */
12+
13+/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14+ * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15+ *
16+ * This program is free software; you can redistribute it and/or modify
17+ * it under the terms of the GNU General Public License as published by
18+ * the Free Software Foundation; either version 2 of the License, or
19+ * (at your option) any later version.
20+ *
21+ * This program is distributed in the hope that it will be useful,
22+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
23+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24+ * the GNU General Public License for more details.
25+ *
26+ * You should have received a copy of the GNU General Public License
27+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
28+ *
29+ */
30+
31+#include <linux/types.h>
32+#include <linux/socket.h>
33+#include <linux/string.h>
34+#include <linux/skbuff.h>
35+#include <linux/audit.h>
36+#include <linux/slab.h>
37+#include <net/sock.h>
38+#include <net/netlink.h>
39+#include <net/genetlink.h>
40+#include <net/netlabel.h>
41+#include <net/calipso.h>
42+#include <linux/atomic.h>
43+
44+#include "netlabel_user.h"
45+#include "netlabel_calipso.h"
46+#include "netlabel_mgmt.h"
47+#include "netlabel_domainhash.h"
48+
49+/* NetLabel Generic NETLINK CALIPSO family */
50+static struct genl_family netlbl_calipso_gnl_family = {
51+ .id = GENL_ID_GENERATE,
52+ .hdrsize = 0,
53+ .name = NETLBL_NLTYPE_CALIPSO_NAME,
54+ .version = NETLBL_PROTO_VERSION,
55+ .maxattr = NLBL_CALIPSO_A_MAX,
56+};
57+
58+/* NetLabel Netlink attribute policy */
59+static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
60+ [NLBL_CALIPSO_A_DOI] = { .type = NLA_U32 },
61+ [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
62+};
63+
64+/* NetLabel Command Handlers
65+ */
66+/**
67+ * netlbl_calipso_add_pass - Adds a CALIPSO pass DOI definition
68+ * @info: the Generic NETLINK info block
69+ * @audit_info: NetLabel audit information
70+ *
71+ * Description:
72+ * Create a new CALIPSO_MAP_PASS DOI definition based on the given ADD message
73+ * and add it to the CALIPSO engine. Return zero on success and non-zero on
74+ * error.
75+ *
76+ */
77+static int netlbl_calipso_add_pass(struct genl_info *info,
78+ struct netlbl_audit *audit_info)
79+{
80+ int ret_val;
81+ struct calipso_doi *doi_def = NULL;
82+
83+ doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
84+ if (!doi_def)
85+ return -ENOMEM;
86+ doi_def->type = CALIPSO_MAP_PASS;
87+ doi_def->doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
88+ ret_val = calipso_doi_add(doi_def, audit_info);
89+ if (ret_val != 0)
90+ calipso_doi_free(doi_def);
91+
92+ return ret_val;
93+}
94+
95+/**
96+ * netlbl_calipso_add - Handle an ADD message
97+ * @skb: the NETLINK buffer
98+ * @info: the Generic NETLINK info block
99+ *
100+ * Description:
101+ * Create a new DOI definition based on the given ADD message and add it to the
102+ * CALIPSO engine. Returns zero on success, negative values on failure.
103+ *
104+ */
105+static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
106+
107+{
108+ int ret_val = -EINVAL;
109+ struct netlbl_audit audit_info;
110+
111+ if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
112+ !info->attrs[NLBL_CALIPSO_A_MTYPE])
113+ return -EINVAL;
114+
115+ netlbl_netlink_auditinfo(skb, &audit_info);
116+ switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
117+ case CALIPSO_MAP_PASS:
118+ ret_val = netlbl_calipso_add_pass(info, &audit_info);
119+ break;
120+ }
121+ if (ret_val == 0)
122+ atomic_inc(&netlabel_mgmt_protocount);
123+
124+ return ret_val;
125+}
126+
127+/* NetLabel Generic NETLINK Command Definitions
128+ */
129+
130+static const struct genl_ops netlbl_calipso_ops[] = {
131+ {
132+ .cmd = NLBL_CALIPSO_C_ADD,
133+ .flags = GENL_ADMIN_PERM,
134+ .policy = calipso_genl_policy,
135+ .doit = netlbl_calipso_add,
136+ .dumpit = NULL,
137+ },
138+};
139+
140+/* NetLabel Generic NETLINK Protocol Functions
141+ */
142+
143+/**
144+ * netlbl_calipso_genl_init - Register the CALIPSO NetLabel component
145+ *
146+ * Description:
147+ * Register the CALIPSO packet NetLabel component with the Generic NETLINK
148+ * mechanism. Returns zero on success, negative values on failure.
149+ *
150+ */
151+int __init netlbl_calipso_genl_init(void)
152+{
153+ return genl_register_family_with_ops(&netlbl_calipso_gnl_family,
154+ netlbl_calipso_ops);
155+}
156+
157+static const struct netlbl_calipso_ops *calipso_ops;
158+
159+/**
160+ * netlbl_calipso_ops_register - Register the CALIPSO operations
161+ *
162+ * Description:
163+ * Register the CALIPSO packet engine operations.
164+ *
165+ */
166+const struct netlbl_calipso_ops *
167+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
168+{
169+ return xchg(&calipso_ops, ops);
170+}
171+EXPORT_SYMBOL(netlbl_calipso_ops_register);
172+
173+static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
174+{
175+ return ACCESS_ONCE(calipso_ops);
176+}
177+
178+/**
179+ * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
180+ * @doi_def: the DOI structure
181+ * @audit_info: NetLabel audit information
182+ *
183+ * Description:
184+ * The caller defines a new DOI for use by the CALIPSO engine and calls this
185+ * function to add it to the list of acceptable domains. The caller must
186+ * ensure that the mapping table specified in @doi_def->map meets all of the
187+ * requirements of the mapping type (see calipso.h for details). Returns
188+ * zero on success and non-zero on failure.
189+ *
190+ */
191+int calipso_doi_add(struct calipso_doi *doi_def,
192+ struct netlbl_audit *audit_info)
193+{
194+ int ret_val = -ENOMSG;
195+ const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
196+
197+ if (ops)
198+ ret_val = ops->doi_add(doi_def, audit_info);
199+ return ret_val;
200+}
201+
202+/**
203+ * calipso_doi_free - Frees a DOI definition
204+ * @doi_def: the DOI definition
205+ *
206+ * Description:
207+ * This function frees all of the memory associated with a DOI definition.
208+ *
209+ */
210+void calipso_doi_free(struct calipso_doi *doi_def)
211+{
212+ const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
213+
214+ if (ops)
215+ ops->doi_free(doi_def);
216+}
net/netlabel/netlabel_calipso.h+90−0
@@ -0,0 +1,90 @@
1+/*
2+ * NetLabel CALIPSO Support
3+ *
4+ * This file defines the CALIPSO functions for the NetLabel system. The
5+ * NetLabel system manages static and dynamic label mappings for network
6+ * protocols such as CIPSO and RIPSO.
7+ *
8+ * Authors: Paul Moore <paul@paul-moore.com>
9+ * Huw Davies <huw@codeweavers.com>
10+ *
11+ */
12+
13+/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14+ * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15+ *
16+ * This program is free software; you can redistribute it and/or modify
17+ * it under the terms of the GNU General Public License as published by
18+ * the Free Software Foundation; either version 2 of the License, or
19+ * (at your option) any later version.
20+ *
21+ * This program is distributed in the hope that it will be useful,
22+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
23+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24+ * the GNU General Public License for more details.
25+ *
26+ * You should have received a copy of the GNU General Public License
27+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
28+ *
29+ */
30+
31+#ifndef _NETLABEL_CALIPSO
32+#define _NETLABEL_CALIPSO
33+
34+#include <net/netlabel.h>
35+#include <net/calipso.h>
36+
37+/* The following NetLabel payloads are supported by the CALIPSO subsystem.
38+ *
39+ * o ADD:
40+ * Sent by an application to add a new DOI mapping table.
41+ *
42+ * Required attributes:
43+ *
44+ * NLBL_CALIPSO_A_DOI
45+ * NLBL_CALIPSO_A_MTYPE
46+ *
47+ * If using CALIPSO_MAP_PASS no additional attributes are required.
48+ *
49+ */
50+
51+/* NetLabel CALIPSO commands */
52+enum {
53+ NLBL_CALIPSO_C_UNSPEC,
54+ NLBL_CALIPSO_C_ADD,
55+ NLBL_CALIPSO_C_REMOVE,
56+ NLBL_CALIPSO_C_LIST,
57+ NLBL_CALIPSO_C_LISTALL,
58+ __NLBL_CALIPSO_C_MAX,
59+};
60+
61+/* NetLabel CALIPSO attributes */
62+enum {
63+ NLBL_CALIPSO_A_UNSPEC,
64+ NLBL_CALIPSO_A_DOI,
65+ /* (NLA_U32)
66+ * the DOI value */
67+ NLBL_CALIPSO_A_MTYPE,
68+ /* (NLA_U32)
69+ * the mapping table type (defined in the calipso.h header as
70+ * CALIPSO_MAP_*) */
71+ __NLBL_CALIPSO_A_MAX,
72+};
73+
74+#define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
75+
76+/* NetLabel protocol functions */
77+#if IS_ENABLED(CONFIG_IPV6)
78+int netlbl_calipso_genl_init(void);
79+#else
80+static inline int netlbl_calipso_genl_init(void)
81+{
82+ return 0;
83+}
84+#endif
85+
86+int calipso_doi_add(struct calipso_doi *doi_def,
87+ struct netlbl_audit *audit_info);
88+void calipso_doi_free(struct calipso_doi *doi_def);
89+
90+#endif
net/netlabel/netlabel_kapi.c+1−0
@@ -1170,6 +1170,7 @@ struct audit_buffer *netlbl_audit_start(int type, · 1169 unmodified lines
11701170 {
11711171 return netlbl_audit_start_common(type, audit_info);
11721172 }
1173+EXPORT_SYMBOL(netlbl_audit_start);
11731174
11741175 /*
11751176 * Setup Functions
net/netlabel/netlabel_mgmt.c+9−0
@@ -674,6 +674,15 @@ static int netlbl_mgmt_protocols(struct sk_buff *skb, · 673 unmodified lines
674674 goto protocols_return;
675675 protos_sent++;
676676 }
677+#if IS_ENABLED(CONFIG_IPV6)
678+ if (protos_sent == 2) {
679+ if (netlbl_mgmt_protocols_cb(skb,
680+ cb,
681+ NETLBL_NLTYPE_CALIPSO) < 0)
682+ goto protocols_return;
683+ protos_sent++;
684+ }
685+#endif
677686
678687 protocols_return:
679688 cb->args[0] = protos_sent;
net/netlabel/netlabel_user.c+5−0
@@ -44,6 +44,7 @@ · 43 unmodified lines
4444 #include "netlabel_mgmt.h"
4545 #include "netlabel_unlabeled.h"
4646 #include "netlabel_cipso_v4.h"
47+#include "netlabel_calipso.h"
4748 #include "netlabel_user.h"
4849
4950 /*
@@ -71,6 +72,10 @@ int __init netlbl_netlink_init(void) · 21 unmodified lines
7172 if (ret_val != 0)
7273 return ret_val;
7374
75+ ret_val = netlbl_calipso_genl_init();
76+ if (ret_val != 0)
77+ return ret_val;
78+
7479 return netlbl_unlabel_genl_init();
7580 }
7681

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t