calipso: Add a label cache.

[mirror_ubuntu-bionic-kernel.git] / include / net / netlabel.h

diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index 7b5a300de7f589a534ac315f24a1151674aa54a4..a306bc7d26424425400e596ab31a2d418dda2cde 100644 (file)
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -40,6 +40,7 @@
 #include <linux/atomic.h>
 
 struct cipso_v4_doi;
+struct calipso_doi;
 
 /*
  * NetLabel - A management interface for maintaining network packet label
@@ -94,6 +95,8 @@ struct cipso_v4_doi;
 #define NETLBL_NLTYPE_UNLABELED_NAME    "NLBL_UNLBL"
 #define NETLBL_NLTYPE_ADDRSELECT        6
 #define NETLBL_NLTYPE_ADDRSELECT_NAME   "NLBL_ADRSEL"
+#define NETLBL_NLTYPE_CALIPSO           7
+#define NETLBL_NLTYPE_CALIPSO_NAME      "NLBL_CALIPSO"
 
 /*
  * NetLabel - Kernel API for accessing the network packet label mappings.
@@ -216,6 +219,63 @@ struct netlbl_lsm_secattr {
        } attr;
 };
 
+/**
+ * struct netlbl_calipso_ops - NetLabel CALIPSO operations
+ * @doi_add: add a CALIPSO DOI
+ * @doi_free: free a CALIPSO DOI
+ * @doi_getdef: returns a reference to a DOI
+ * @doi_putdef: releases a reference of a DOI
+ * @doi_walk: enumerate the DOI list
+ * @sock_getattr: retrieve the socket's attr
+ * @sock_setattr: set the socket's attr
+ * @sock_delattr: remove the socket's attr
+ * @req_setattr: set the req socket's attr
+ * @req_delattr: remove the req socket's attr
+ * @opt_getattr: retrieve attr from memory block
+ * @skbuff_optptr: find option in packet
+ * @skbuff_setattr: set the skbuff's attr
+ * @skbuff_delattr: remove the skbuff's attr
+ * @cache_invalidate: invalidate cache
+ * @cache_add: add cache entry
+ *
+ * Description:
+ * This structure is filled out by the CALIPSO engine and passed
+ * to the NetLabel core via a call to netlbl_calipso_ops_register().
+ * It enables the CALIPSO engine (and hence IPv6) to be compiled
+ * as a module.
+ */
+struct netlbl_calipso_ops {
+       int (*doi_add)(struct calipso_doi *doi_def,
+                      struct netlbl_audit *audit_info);
+       void (*doi_free)(struct calipso_doi *doi_def);
+       int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info);
+       struct calipso_doi *(*doi_getdef)(u32 doi);
+       void (*doi_putdef)(struct calipso_doi *doi_def);
+       int (*doi_walk)(u32 *skip_cnt,
+                       int (*callback)(struct calipso_doi *doi_def, void *arg),
+                       void *cb_arg);
+       int (*sock_getattr)(struct sock *sk,
+                           struct netlbl_lsm_secattr *secattr);
+       int (*sock_setattr)(struct sock *sk,
+                           const struct calipso_doi *doi_def,
+                           const struct netlbl_lsm_secattr *secattr);
+       void (*sock_delattr)(struct sock *sk);
+       int (*req_setattr)(struct request_sock *req,
+                          const struct calipso_doi *doi_def,
+                          const struct netlbl_lsm_secattr *secattr);
+       void (*req_delattr)(struct request_sock *req);
+       int (*opt_getattr)(const unsigned char *calipso,
+                          struct netlbl_lsm_secattr *secattr);
+       unsigned char *(*skbuff_optptr)(const struct sk_buff *skb);
+       int (*skbuff_setattr)(struct sk_buff *skb,
+                             const struct calipso_doi *doi_def,
+                             const struct netlbl_lsm_secattr *secattr);
+       int (*skbuff_delattr)(struct sk_buff *skb);
+       void (*cache_invalidate)(void);
+       int (*cache_add)(const unsigned char *calipso_ptr,
+                        const struct netlbl_lsm_secattr *secattr);
+};
+
 /*
  * LSM security attribute operations (inline)
  */
@@ -405,6 +465,12 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
                          unsigned long bitmap,
                          gfp_t flags);
 
+/* Bitmap functions
+ */
+int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
+                      u32 offset, u8 state);
+void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state);
+
 /*
  * LSM protocol operations (NetLabel LSM/kernel API)
  */
@@ -427,13 +493,13 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
 int netlbl_skbuff_getattr(const struct sk_buff *skb,
                          u16 family,
                          struct netlbl_lsm_secattr *secattr);
-void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway);
+void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway);
 
 /*
  * LSM label mapping cache operations
  */
 void netlbl_cache_invalidate(void);
-int netlbl_cache_add(const struct sk_buff *skb,
+int netlbl_cache_add(const struct sk_buff *skb, u16 family,
                     const struct netlbl_lsm_secattr *secattr);
 
 /*
@@ -586,7 +652,7 @@ static inline void netlbl_cache_invalidate(void)
 {
        return;
 }
-static inline int netlbl_cache_add(const struct sk_buff *skb,
+static inline int netlbl_cache_add(const struct sk_buff *skb, u16 family,
                                   const struct netlbl_lsm_secattr *secattr)
 {
        return 0;
@@ -598,4 +664,7 @@ static inline struct audit_buffer *netlbl_audit_start(int type,
 }
 #endif /* CONFIG_NETLABEL */
 
+const struct netlbl_calipso_ops *
+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops);
+
 #endif /* _NETLABEL_H */