Home | History | Annotate | Download | only in tsol
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef	_SYS_TSOL_LABEL_H
     27 #define	_SYS_TSOL_LABEL_H
     28 
     29 #include <sys/types.h>
     30 #ifdef _KERNEL
     31 #include <sys/cred.h>
     32 #include <sys/vnode.h>
     33 #include <sys/tsol/label_macro.h>
     34 #endif /* _KERNEL */
     35 
     36 #ifdef	__cplusplus
     37 extern "C" {
     38 #endif
     39 
     40 /*
     41  * types of label comparison
     42  */
     43 #define	EQUALITY_CHECK	0
     44 #define	DOMINANCE_CHECK	1
     45 
     46 /* Manifest human readable label names */
     47 #define	ADMIN_LOW	"ADMIN_LOW"
     48 #define	ADMIN_HIGH	"ADMIN_HIGH"
     49 
     50 /* Binary Label Structure Definitions */
     51 
     52 typedef	struct _mac_label_impl	m_label_t;
     53 
     54 typedef m_label_t	blevel_t,		/* compatibility */
     55 			bslabel_t,		/* Sensitivity Label */
     56 			bclear_t;		/* Clearance */
     57 
     58 typedef struct _tsol_binary_level_lrange {	/* Level Range */
     59 	m_label_t *lower_bound;
     60 	m_label_t *upper_bound;
     61 } m_range_t;
     62 
     63 typedef	m_range_t	blrange_t;
     64 
     65 typedef struct tsol_mlp_s {
     66 	uchar_t mlp_ipp;
     67 	uint16_t mlp_port;
     68 	uint16_t mlp_port_upper;
     69 } tsol_mlp_t;
     70 
     71 /* Procedure Interface Definitions available to user and kernel */
     72 
     73 extern int	bltype(const void *, uint8_t);
     74 extern int	blequal(const m_label_t *, const m_label_t *);
     75 extern int	bldominates(const m_label_t *, const m_label_t *);
     76 extern int	blstrictdom(const m_label_t *, const m_label_t *);
     77 extern int	blinrange(const m_label_t *, const m_range_t *);
     78 extern void	blmaximum(m_label_t *, const m_label_t *);
     79 extern void	blminimum(m_label_t *, const m_label_t *);
     80 extern void	bsllow(m_label_t *);
     81 extern void	bslhigh(m_label_t *);
     82 extern void	bclearlow(m_label_t *);
     83 extern void	bclearhigh(m_label_t *);
     84 extern void	bslundef(m_label_t *);
     85 extern void	bclearundef(m_label_t *);
     86 extern void	setbltype(void *, uint8_t);
     87 extern boolean_t	bisinvalid(const void *);
     88 
     89 #ifdef	_KERNEL
     90 typedef struct tsol_mlp_entry_s {
     91 	struct tsol_mlp_entry_s *mlpe_next, *mlpe_prev;
     92 	zoneid_t mlpe_zoneid;
     93 	tsol_mlp_t mlpe_mlp;
     94 } tsol_mlp_entry_t;
     95 
     96 typedef struct tsol_mlp_list_s {
     97 	krwlock_t mlpl_rwlock;
     98 	tsol_mlp_entry_t *mlpl_first, *mlpl_last;
     99 } tsol_mlp_list_t;
    100 
    101 typedef	struct ts_label_s {
    102 	uint_t		tsl_ref;	/* Reference count */
    103 	uint32_t	tsl_doi;	/* Domain of Interpretation */
    104 	uint32_t	tsl_flags;	/* TSLF_* below */
    105 	m_label_t	tsl_label;	/* Actual label */
    106 } ts_label_t;
    107 
    108 #define	DEFAULT_DOI 1
    109 
    110 /*
    111  * TSLF_UNLABELED is set in tsl_flags for  packets with no explicit label
    112  * when the peer is unlabeled.
    113  *
    114  * TSLF_IMPLICIT_IN is set when a packet is received with no explicit label
    115  * from a peer which is flagged in the tnrhdb as label-aware.
    116  *
    117  * TSLF_IMPLICIT_OUT is set when the packet should be sent without an
    118  * explict label even if the peer or next-hop router is flagged in the
    119  * tnrhdb as label-aware.
    120  */
    121 
    122 #define	TSLF_UNLABELED		0x00000001	/* peer is unlabeled */
    123 #define	TSLF_IMPLICIT_IN	0x00000002	/* inbound implicit */
    124 #define	TSLF_IMPLICIT_OUT	0x00000004	/* outbound implicit */
    125 
    126 #define	CR_SL(cr)	(label2bslabel(crgetlabel(cr)))
    127 
    128 extern ts_label_t	*l_admin_low;
    129 extern ts_label_t	*l_admin_high;
    130 extern uint32_t		default_doi;
    131 extern int		sys_labeling;
    132 
    133 extern void		label_init(void);
    134 extern ts_label_t	*labelalloc(const m_label_t *, uint32_t, int);
    135 extern ts_label_t	*labeldup(const ts_label_t *, int);
    136 extern void		label_hold(ts_label_t *);
    137 extern void		label_rele(ts_label_t *);
    138 extern m_label_t	*label2bslabel(ts_label_t *);
    139 extern uint32_t		label2doi(ts_label_t *);
    140 extern boolean_t	label_equal(const ts_label_t *, const ts_label_t *);
    141 extern cred_t 		*newcred_from_bslabel(m_label_t *, uint32_t, int);
    142 extern cred_t 		*copycred_from_bslabel(const cred_t *, m_label_t *,
    143 			    uint32_t, int);
    144 extern cred_t		*copycred_from_tslabel(const cred_t *, ts_label_t *,
    145 			    int);
    146 extern ts_label_t	*getflabel(vnode_t *);
    147 extern int		getlabel(const char *, m_label_t *);
    148 extern int		fgetlabel(int, m_label_t *);
    149 extern int		_blinrange(const m_label_t *, const brange_t *);
    150 extern int		blinlset(const m_label_t *, const blset_t);
    151 
    152 extern int		l_to_str_internal(const m_label_t *, char **);
    153 extern int		hexstr_to_label(const char *, m_label_t *);
    154 
    155 /*
    156  * The use of '!!' here prevents users from referencing this function-like
    157  * macro as though it were an l-value, and in normal use is optimized away
    158  * by the compiler.
    159  */
    160 #define	is_system_labeled()	(!!(sys_labeling > 0))
    161 
    162 #endif	/* _KERNEL */
    163 
    164 #ifdef	__cplusplus
    165 }
    166 #endif
    167 
    168 #endif	/* !_SYS_TSOL_LABEL_H */
    169