include/sys/tsol/tndb.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  *
  25  * from "tndb.h 7.34    01/08/31 SMI; TSOL 2.x"
  26  */
  27
  28 #ifndef _SYS_TSOL_TNDB_H
  29 #define _SYS_TSOL_TNDB_H
  30
  31 #include <sys/types.h>
  32 #include <sys/zone.h>
  33 #include <sys/tsol/label.h>
  34 #include <sys/tsol/label_macro.h>
  35 #include <net/if.h>
  36
  37 #ifdef _KERNEL
  38 #include <net/route.h>
  39 #endif
  40
  41 #ifdef  __cplusplus
  42 extern "C" {
  43 #endif
  44
  45 /* same on ILP32 and LP64 */
  46 typedef union tnaddr {
  47         struct sockaddr_in      ip_addr_v4;
  48         struct sockaddr_in6     ip_addr_v6;
  49 } tnaddr_t;
  50
  51 #define ta_family       ip_addr_v4.sin_family
  52 #define ta_addr_v4      ip_addr_v4.sin_addr
  53 #define ta_addr_v6      ip_addr_v6.sin6_addr
  54 #define ta_port_v4      ip_addr_v4.sin_port
  55 #define ta_port_v6      ip_addr_v6.sin6_port
  56
  57 #define TNADDR_EQ(addr1, addr2) \
  58         (((addr1)->ta_family == AF_INET && (addr2)->ta_family == AF_INET && \
  59         (addr1)->ta_addr_v4.s_addr == (addr2)->ta_addr_v4.s_addr) || \
  60         ((addr1)->ta_family == AF_INET6 && (addr2)->ta_family == AF_INET6 && \
  61         IN6_ARE_ADDR_EQUAL(&(addr1)->ta_addr_v6, &(addr2)->ta_addr_v6)))
  62
  63 /*
  64  * structure for TN database access routines and TN system calls
  65  */
  66
  67 typedef enum tsol_dbops {
  68         TNDB_NOOP = 0,
  69         TNDB_LOAD = 1,
  70         TNDB_DELETE = 2,
  71         TNDB_FLUSH = 3,
  72         TNDB_GET = 5
  73 } tsol_dbops_t;
  74
  75 #define TNTNAMSIZ       ZONENAME_MAX    /* template name size */
  76 #define IP_STR_SIZE     200             /* string ip address size */
  77
  78 #define TNRHDB_NCOL     2               /* # of columns in tnrhdb */
  79
  80 /*
  81  * For tnrhdb access library routines and tnrh(2TSOL)
  82  * same for both ILP32 and LP64.
  83  */
  84 typedef struct tsol_rhent {
  85         short rh_prefix;                /* length of subnet mask */
  86         short rh_unused;                /* padding */
  87         tnaddr_t rh_address;            /* IP address */
  88         char rh_template[TNTNAMSIZ];    /* template name */
  89 } tsol_rhent_t;
  90
  91 typedef struct tsol_rhstr_s {
  92         int     family;
  93         char    *address;
  94         char    *template;
  95 } tsol_rhstr_t;
  96
  97 /*
  98  * host types recognized by tsol hosts
  99  */
 100 typedef enum {
 101         UNLABELED       = 1,
 102         SUN_CIPSO       = 3
 103 } tsol_host_type_t;
 104
 105 typedef enum {
 106         OPT_NONE        = 0,
 107         OPT_CIPSO       = 1
 108 } tsol_ip_label_t;
 109
 110 typedef struct cipso_tag_type_1 {
 111         uchar_t tag_type;               /* Tag Type (1) */
 112         uchar_t tag_length;             /* Length of Tag */
 113         uchar_t tag_align;              /* Alignment Octet */
 114         uchar_t tag_sl;                 /* Sensitivity Level */
 115         uchar_t tag_cat[1];             /* Categories */
 116 } cipso_tag_type_1_t;
 117
 118 #define TSOL_CIPSO_MIN_LENGTH 6
 119 #define TSOL_CIPSO_MAX_LENGTH IP_MAX_OPT_LENGTH
 120 #define TSOL_TT1_MIN_LENGTH 4
 121 #define TSOL_TT1_MAX_LENGTH 34
 122
 123 #define TSOL_CIPSO_DOI_OFFSET 2
 124 #define TSOL_CIPSO_TAG_OFFSET 6
 125
 126 typedef struct cipso_option {
 127         uchar_t cipso_type;             /* Type of option (134) */
 128         uchar_t cipso_length;           /* Length of option */
 129         uchar_t cipso_doi[4];           /* Domain of Interpretation */
 130         uchar_t cipso_tag_type[1];      /* variable length */
 131 } cipso_option_t;
 132
 133 /*
 134  * RIPSO classifications
 135  */
 136 #define TSOL_CL_TOP_SECRET 0x3d
 137 #define TSOL_CL_SECRET 0x5a
 138 #define TSOL_CL_CONFIDENTIAL 0x96
 139 #define TSOL_CL_UNCLASSIFIED 0xab
 140
 141 /*
 142  * RIPSO protection authorities
 143  */
 144 #define TSOL_PA_GENSER 0x80
 145 #define TSOL_PA_SIOP_ESI 0x40
 146 #define TSOL_PA_SCI 0x20
 147 #define TSOL_PA_NSA 0x10
 148 #define TSOL_PA_DOE 0x08
 149
 150 /*
 151  * this mask is only used for tndb structures, and is different
 152  * from t6mask_t bits definitions
 153  */
 154
 155 typedef unsigned int tnmask_t;
 156
 157 /*
 158  * unlabeled host structure for the tnrhtp template.
 159  * same for both ILP32 and LP64.
 160  */
 161 struct tsol_unl {
 162         tnmask_t mask; /* tells which attributes are returned by the library */
 163         bslabel_t def_label;    /* default label */
 164         brange_t gw_sl_range;   /* for routing only */
 165         blset_t sl_set;         /* label set */
 166 };
 167
 168 /*
 169  * CIPSO host structure for the tnrhtp template
 170  * same for both ILP32 and LP64.
 171  */
 172 struct tsol_cipso {
 173         tnmask_t mask; /* tells which attributes are returned by the library */
 174         bclear_t def_cl;        /* default clearance */
 175         brange_t sl_range;      /* min/max SL range */
 176         blset_t sl_set;         /* label set */
 177 };
 178
 179 /*
 180  * Valid keys and values of the key=value pairs for tnrhtp
 181  */
 182 #define TP_UNLABELED    "unlabeled"
 183 #define TP_CIPSO        "cipso"
 184 #define TP_ZONE         "zone"
 185 #define TP_HOSTTYPE     "host_type"
 186 #define TP_DOI          "doi"
 187 #define TP_DEFLABEL     "def_label"
 188 #define TP_MINLABEL     "min_sl"
 189 #define TP_MAXLABEL     "max_sl"
 190 #define TP_SET          "sl_set"
 191
 192 #define TP_COMMA        ","
 193
 194 #define TNRHTP_NCOL     2       /* # of columns in tnrhtp */
 195
 196 /*
 197  * For tnrhtp access library routines and tnrhtp(2TSOL)
 198  * same for both ILP32 and LP64.
 199  */
 200 typedef struct tsol_tpent {
 201         char name[TNTNAMSIZ]; /* template name */
 202         tsol_host_type_t host_type; /* specifies host type */
 203         int tp_doi;             /* Domain of Interpretation */
 204 #define tp_cipso_doi_unl        tp_doi
 205 #define tp_cipso_doi_cipso      tp_doi
 206         union {
 207                 struct tsol_unl unl; /* template for unlabeled */
 208 #define tp_mask_unl             un.unl.mask
 209 #define tp_def_label            un.unl.def_label
 210 #define tp_gw_sl_range          un.unl.gw_sl_range
 211 #define tp_gw_sl_set            un.unl.sl_set
 212
 213                 struct tsol_cipso cipso; /* template for CIPSO */
 214 #define tp_mask_cipso           un.cipso.mask
 215 #define tp_def_cl_cipso         un.cipso.def_cl
 216 #define tp_sl_range_cipso       un.cipso.sl_range
 217 #define tp_sl_set_cipso         un.cipso.sl_set
 218         } un;
 219 } tsol_tpent_t;
 220
 221 typedef struct tsol_tpstr_s {
 222         char    *template;
 223         char    *attrs;
 224 } tsol_tpstr_t;
 225
 226 /*
 227  * For tnmlp(2TSOL); same for both ILP32 and LP64.
 228  */
 229 typedef struct tsol_mlpent {
 230         zoneid_t        tsme_zoneid;
 231         uint_t          tsme_flags;     /* TSOL_MEF_* */
 232         tsol_mlp_t      tsme_mlp;
 233 } tsol_mlpent_t;
 234
 235 #define TSOL_MEF_SHARED 0x00000001      /* MLP defined on shared addresses */
 236
 237 /*
 238  * For tnzonecfg access library routines.
 239  * List of MLPs ends with null entry, where protocol and port are both zero.
 240  */
 241 typedef struct tsol_zcent {
 242         char            zc_name[ZONENAME_MAX];
 243         int             zc_doi;
 244         bslabel_t       zc_label;
 245         int             zc_match;
 246         tsol_mlp_t      *zc_private_mlp;
 247         tsol_mlp_t      *zc_shared_mlp;
 248 } tsol_zcent_t;
 249 #define TSOL_MLP_END(mlp)       ((mlp)->mlp_ipp == 0 && (mlp)->mlp_port == 0)
 250
 251 typedef struct tsol_tpc {
 252         kmutex_t                tpc_lock;       /* lock for structure */
 253         uint_t                  tpc_refcnt;     /* reference count */
 254         boolean_t               tpc_invalid;    /* entry has been deleted */
 255         struct tsol_tpent       tpc_tp;         /* template */
 256 } tsol_tpc_t;
 257
 258 typedef struct tsol_tnrhc {
 259         struct tsol_tnrhc       *rhc_next;      /* link to next entry */
 260         kmutex_t                rhc_lock;       /* lock for structure */
 261         tnaddr_t                rhc_host;       /* IPv4/IPv6 host address */
 262         tsol_tpc_t              *rhc_tpc;       /* pointer to template */
 263         uint_t                  rhc_refcnt;     /* Number of references */
 264         char                    rhc_invalid;    /* out-of-date rhc */
 265         char                    rhc_isbcast;    /* broadcast address */
 266         char                    rhc_local;      /* loopback or local interace */
 267 } tsol_tnrhc_t;
 268
 269 /* Size of remote host hash tables in kernel */
 270 #define TNRHC_SIZE 256
 271 #define TSOL_MASK_TABLE_SIZE    33
 272 #define TSOL_MASK_TABLE_SIZE_V6 129
 273
 274 #ifdef  _KERNEL
 275 #define TNRHC_HOLD(a)   {                                       \
 276         mutex_enter(&(a)->rhc_lock);                            \
 277         (a)->rhc_refcnt++;                                      \
 278         ASSERT((a)->rhc_refcnt > 0);                            \
 279         mutex_exit(&(a)->rhc_lock);                             \
 280 }
 281 #define TNRHC_RELE(a)   {                                       \
 282         mutex_enter(&(a)->rhc_lock);                            \
 283         ASSERT((a)->rhc_refcnt > 0);                            \
 284         if (--(a)->rhc_refcnt <= 0)                             \
 285                 tnrhc_free(a);                                  \
 286         else                                                    \
 287                 mutex_exit(&(a)->rhc_lock);                     \
 288 }
 289 extern void tnrhc_free(tsol_tnrhc_t *);
 290 #define TPC_HOLD(a)     {                                       \
 291         mutex_enter(&(a)->tpc_lock);                            \
 292         (a)->tpc_refcnt++;                                      \
 293         ASSERT((a)->tpc_refcnt > 0);                            \
 294         mutex_exit(&(a)->tpc_lock);                             \
 295 }
 296 #define TPC_RELE(a)     {                                       \
 297         mutex_enter(&(a)->tpc_lock);                            \
 298         ASSERT((a)->tpc_refcnt > 0);                            \
 299         if (--(a)->tpc_refcnt <= 0)                             \
 300                 tpc_free(a);                                    \
 301         else                                                    \
 302                 mutex_exit(&(a)->tpc_lock);                     \
 303 }
 304 extern void tpc_free(tsol_tpc_t *);
 305 #endif  /* _KERNEL */
 306
 307 /*
 308  * The next three hashing macros are copied from macros in ip_ire.h.
 309  */
 310 #define TSOL_ADDR_HASH(addr, table_size)                                \
 311         (((((addr) >> 16) ^ (addr)) ^ ((((addr) >> 16) ^ (addr))>> 8))  \
 312         % (table_size))
 313
 314 #define TSOL_ADDR_HASH_V6(addr, table_size)                             \
 315         (((addr).s6_addr8[8] ^ (addr).s6_addr8[9] ^                     \
 316         (addr).s6_addr8[10] ^ (addr).s6_addr8[13] ^                     \
 317         (addr).s6_addr8[14] ^ (addr).s6_addr8[15]) % (table_size))
 318
 319 /* This assumes that table_size is a power of 2. */
 320 #define TSOL_ADDR_MASK_HASH_V6(addr, mask, table_size)                   \
 321         ((((addr).s6_addr8[8] & (mask).s6_addr8[8]) ^                   \
 322         ((addr).s6_addr8[9] & (mask).s6_addr8[9]) ^                     \
 323         ((addr).s6_addr8[10] & (mask).s6_addr8[10]) ^                   \
 324         ((addr).s6_addr8[13] & (mask).s6_addr8[13]) ^                   \
 325         ((addr).s6_addr8[14] & (mask).s6_addr8[14]) ^                   \
 326         ((addr).s6_addr8[15] & (mask).s6_addr8[15])) & ((table_size) - 1))
 327
 328
 329 /*
 330  * Constants used for getting the mask value in struct tsol_tpent
 331  */
 332 enum {
 333         TNT_DEF_LABEL,
 334         TNT_DEF_CL,
 335         TNT_SL_RANGE_TSOL, /* use this for both unl and zone */
 336         TNT_CIPSO_DOI
 337 };
 338
 339 /*
 340  * mask definitions
 341  */
 342 #define tsol_tntmask(value) ((unsigned int)(1<<(value)))
 343
 344 #define TSOL_MSK_DEF_LABEL tsol_tntmask(TNT_DEF_LABEL)
 345 #define TSOL_MSK_DEF_CL tsol_tntmask(TNT_DEF_CL)
 346 #define TSOL_MSK_SL_RANGE_TSOL tsol_tntmask(TNT_SL_RANGE_TSOL)
 347 #define TSOL_MSK_CIPSO_DOI tsol_tntmask(TNT_CIPSO_DOI)
 348
 349 /*
 350  * TN errors
 351  */
 352 #define TSOL_PARSE_ERANGE 1 /* result buffer not allocated */
 353 #define TSOL_NOT_SUPPORTED 2 /* address family not supported */
 354 #define TSOL_NOT_FOUND 3 /* search by * routines target not found */
 355
 356 /*
 357  * Structure used to hold a list of IP addresses.
 358  */
 359 typedef struct tsol_address {
 360         struct tsol_address     *next;
 361         in_addr_t               ip_address;
 362 } tsol_address_t;
 363
 364 /* This is shared between tcache and mdb */
 365 typedef struct tnrhc_hash_s {
 366         tsol_tnrhc_t *tnrh_list;
 367         kmutex_t tnrh_lock;
 368 } tnrhc_hash_t;
 369
 370 #ifdef _KERNEL
 371 typedef enum {
 372         mlptSingle,
 373         mlptPrivate,
 374         mlptShared,
 375         mlptBoth
 376 } mlp_type_t;
 377
 378 extern tsol_tpc_t *find_tpc(const void *, uchar_t, boolean_t);
 379 extern void tcache_init(void);
 380 extern in_port_t tsol_next_port(zone_t *, in_port_t, int, boolean_t);
 381 extern mlp_type_t tsol_mlp_port_type(zone_t *, uchar_t, uint16_t, mlp_type_t);
 382 extern zoneid_t tsol_mlp_findzone(uchar_t, uint16_t);
 383 extern int tsol_mlp_anon(zone_t *, mlp_type_t, uchar_t, uint16_t, boolean_t);
 384 extern void tsol_print_label(const blevel_t *, const char *);
 385
 386 struct tsol_gc_s;
 387 struct tsol_gcgrp_s;
 388 struct tsol_gcgrp_addr_s;
 389
 390 extern struct tsol_gc_s *gc_create(struct rtsa_s *, struct tsol_gcgrp_s *,
 391     boolean_t *);
 392 extern void gc_inactive(struct tsol_gc_s *);
 393 extern int rtsa_validate(const struct rtsa_s *);
 394 extern struct tsol_gcgrp_s *gcgrp_lookup(struct tsol_gcgrp_addr_s *, boolean_t);
 395 extern void gcgrp_inactive(struct tsol_gcgrp_s *);
 396 extern int tnrh_load(const tsol_rhent_t *);
 397 #endif /* _KERNEL */
 398
 399 #ifdef  __cplusplus
 400 }
 401 #endif
 402
 403 #endif  /* _SYS_TSOL_TNDB_H */