/src/strongswan/src/libstrongswan/selectors/sec_label.h
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C) 2021 Tobias Brunner |
3 | | * |
4 | | * Copyright (C) secunet Security Networks AG |
5 | | * |
6 | | * This program is free software; you can redistribute it and/or modify it |
7 | | * under the terms of the GNU General Public License as published by the |
8 | | * Free Software Foundation; either version 2 of the License, or (at your |
9 | | * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, but |
12 | | * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY |
13 | | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
14 | | * for more details. |
15 | | */ |
16 | | |
17 | | /** |
18 | | * @defgroup sec_label sec_label |
19 | | * @{ @ingroup ipsec |
20 | | */ |
21 | | |
22 | | #ifndef SEC_LABEL_H_ |
23 | | #define SEC_LABEL_H_ |
24 | | |
25 | | typedef enum sec_label_mode_t sec_label_mode_t; |
26 | | typedef struct sec_label_t sec_label_t; |
27 | | |
28 | | #include <library.h> |
29 | | |
30 | | /** |
31 | | * Mode in which security labels are used. |
32 | | */ |
33 | | enum sec_label_mode_t { |
34 | | |
35 | | /** |
36 | | * System default. Simple mode if SELinux is not supported or disabled |
37 | | * on the system. |
38 | | */ |
39 | | SEC_LABEL_MODE_SYSTEM, |
40 | | |
41 | | /** |
42 | | * Simple mode that does establish regular CHILD_SAs, matches labels exactly |
43 | | * and does not install them in the kernel. |
44 | | */ |
45 | | SEC_LABEL_MODE_SIMPLE, |
46 | | |
47 | | /** |
48 | | * SELinux mode where configured labels are installed on (trap) policies, |
49 | | * labels from acquires/peer on SAs, child-less IKE_SAs are initiated |
50 | | * if there is no acquire, labels are also matched via polmatch. |
51 | | */ |
52 | | SEC_LABEL_MODE_SELINUX, |
53 | | }; |
54 | | |
55 | | /** |
56 | | * Names for security label modes. |
57 | | */ |
58 | | extern enum_name_t *sec_label_mode_names; |
59 | | |
60 | | /** |
61 | | * Representation of a security label used on policies/SAs. |
62 | | * |
63 | | * For example, with SELinux this could be a value like |
64 | | * system_u:object_r:ipsec_spd_t:s0. |
65 | | */ |
66 | | struct sec_label_t { |
67 | | |
68 | | /** |
69 | | * Return a binary encoding of the security label as used for IKE. |
70 | | * |
71 | | * @return binary encoding (internal data) |
72 | | */ |
73 | | chunk_t (*get_encoding)(sec_label_t *this); |
74 | | |
75 | | /** |
76 | | * Return a string representation of this security label. |
77 | | * |
78 | | * @return string representation (internal data) |
79 | | */ |
80 | | char *(*get_string)(sec_label_t *this); |
81 | | |
82 | | /** |
83 | | * Clone this security label. |
84 | | * |
85 | | * @return clone of it |
86 | | */ |
87 | | sec_label_t *(*clone)(sec_label_t *this); |
88 | | |
89 | | /** |
90 | | * Match two security labels. |
91 | | * |
92 | | * For SELinux this checks if this security label permits other in terms |
93 | | * of association { polmatch }. |
94 | | * |
95 | | * @param other security label to match against this |
96 | | * @return TRUE if matching, FALSE otherwise |
97 | | */ |
98 | | bool (*matches)(sec_label_t *this, sec_label_t *other); |
99 | | |
100 | | /** |
101 | | * Compare two security labels for equality. |
102 | | * |
103 | | * @param other security label to compare with this |
104 | | * @return TRUE if equal, FALSE otherwise |
105 | | */ |
106 | | bool (*equals)(sec_label_t *this, sec_label_t *other); |
107 | | |
108 | | /** |
109 | | * Create a hash value for the security label. |
110 | | * |
111 | | * @param inc optional value for incremental hashing |
112 | | * @return calculated hash value for the security label |
113 | | */ |
114 | | u_int (*hash)(sec_label_t *this, u_int inc); |
115 | | |
116 | | /** |
117 | | * Destroys the object. |
118 | | */ |
119 | | void (*destroy)(sec_label_t *this); |
120 | | }; |
121 | | |
122 | | /** |
123 | | * Try to parse a sec_label_t from the given binary encoding. |
124 | | * |
125 | | * @param value encoding to parse |
126 | | * @return security label instance, NULL if invalid |
127 | | */ |
128 | | sec_label_t *sec_label_from_encoding(const chunk_t value); |
129 | | |
130 | | /** |
131 | | * Try to parse a sec_label_t from the given string. |
132 | | * |
133 | | * @param value string to parse |
134 | | * @return security label instance, NULL if invalid |
135 | | */ |
136 | | sec_label_t *sec_label_from_string(const char *value); |
137 | | |
138 | | /** |
139 | | * Compare two security labels for equality, accept if both are NULL. |
140 | | * |
141 | | * @param a first label |
142 | | * @param b second label |
143 | | * @return TRUE if labels are equal or both NULL |
144 | | */ |
145 | | static inline bool sec_labels_equal(sec_label_t *a, sec_label_t *b) |
146 | 0 | { |
147 | 0 | return (!a && !b) || (a && a->equals(a, b)); |
148 | 0 | } Unexecuted instantiation: fuzz_vici.c:sec_labels_equal Unexecuted instantiation: daemon.c:sec_labels_equal Unexecuted instantiation: kernel_interface.c:sec_labels_equal Unexecuted instantiation: kernel_handler.c:sec_labels_equal Unexecuted instantiation: receiver.c:sec_labels_equal Unexecuted instantiation: sender.c:sec_labels_equal Unexecuted instantiation: socket_manager.c:sec_labels_equal Unexecuted instantiation: acquire_job.c:sec_labels_equal Unexecuted instantiation: delete_child_sa_job.c:sec_labels_equal Unexecuted instantiation: migrate_job.c:sec_labels_equal Unexecuted instantiation: process_message_job.c:sec_labels_equal Unexecuted instantiation: rekey_child_sa_job.c:sec_labels_equal Unexecuted instantiation: start_action_job.c:sec_labels_equal Unexecuted instantiation: roam_job.c:sec_labels_equal Unexecuted instantiation: update_sa_job.c:sec_labels_equal Unexecuted instantiation: ike_sa_manager.c:sec_labels_equal Unexecuted instantiation: child_sa_manager.c:sec_labels_equal Unexecuted instantiation: shunt_manager.c:sec_labels_equal Unexecuted instantiation: trap_manager.c:sec_labels_equal Unexecuted instantiation: redirect_manager.c:sec_labels_equal Unexecuted instantiation: sys_logger.c:sec_labels_equal Unexecuted instantiation: socket_default_plugin.c:sec_labels_equal Unexecuted instantiation: socket_default_socket.c:sec_labels_equal Unexecuted instantiation: counters_plugin.c:sec_labels_equal Unexecuted instantiation: vici_plugin.c:sec_labels_equal Unexecuted instantiation: vici_query.c:sec_labels_equal Unexecuted instantiation: updown_plugin.c:sec_labels_equal Unexecuted instantiation: eap_radius_plugin.c:sec_labels_equal Unexecuted instantiation: eap_radius_provider.c:sec_labels_equal Unexecuted instantiation: eap_radius_xauth.c:sec_labels_equal Unexecuted instantiation: kernel_netlink_plugin.c:sec_labels_equal Unexecuted instantiation: resolve_plugin.c:sec_labels_equal Unexecuted instantiation: attr_plugin.c:sec_labels_equal Unexecuted instantiation: attr_provider.c:sec_labels_equal Unexecuted instantiation: attribute_manager.c:sec_labels_equal Unexecuted instantiation: bus.c:sec_labels_equal Unexecuted instantiation: file_logger.c:sec_labels_equal Unexecuted instantiation: backend_manager.c:sec_labels_equal Unexecuted instantiation: child_cfg.c:sec_labels_equal Unexecuted instantiation: ike_cfg.c:sec_labels_equal Unexecuted instantiation: peer_cfg.c:sec_labels_equal Unexecuted instantiation: controller.c:sec_labels_equal Unexecuted instantiation: message.c:sec_labels_equal Unexecuted instantiation: parser.c:sec_labels_equal Unexecuted instantiation: configuration_attribute.c:sec_labels_equal Unexecuted instantiation: encrypted_payload.c:sec_labels_equal Unexecuted instantiation: notify_payload.c:sec_labels_equal Unexecuted instantiation: payload.c:sec_labels_equal Unexecuted instantiation: proposal_substructure.c:sec_labels_equal Unexecuted instantiation: sa_payload.c:sec_labels_equal Unexecuted instantiation: traffic_selector_substructure.c:sec_labels_equal Unexecuted instantiation: transform_substructure.c:sec_labels_equal Unexecuted instantiation: ts_payload.c:sec_labels_equal Unexecuted instantiation: kernel_ipsec.c:sec_labels_equal Unexecuted instantiation: kernel_net.c:sec_labels_equal Unexecuted instantiation: kernel_listener.c:sec_labels_equal Unexecuted instantiation: socket.c:sec_labels_equal Unexecuted instantiation: delete_ike_sa_job.c:sec_labels_equal Unexecuted instantiation: eap_method.c:sec_labels_equal Unexecuted instantiation: xauth_method.c:sec_labels_equal Unexecuted instantiation: child_sa.c:sec_labels_equal Unexecuted instantiation: ike_sa.c:sec_labels_equal Unexecuted instantiation: keymat.c:sec_labels_equal Unexecuted instantiation: task_manager.c:sec_labels_equal Unexecuted instantiation: task.c:sec_labels_equal Unexecuted instantiation: keymat_v2.c:sec_labels_equal Unexecuted instantiation: task_manager_v2.c:sec_labels_equal Unexecuted instantiation: child_create.c:sec_labels_equal Unexecuted instantiation: child_delete.c:sec_labels_equal Unexecuted instantiation: child_rekey.c:sec_labels_equal Unexecuted instantiation: ike_auth.c:sec_labels_equal Unexecuted instantiation: ike_cert_pre.c:sec_labels_equal Unexecuted instantiation: ike_cert_post.c:sec_labels_equal Unexecuted instantiation: ike_config.c:sec_labels_equal Unexecuted instantiation: ike_delete.c:sec_labels_equal Unexecuted instantiation: ike_dpd.c:sec_labels_equal Unexecuted instantiation: ike_establish.c:sec_labels_equal Unexecuted instantiation: ike_init.c:sec_labels_equal Unexecuted instantiation: ike_natd.c:sec_labels_equal Unexecuted instantiation: ike_mid_sync.c:sec_labels_equal Unexecuted instantiation: ike_mobike.c:sec_labels_equal Unexecuted instantiation: ike_rekey.c:sec_labels_equal Unexecuted instantiation: ike_reauth.c:sec_labels_equal Unexecuted instantiation: ike_reauth_complete.c:sec_labels_equal Unexecuted instantiation: ike_redirect.c:sec_labels_equal Unexecuted instantiation: ike_auth_lifetime.c:sec_labels_equal Unexecuted instantiation: ike_vendor.c:sec_labels_equal Unexecuted instantiation: ike_verify_peer_cert.c:sec_labels_equal Unexecuted instantiation: counters_listener.c:sec_labels_equal Unexecuted instantiation: vici_attribute.c:sec_labels_equal Unexecuted instantiation: vici_config.c:sec_labels_equal Unexecuted instantiation: vici_control.c:sec_labels_equal Unexecuted instantiation: vici_logger.c:sec_labels_equal Unexecuted instantiation: updown_handler.c:sec_labels_equal Unexecuted instantiation: updown_listener.c:sec_labels_equal Unexecuted instantiation: eap_radius.c:sec_labels_equal Unexecuted instantiation: eap_radius_accounting.c:sec_labels_equal Unexecuted instantiation: eap_radius_dae.c:sec_labels_equal Unexecuted instantiation: eap_radius_forward.c:sec_labels_equal Unexecuted instantiation: kernel_netlink_ipsec.c:sec_labels_equal Unexecuted instantiation: kernel_netlink_net.c:sec_labels_equal Unexecuted instantiation: resolve_handler.c:sec_labels_equal Unexecuted instantiation: generator.c:sec_labels_equal Unexecuted instantiation: auth_payload.c:sec_labels_equal Unexecuted instantiation: cert_payload.c:sec_labels_equal Unexecuted instantiation: certreq_payload.c:sec_labels_equal Unexecuted instantiation: delete_payload.c:sec_labels_equal Unexecuted instantiation: eap_payload.c:sec_labels_equal Unexecuted instantiation: id_payload.c:sec_labels_equal Unexecuted instantiation: nonce_payload.c:sec_labels_equal Unexecuted instantiation: redirect_job.c:sec_labels_equal Unexecuted instantiation: rekey_ike_sa_job.c:sec_labels_equal Unexecuted instantiation: retransmit_job.c:sec_labels_equal Unexecuted instantiation: retry_initiate_job.c:sec_labels_equal Unexecuted instantiation: send_dpd_job.c:sec_labels_equal Unexecuted instantiation: send_keepalive_job.c:sec_labels_equal Unexecuted instantiation: inactivity_job.c:sec_labels_equal Unexecuted instantiation: initiate_tasks_job.c:sec_labels_equal Unexecuted instantiation: authenticator.c:sec_labels_equal Unexecuted instantiation: eap_authenticator.c:sec_labels_equal Unexecuted instantiation: psk_authenticator.c:sec_labels_equal Unexecuted instantiation: pubkey_authenticator.c:sec_labels_equal Unexecuted instantiation: sec_label.c:sec_labels_equal Unexecuted instantiation: fuzz_ike.c:sec_labels_equal |
149 | | |
150 | | /** |
151 | | * Try to parse a security label mode from the given string. |
152 | | * |
153 | | * @param value string to parse |
154 | | * @param mode parsed mode |
155 | | * @return TRUE if mode is valid (and usable on system) |
156 | | */ |
157 | | bool sec_label_mode_from_string(const char *value, sec_label_mode_t *mode); |
158 | | |
159 | | /** |
160 | | * Get the system default security label mode. |
161 | | * |
162 | | * @return default mode |
163 | | */ |
164 | | sec_label_mode_t sec_label_mode_default(); |
165 | | |
166 | | #endif /** SEC_LABEL_H_ @}*/ |