1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0 */
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * SELinux support for the XFRM LSM hooks
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Author : Trent Jaeger, <jaegert@us.ibm.com>
6*4882a593Smuzhiyun * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
7*4882a593Smuzhiyun */
8*4882a593Smuzhiyun #ifndef _SELINUX_XFRM_H_
9*4882a593Smuzhiyun #define _SELINUX_XFRM_H_
10*4882a593Smuzhiyun
11*4882a593Smuzhiyun #include <net/flow.h>
12*4882a593Smuzhiyun
13*4882a593Smuzhiyun int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
14*4882a593Smuzhiyun struct xfrm_user_sec_ctx *uctx,
15*4882a593Smuzhiyun gfp_t gfp);
16*4882a593Smuzhiyun int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
17*4882a593Smuzhiyun struct xfrm_sec_ctx **new_ctxp);
18*4882a593Smuzhiyun void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
19*4882a593Smuzhiyun int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
20*4882a593Smuzhiyun int selinux_xfrm_state_alloc(struct xfrm_state *x,
21*4882a593Smuzhiyun struct xfrm_user_sec_ctx *uctx);
22*4882a593Smuzhiyun int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
23*4882a593Smuzhiyun struct xfrm_sec_ctx *polsec, u32 secid);
24*4882a593Smuzhiyun void selinux_xfrm_state_free(struct xfrm_state *x);
25*4882a593Smuzhiyun int selinux_xfrm_state_delete(struct xfrm_state *x);
26*4882a593Smuzhiyun int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
27*4882a593Smuzhiyun int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
28*4882a593Smuzhiyun struct xfrm_policy *xp,
29*4882a593Smuzhiyun const struct flowi_common *flic);
30*4882a593Smuzhiyun
31*4882a593Smuzhiyun #ifdef CONFIG_SECURITY_NETWORK_XFRM
32*4882a593Smuzhiyun extern atomic_t selinux_xfrm_refcount;
33*4882a593Smuzhiyun
selinux_xfrm_enabled(void)34*4882a593Smuzhiyun static inline int selinux_xfrm_enabled(void)
35*4882a593Smuzhiyun {
36*4882a593Smuzhiyun return (atomic_read(&selinux_xfrm_refcount) > 0);
37*4882a593Smuzhiyun }
38*4882a593Smuzhiyun
39*4882a593Smuzhiyun int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
40*4882a593Smuzhiyun struct common_audit_data *ad);
41*4882a593Smuzhiyun int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
42*4882a593Smuzhiyun struct common_audit_data *ad, u8 proto);
43*4882a593Smuzhiyun int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
44*4882a593Smuzhiyun int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
45*4882a593Smuzhiyun
selinux_xfrm_notify_policyload(void)46*4882a593Smuzhiyun static inline void selinux_xfrm_notify_policyload(void)
47*4882a593Smuzhiyun {
48*4882a593Smuzhiyun struct net *net;
49*4882a593Smuzhiyun
50*4882a593Smuzhiyun down_read(&net_rwsem);
51*4882a593Smuzhiyun for_each_net(net)
52*4882a593Smuzhiyun rt_genid_bump_all(net);
53*4882a593Smuzhiyun up_read(&net_rwsem);
54*4882a593Smuzhiyun }
55*4882a593Smuzhiyun #else
selinux_xfrm_enabled(void)56*4882a593Smuzhiyun static inline int selinux_xfrm_enabled(void)
57*4882a593Smuzhiyun {
58*4882a593Smuzhiyun return 0;
59*4882a593Smuzhiyun }
60*4882a593Smuzhiyun
selinux_xfrm_sock_rcv_skb(u32 sk_sid,struct sk_buff * skb,struct common_audit_data * ad)61*4882a593Smuzhiyun static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
62*4882a593Smuzhiyun struct common_audit_data *ad)
63*4882a593Smuzhiyun {
64*4882a593Smuzhiyun return 0;
65*4882a593Smuzhiyun }
66*4882a593Smuzhiyun
selinux_xfrm_postroute_last(u32 sk_sid,struct sk_buff * skb,struct common_audit_data * ad,u8 proto)67*4882a593Smuzhiyun static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
68*4882a593Smuzhiyun struct common_audit_data *ad,
69*4882a593Smuzhiyun u8 proto)
70*4882a593Smuzhiyun {
71*4882a593Smuzhiyun return 0;
72*4882a593Smuzhiyun }
73*4882a593Smuzhiyun
selinux_xfrm_decode_session(struct sk_buff * skb,u32 * sid,int ckall)74*4882a593Smuzhiyun static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
75*4882a593Smuzhiyun int ckall)
76*4882a593Smuzhiyun {
77*4882a593Smuzhiyun *sid = SECSID_NULL;
78*4882a593Smuzhiyun return 0;
79*4882a593Smuzhiyun }
80*4882a593Smuzhiyun
selinux_xfrm_notify_policyload(void)81*4882a593Smuzhiyun static inline void selinux_xfrm_notify_policyload(void)
82*4882a593Smuzhiyun {
83*4882a593Smuzhiyun }
84*4882a593Smuzhiyun
selinux_xfrm_skb_sid(struct sk_buff * skb,u32 * sid)85*4882a593Smuzhiyun static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
86*4882a593Smuzhiyun {
87*4882a593Smuzhiyun *sid = SECSID_NULL;
88*4882a593Smuzhiyun return 0;
89*4882a593Smuzhiyun }
90*4882a593Smuzhiyun #endif
91*4882a593Smuzhiyun
92*4882a593Smuzhiyun #endif /* _SELINUX_XFRM_H_ */
93