Import dssp5

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>

1 files changed, 147 insertions, 0 deletions

diff --git a/src/net/nodenet.cil b/src/net/nodenet.cil
new file mode 100644
index 0000000..a42df16
--- /dev/null
+++ b/src/net/nodenet.cil
@@ -0,0 +1,147 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(sidcontext node (sys.id sys.role net.netnode lowlevelrange))
+
+(class node (recvfrom sendto))
+(classorder (unordered node))
+
+(macro recvfrom_invalid_nodes ((type ARG1))
+       (allow ARG1 invalid (node (recvfrom))))
+
+(macro recvfromsendto_invalid_nodes ((type ARG1))
+       (allow ARG1 invalid (node (recvfrom sendto))))
+
+(macro sendto_invalid_nodes ((type ARG1))
+       (allow ARG1 invalid (node (sendto))))
+
+(tunableif (or invalid_associations invalid_peers)
+	   (true
+
+	    (call net.netnode.recvfromsendto_all_nodes (invalid))))
+
+(in invalid.unconfined
+
+    (allow typeattr .invalid (node (all))))
+
+(in mcs
+
+    (mlsconstrain (node (sendto))
+		  (or (dom h1 h2)
+		      (neq t1 constrained.typeattr)))
+
+    (mlsconstrain (node (recvfrom))
+		  (or (dom l1 l2)
+		      (neq t1 constrained.typeattr))))
+
+(in net
+
+    (blockinherit netnode.template)
+
+    (block netnode
+
+      (macro type ((type ARG1))
+	     (typeattributeset typeattr ARG1))
+
+      (typeattribute typeattr)
+
+      (blockinherit all_macro_template)
+
+      (call .obj.type (typeattr))
+
+      (block all_macro_template
+
+	(blockabstract all_macro_template)
+
+	(macro nodebind_all_dccp_sockets ((type ARG1))
+	       (allow ARG1 typeattr (dccp_socket (node_bind))))
+
+	(macro nodebind_all_icmp_sockets ((type ARG1))
+	       (allow ARG1 typeattr (icmp_socket (node_bind))))
+
+	(macro nodebind_all_rawip_sockets ((type ARG1))
+	       (allow ARG1 typeattr (rawip_socket (node_bind))))
+
+	(macro nodebind_all_sctp_sockets ((type ARG1))
+	       (allow ARG1 typeattr (sctp_socket (node_bind))))
+
+	(macro nodebind_all_tcp_sockets ((type ARG1))
+	       (allow ARG1 typeattr (tcp_socket (node_bind))))
+
+	(macro nodebind_all_udp_sockets ((type ARG1))
+	       (allow ARG1 typeattr (udp_socket (node_bind))))
+
+	(macro recvfrom_all_nodes ((type ARG1))
+	       (allow ARG1 typeattr (node (recvfrom))))
+
+	(macro recvfromsendto_all_nodes ((type ARG1))
+	       (allow ARG1 typeattr (node (recvfrom sendto))))
+
+	(macro sendto_all_nodes ((type ARG1))
+	       (allow ARG1 typeattr (node (sendto)))))
+
+      (block base_template
+
+	(blockabstract base_template)
+
+	(context netnode_context (.sys.id .sys.role netnode lowlevelrange))
+
+	(type netnode)
+	(call .net.netnode.type (netnode)))
+
+      (block macro_template
+
+	(blockabstract macro_template)
+
+	(macro nodebind_netnode_dccp_sockets ((type ARG1))
+	       (allow ARG1 netnode (dccp_socket (node_bind))))
+
+	(macro nodebind_netnode_icmp_sockets ((type ARG1))
+	       (allow ARG1 netnode (icmp_socket (node_bind))))
+
+	(macro nodebind_netnode_rawip_sockets ((type ARG1))
+	       (allow ARG1 netnode (rawip_socket (node_bind))))
+
+	(macro nodebind_netnode_sctp_sockets ((type ARG1))
+	       (allow ARG1 netnode (sctp_socket (node_bind))))
+
+	(macro nodebind_netnode_tcp_sockets ((type ARG1))
+	       (allow ARG1 netnode (tcp_socket (node_bind))))
+
+	(macro nodebind_netnode_udp_sockets ((type ARG1))
+	       (allow ARG1 netnode (udp_socket (node_bind))))
+
+	(macro recvfrom_nodes ((type ARG1))
+	       (allow ARG1 netnode (node (recvfrom))))
+
+	(macro recvfromsendto_nodes ((type ARG1))
+	       (allow ARG1 netnode (node (recvfrom sendto))))
+
+	(macro sendto_nodes ((type ARG1))
+	       (allow ARG1 netnode (node (sendto)))))
+
+      (block template
+
+	(blockabstract template)
+
+	(blockinherit .net.netnode.base_template)
+	(blockinherit .net.netnode.macro_template))
+
+      (block unconfined
+
+	(macro type ((type ARG1))
+	       (typeattributeset typeattr ARG1))
+
+	(typeattribute typeattr)
+
+	(allow typeattr netnode.typeattr (dccp_socket (node_bind)))
+	(allow typeattr netnode.typeattr (icmp_socket (node_bind)))
+	(allow typeattr netnode.typeattr (node (all)))
+	(allow typeattr netnode.typeattr (rawip_socket (node_bind)))
+	(allow typeattr netnode.typeattr (sctp_socket (node_bind)))
+	(allow typeattr netnode.typeattr (tcp_socket (node_bind)))
+	(allow typeattr netnode.typeattr (udp_socket (node_bind))))))
+
+(in net.unconfined
+
+    (call .net.netnode.unconfined.type (typeattr)))