Skip to content

Commit e41d837

Browse files
pcmoorepcmoore
committed
Initial commit using netlabel_tools-0.16.tar.gz as the source.
0 parents  commit e41d837

33 files changed

+5603
-0
lines changed

‎CHANGELOG‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
NetLabel Tools CHANGELOG
2+
==============================================================================
3+
4+
* Version 0.16 (August 3, 2006)
5+
------------------------------------------------------------------------------
6+
o Added a "version" flag (-V)
7+
o Moved the mapping commands to the new "map" class
8+
o Added support for the unlabeled list command
9+
o Updated the documentation to bring it up to date with the current options
10+
o Cleanup the libnetlabel interfaces a little bit
11+
o Shift to using NETLINK attributes, at some point we should use libnetlink
12+
13+
* Version 0.15 (July 6, 2006)
14+
------------------------------------------------------------------------------
15+
o Modified the NETLINK communication bits to support the newly aligned fields
16+
17+
* Version 0.14 (June 27, 2006)
18+
------------------------------------------------------------------------------
19+
o Added a RPM specfile based on a version from Steve Grubb <sgrubb@redhat.com>
20+
o Minor Makefile changes to ease tarball and RPM creation
21+
o Modified the NETLINK communication bits to support the new Generic NETLINK
22+
communication mechanism
23+
24+
* Version 0.13 (June 23, 2006)
25+
------------------------------------------------------------------------------
26+
o Added some text to the README to explain how to remove any pre-existing
27+
NetLabel configuration
28+
o Added two patches from Klaus Weidner <klaus@atsec.com> to add some error
29+
messages and better sendmsg() error reporting
30+
o Fixed some compiler warnings (added -Wall to CFLAGS) on Klaus' recomendation
31+
32+
* Version 0.12 (June 13, 2006)
33+
------------------------------------------------------------------------------
34+
o Added support for the new CIPSO_V4_MAP_PASS CIPSO mapping type
35+
36+
* Version 0.11 (June 7, 2006)
37+
------------------------------------------------------------------------------
38+
o Corrected a problem with the netlabel.h header file
39+
40+
* Version 0.11 (June 6, 2006)
41+
------------------------------------------------------------------------------
42+
o Changed the libnetlabel to reflect changes to the NetLabel protocol
43+
44+
* Version 0.10 (May 1, 2006)
45+
------------------------------------------------------------------------------
46+
o Initial version

‎LICENSE‎

Lines changed: 340 additions & 0 deletions
Large diffs are not rendered by default.

‎Makefile‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
#
2+
# NetLabel Tools Makefile
3+
#
4+
# NetLabel Tools are a collection of user space programs and libraries for
5+
# working with the Linux NetLabel subsystem. The NetLabel subsystem manages
6+
# static and dynamic label mappings for network protocols such as CIPSO and
7+
# RIPSO.
8+
#
9+
# Author: Paul Moore <paul.moore@hp.com>
10+
#
11+
12+
#
13+
# (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14+
#
15+
# This program is free software; you can redistribute it and/or modify
16+
# it under the terms of the GNU General Public License as published by
17+
# the Free Software Foundation; either version 2 of the License, or
18+
# (at your option) any later version.
19+
#
20+
# This program is distributed in the hope that it will be useful,
21+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
22+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23+
# the GNU General Public License for more details.
24+
#
25+
# You should have received a copy of the GNU General Public License
26+
# along with this program; if not, write to the Free Software
27+
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28+
#
29+
30+
#
31+
# macros
32+
#
33+
34+
include macros.mk
35+
36+
#
37+
# configuration
38+
#
39+
40+
INSTALL_PREFIX = /usr/local
41+
42+
INSTALL_SBIN_DIR = $(INSTALL_PREFIX)/sbin
43+
INSTALL_BIN_DIR = $(INSTALL_PREFIX)/bin
44+
INSTALL_MAN_DIR = $(INSTALL_PREFIX)/share/man
45+
46+
OWNER = root
47+
GROUP = root
48+
49+
#
50+
# targets
51+
#
52+
53+
SUBDIRS = libnetlabel netlabelctl
54+
55+
.PHONY: tarball install clean $(SUBDIRS)
56+
57+
all: $(SUBDIRS)
58+
59+
$(SUBDIRS):
60+
@echo "INFO: entering directory $@/ ..."
61+
@$(MAKE) -s -C $@
62+
63+
tarball: clean
64+
@name=$$(grep "^Name:" netlabel_tools.spec | awk '{ print $$2 }'); \
65+
ver=$$(grep "^Version:" netlabel_tools.spec | awk '{ print $$2 }'); \
66+
tarball=$$name-$$ver.tar.gz; \
67+
echo "INFO: creating the tarball ../$$tarball"; \
68+
tmp_dir=$$(mktemp -d /tmp/netlabel_tools.XXXXX); \
69+
rel_dir=$$tmp_dir/$$name-$$ver; \
70+
mkdir $$rel_dir; \
71+
tar cf - . | (cd $$rel_dir; tar xf -); \
72+
(cd $$tmp_dir; tar zcf $$tarball $$name-$$ver); \
73+
mv $$tmp_dir/$$tarball ..; \
74+
rm -rf $$tmp_dir;
75+
76+
install: $(SUBDIRS)
77+
@echo "INFO: installing files in $(INSTALL_PREFIX)"
78+
@mkdir -p $(INSTALL_SBIN_DIR)
79+
@mkdir -p $(INSTALL_MAN_DIR)/man8
80+
@install -o $(OWNER) -g $(GROUP) -m 755 netlabelctl/netlabelctl \
81+
$(INSTALL_SBIN_DIR)/netlabelctl
82+
@install -o $(OWNER) -g $(GROUP) -m 644 docs/man/netlabelctl.8 \
83+
$(INSTALL_MAN_DIR)/man8
84+
85+
clean:
86+
@for dir in $(SUBDIRS); do \
87+
echo "INFO: cleaning in $$dir/"; \
88+
$(MAKE) -s -C $$dir clean; \
89+
done
90+

‎README‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
NetLabel Tools README
2+
==============================================================================
3+
Paul Moore <paul.moore@hp.com>
4+
5+
* Note on the Documentation
6+
7+
The text below is intended as a quick start guide to configuring the Linux
8+
NetLabel subsystm using the tools provided in this package. For more
9+
documentation please look in the "docs/" subdirectory.
10+
11+
* Quick Start
12+
13+
The first step is to compile and install the netlabelctl application. It
14+
assumes you are already running a kernel with NetLabel support, if you are not
15+
please configure your kernel for NetLabel support before going any further.
16+
Once you have unpacked the NetLabel tools tarball run the following to build
17+
the application:
18+
19+
# make
20+
21+
Then as root run the following command to install the required files (installs
22+
to /usr/local by default):
23+
24+
# make install
25+
26+
Now you can proceed to configuring the NetLabel system in the kernel. Before
27+
you begin you first need to see if your kernel is already configured to some
28+
extent (it probably is), so run the following commands:
29+
30+
# netlabelctl -p cipsov4 list
31+
# netlabelctl -p map list
32+
33+
If you see any configured CIPSO definitions you can remove them with the
34+
following command:
35+
36+
# netlabelctl -p cipsov4 del doi:<DOI>
37+
38+
If you see any domain mappings you can remove them with the following command:
39+
40+
# netlabelctl -p map del domain:<DOMAIN>
41+
42+
You can remove the default domain mapping with this command:
43+
44+
# netlabelctl -p map del default
45+
46+
Finally, you set NetLabel to allow or deny incoming unlabeled packets with
47+
the following command:
48+
49+
# netlabelctl -p unlbl accept on|off
50+
51+
Now that you have removed any existing NetLabel configuration you can setup a
52+
basic CIPSO configuration. The first step is to add a CIPSO/IPv4 definition
53+
to the kernel. The command below creates a CIPSO/IPv4 definition using a DOI
54+
value of 1, the permissive bitmask tag, and three levels and categories both
55+
mapping straight from the CIPSO values to the local values.
56+
57+
# netlabelctl cipsov4 add std doi:1 tags:1 levels:0=0,1=1,2=2 \
58+
categories:0=0,1=1,2=2
59+
60+
The next step is to tell the NetLabel system to use this CIPSO/IPv4 defintion
61+
by default. You do that with the following command:
62+
63+
# netlabelctl map add default protocol:cipsov4,1
64+
65+
You can verify that everything is configured correctly with the following two
66+
commands:
67+
68+
# netlabelctl -p cipsov4 list doi:1
69+
# netlabelctl -p map list
70+
71+
For a greater explanation of what these commands do please see the "docs/"
72+
directory, good luck!

‎docs/libnetlabel.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
NetLabel Library
2+
==============================================================================
3+
Paul Moore <paul.moore@hp.com>
4+
5+
* TBD

‎docs/man/netlabelctl.8‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
.TH "netlabelctl" 1 "14 July 2006" "paul.moore@hp.com" "NetLabel Documentation"
2+
.SH NAME
3+
netlabelctl \- NetLabel control utility
4+
.SH SYNOPSIS
5+
.B netlabelctl
6+
[<flags>] <module> [<commands>]
7+
.SH DESCRIPTION
8+
.B netlabelctl
9+
allows privileged users to query and manipulate the NetLabel subsystem within
10+
the kernel.
11+
.SH OPTIONS
12+
.TP
13+
Flags
14+
.TP
15+
.B \-h
16+
Help message
17+
.TP
18+
.B \-p
19+
Attempt to make the output "pretty"
20+
.TP
21+
.B \-t <seconds>
22+
Set a timeout to be used when waiting for the NetLabel subsystem to respond
23+
.TP
24+
.B \-v
25+
Enable extra output
26+
.TP
27+
.B \-V
28+
Display the version information
29+
.TP
30+
Modules
31+
.TP
32+
.B mgmt
33+
The following commands are valid within this module
34+
.nf
35+
36+
version
37+
protocols
38+
.fi
39+
.TP
40+
.B map
41+
The following commands are valid within this module
42+
.nf
43+
44+
add default|domain:<domain> protocol:<protocol>[,<extra>]
45+
del default|domain:<domain>
46+
list
47+
.fi
48+
.TP
49+
.B unlbl
50+
The following commands are valid within this module
51+
.nf
52+
53+
accept on|off
54+
list
55+
.fi
56+
.TP
57+
.B cipsov4
58+
The following commands are valid within this module
59+
.nf
60+
61+
add std doi:<DOI> tags:<T1>,<Tn> levels:<LL1>=<RL1>,<LLn>=<RLn>
62+
categories:<LC1>=<RC1>,<LCn>=<RCn>
63+
add pass doi:<DOI> tags:<T1>,<Tn>
64+
del doi:<DOI>
65+
list [doi:<DOI>]
66+
.fi
67+
.SH "EXAMPLES"
68+
.TP
69+
.B netlabelctl cipsov4 add std doi:8 tags:1 levels:0=0,1=1 categories:0=1,1=0
70+
Add a CIPSO/IPv4 mapping with a DOI value of "8", using CIPSO tag "1"
71+
(the permissive bitmap tag). The specified mapping converts local LSM levels
72+
"0" and "1" to CIPSO levels "0" and "1" respectively while local LSM categories
73+
"0" and "1" are mapped to CIPSO categories "1" and "0" respectively.
74+
.TP
75+
.B netlabelctl map add domain:lsm_specific_string protocol:cipsov4,8
76+
Add a domain mapping so that all outgoing packets asscoiated with the
77+
specified LSM domain string will be labeled according to the CIPSO/IPv4
78+
protocol using DOI 8.
79+
.SH "NOTES"
80+
This program is currently under development, please report any bugs to the author.
81+
.SH "AUTHOR"
82+
Paul Moore <paul.moore@hp.com>
83+
.SH "SEE ALSO"
84+
<other pages to be created at a future date>

0 commit comments

Comments
 (0)