CALIPSO is a packet labelling protocol for IPv6 which is very similar to CIPSO. It is specified in RFC 5570. Much of the code is based on the current CIPSO code. This adds support for adding passthrough-type CALIPSO DOIs through the NLBL_CALIPSO_C_ADD command. It requires attributes: NLBL_CALIPSO_A_TYPE which must be CALIPSO_MAP_PASS. NLBL_CALIPSO_A_DOI. In passthrough mode the CALIPSO engine will map MLS secattr levels and categories directly to the packet label. At this stage, the major difference between this and the CIPSO code is that IPv6 may be compiled as a module. To allow for this the CALIPSO functions are registered at module init time.
Showing the changes to include/uapi (1 of 12 files). Show all
Unified · Split
| @@ -130,6 +130,8 @@ · 129 unmodified lines | |||
| 130 | #define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit an IPSec event */ | 130 | #define AUDIT_MAC_IPSEC_EVENT 1415 /* Audit an IPSec event */ |
| 131 | #define AUDIT_MAC_UNLBL_STCADD 1416 /* NetLabel: add a static label */ | 131 | #define AUDIT_MAC_UNLBL_STCADD 1416 /* NetLabel: add a static label */ |
| 132 | #define AUDIT_MAC_UNLBL_STCDEL 1417 /* NetLabel: del a static label */ | 132 | #define AUDIT_MAC_UNLBL_STCDEL 1417 /* NetLabel: del a static label */ |
| 133 | #define AUDIT_MAC_CALIPSO_ADD 1418 /* NetLabel: add CALIPSO DOI entry */ | ||
| 134 | #define AUDIT_MAC_CALIPSO_DEL 1419 /* NetLabel: del CALIPSO DOI entry */ | ||
| 133 | 135 | ||
| 134 | #define AUDIT_FIRST_KERN_ANOM_MSG 1700 | 136 | #define AUDIT_FIRST_KERN_ANOM_MSG 1700 |
| 135 | #define AUDIT_LAST_KERN_ANOM_MSG 1799 | 137 | #define AUDIT_LAST_KERN_ANOM_MSG 1799 |