Paul Moore
8cc44579d1
NetLabel: Introduce static network labels for unlabeled connections ...
Most trusted OSs, with the exception of Linux, have the ability to specify
static security labels for unlabeled networks. This patch adds this ability to
the NetLabel packet labeling framework.
If the NetLabel subsystem is called to determine the security attributes of an
incoming packet it first checks to see if any recognized NetLabel packet
labeling protocols are in-use on the packet. If none can be found then the
unlabled connection table is queried and based on the packets incoming
interface and address it is matched with a security label as configured by the
administrator using the netlabel_tools package. The matching security label is
returned to the caller just as if the packet was explicitly labeled using a
labeling protocol.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-01-30 08:17:28 +11:00
Use helpers to obtain task pid in printks
2007-10-19 11:53:43 -07:00
[NET]: Remove FASTCALL macro
2008-01-28 14:57:23 -08:00
[IrDA]: Irport removal - part 1
2008-01-28 15:08:10 -08:00
[AF_IUCV]: postpone receival of iucv-packets
2007-10-10 16:54:51 -07:00
[NETNS][FRAGS]: Move ctl tables around.
2008-01-28 15:10:34 -08:00
[NETNS][FRAGS]: Isolate the secret interval from namespaces.
2008-01-28 15:10:39 -08:00
[NET] CORE: Introducing new memory accounting interface.
2008-01-28 15:00:18 -08:00
[PKT_SCHED]: Add stateless NAT
2007-10-10 16:53:11 -07:00
[NET_SCHED]: act_api: use PTR_ERR in tcf_action_init/tcf_action_get
2008-01-28 15:11:17 -08:00
[IPV4]: Enable use of 240/4 address space.
2008-01-28 15:08:44 -08:00
[AF_UNIX]: Remove unused declaration of sysctl_unix_max_dgram_qlen.
2008-01-28 14:57:13 -08:00
[IPSEC]: Get rid of ipv6_{auth,esp,comp}_hdr
2007-10-10 16:55:55 -07:00
[IPV4]: Remove unused define in include/net/arp.h (HAVE_ARP_CREATE)
2008-01-28 15:00:16 -08:00
[NET] include/net/: Spelling fixes
2007-12-20 13:56:32 -08:00
ax88796: add 93cx6 eeprom support
2007-10-10 16:53:56 -07:00
cfg80211/nl80211: implement station attribute retrieval
2008-01-28 14:59:52 -08:00
[NET]: Move netfilter checksum helpers to net/core/utils.c
2008-01-28 14:55:14 -08:00
[NET]: Wrap netdevice hardware header creation.
2007-10-10 16:52:50 -07:00
[NET]: Constify include/net/dsfield.h
2008-01-28 14:55:58 -08:00
[DST]: shrinks sizeof(struct rtable) by 64 bytes on x86_64
2008-01-28 15:10:41 -08:00
cleanup asm/scatterlist.h includes
2007-11-02 08:47:06 +01:00
[NETNS]: Process FIB rule action in the context of the namespace.
2008-01-28 15:08:14 -08:00
[IPV4]: Remove unused multipath cached routing defintion in net/flow.h
2008-01-28 15:00:20 -08:00
[NET_SCHED]: Convert packet schedulers from rtnetlink to new netlink API
2008-01-28 15:11:10 -08:00
[IPV4]: Add ICMPMsgStats MIB (RFC 4293)
2007-10-10 16:51:28 -07:00
ieee80211: fix misannotations
2008-01-28 15:08:48 -08:00
[MAC80211]: Add get_unaligned to ieee80211_get_radiotap_len
2007-10-10 16:47:40 -07:00
[IEEE80211]: Fix softmac lockdep reports.
2007-10-10 16:52:22 -07:00
IPoIB: improve IPv4/IPv6 to IB mcast mapping functions
2008-01-25 14:15:37 -08:00
[INET]: Remove leftover prototypes from include/net/inet_common.h
2007-11-12 21:02:51 -08:00
[INET]: Give outer DSCP directly to ip*_copy_dscp
2008-01-28 14:53:45 -08:00
[NETNS][FRAGS]: Make the pernet subsystem for fragments.
2008-01-28 15:10:40 -08:00
[NET]: prot_inuse cleanups and optimizations
2008-01-28 15:00:36 -08:00
[UDP]: Make use of inet_iif() when doing socket lookups.
2007-10-25 18:54:46 -07:00
[INET]: Uninline the inet_twsk_put function.
2008-01-28 14:59:28 -08:00
[INET]: Use list_head-s in inetpeer.c
2007-11-12 21:27:28 -08:00
[NETNS][FRAGS]: Make the mem counter per-namespace.
2008-01-28 15:10:36 -08:00
[XFRM] IPv6: Fix dst/routing check at transformation.
2008-01-28 14:59:36 -08:00
[NETNS][IPV6]: Make sysctls route per namespace.
2008-01-28 15:01:20 -08:00
[NET] include/net/: Spelling fixes
2007-12-20 13:56:32 -08:00
[NETNS]: Add netns parameter to fib_select_default.
2008-01-28 15:11:03 -08:00
[IPVS]: Switch to using ctl_paths.
2008-01-28 15:01:08 -08:00
[IPSEC]: Get rid of ipv6_{auth,esp,comp}_hdr
2007-10-10 16:55:55 -07:00
[IPV4]: Add ip_local_out
2008-01-28 14:53:47 -08:00
[NETNS][FRAGS]: Make the mem counter per-namespace.
2008-01-28 15:10:36 -08:00
[NL80211]: add netlink interface to cfg80211
2007-10-10 16:52:14 -07:00
[NET]: Make socket creation namespace safe.
2007-10-10 16:49:07 -07:00
mac80211: add unified BSS configuration
2008-01-28 15:09:43 -08:00
[IPv6]: Export userland ND options through netlink (RDNSS support)
2007-10-10 21:22:05 -07:00
[ARP]: neigh_parms_put(destroy) are essentially local to core/neighbour.c.
2008-01-28 15:02:11 -08:00
[NETNS]: Namespacing in the generic fib rules code.
2008-01-28 15:01:23 -08:00
[NET]: Remove unnecessary inclusion of dst.h
2008-01-28 14:53:38 -08:00
NetLabel: Introduce static network labels for unlabeled connections
2008-01-30 08:17:28 +11:00
[NETLINK]: Add nla_append()
2008-01-28 15:11:09 -08:00
[NET_SCHED]: Convert classifiers from rtnetlink to new netlink API
2008-01-28 15:11:11 -08:00
[NET_SCHED]: Convert packet schedulers from rtnetlink to new netlink API
2008-01-28 15:11:10 -08:00
[IPV6]: make inet6_register_protosw to return an error code
2008-01-28 14:57:12 -08:00
[NETNS][RAW]: Make /proc/net/raw(6) show per-namespace socket list.
2008-01-28 15:02:06 -08:00
[IPv6] RAW: Compact the API for the kernel
2008-01-28 14:54:29 -08:00
[INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue
2007-11-15 02:57:06 -08:00
[ROSE]: Fix rose.ko oops on unload
2007-10-07 23:44:17 -07:00
[NETNS]: Routing cache virtualization.
2008-01-28 15:11:13 -08:00
[NET]: Make the device list and device lookups per namespace.
2007-10-10 16:49:10 -07:00
[NET_SCHED]: Convert classifiers from rtnetlink to new netlink API
2008-01-28 15:11:11 -08:00
pid namespaces: changes to show virtual ids to user
2007-10-19 11:53:40 -07:00
[XFRM]: Define packet dropping statistics.
2008-01-28 14:59:38 -08:00
[TCP]: Do not purge sk_forward_alloc entirely in tcp_delack_timer().
2008-01-28 15:01:42 -08:00
[TCP]: Uninline tcp_is_cwnd_limited
2008-01-28 15:01:48 -08:00
[IPV6]: make the protocol initialization to return an error code
2008-01-28 14:57:13 -08:00
[NET]: prot_inuse cleanups and optimizations
2008-01-28 15:00:36 -08:00
[UDP]: Restore missing inDatagrams increments
2008-01-28 14:56:33 -08:00
[NET]: Make the device list and device lookups per namespace.
2007-10-10 16:49:10 -07:00
[XFRM] xfrm_policy_destroy: Rename and relative fixes.
2008-01-28 15:00:46 -08:00
8cc44579d1