[root@poisonivy ~]# ./client 192.168.147.132
getpeercon: Protocol not available Received: Hello, (null) from (null)
[root@scarecrow ~]# ./server
getsockopt: Protocol not available server: got connection from
192.168.147.130, (null)
getpeercon()返回协议不可用，因为在本次连接中没有标记被启用，你可以根据
错误信息来判断你是否使用了标记网络套接字。
如果我们在这两台机器之间不指定一个上下文而产生一个SA，我们将得到同样的结果：
[root@scarecrow ~]# cat dev/ipsec/setkey.scarecrow.test
spdflush;
flush;
spdadd 192.168.147.130 192.168.147.132 any
-P in ipsec esp/transport//require;
spdadd 192.168.147.132 192.168.147.130 any
-P out ipsec esp/transport//require;
[root@poisonivy ~]# cat dev/ipsec/setkey.poisonivy.test
spdflush;
flush;
spdadd 192.168.147.132 192.168.147.130 any
-P in ipsec esp/transport//require;
spdadd 192.168.147.130 192.168.147.132 any
-P out ipsec esp/transport//require;
值得特别感谢的是那些为这个技术努力工作的人们，将来他们会使网络架构更安全，这些人包括：James Morris, Venkat Yekkirala, Joy Latten, Paul Moore (实现了NetLabel)等
附录A：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 3490 // the port client will be connecting to
#define MAXDATASIZE 100 // max number of bytes we can get at once
int main(int argc, char *argv[])
{
int sockfd, numbytes;
char buf[MAXDATASIZE];
struct hostent *he;
struct sockaddr_in their_addr; // connector's address information
security_context_t con = NULL;
if (argc != 2) {
fprintf(stderr,"usage: client hostnamen");
exit(1);
}
if ((he=gethostbyname(argv[1])) == NULL) { // get the host info
herror("gethostbyname");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
their_addr.sin_family = AF_INET; // host byte order
their_addr.sin_port = htons(PORT); // short, network byte order
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(their_addr.sin_zero), '', 8); // zero the rest of the struct
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
perror("connect");
exit(1);
}
if ((numbytes=recv(sockfd, buf, MAXDATASIZE-1, 0)) == -1) {
perror("recv");
exit(1);
}
if (getpeercon(sockfd, &con)) {
perror("getpeercon");
}
buf[numbytes] = '';
printf("Received: %s from %sn",buf, con);
close(sockfd);
return 0;
}
附录B：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define MYPORT 3490 // the port users will be connecting to
#define BACKLOG 10 // how many pending connections queue will hold
void sigchld_handler(int s)
{
while(waitpid(-1, NULL, WNOHANG) > 0);
}
int main(void)
{
int sockfd, new_fd; // listen on sock_fd, new connection on new_fd
struct sockaddr_in my_addr; // my address information
struct sockaddr_in their_addr; // connector's address information
socklen_t sin_size;
struct sigaction sa;
int yes=1;
char buf[255];
socklen_t len=254;
security_context_t con = NULL;
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) {
perror("setsockopt");
exit(1);
}
my_addr.sin_family = AF_INET; // host byte order
my_addr.sin_port = htons(MYPORT); // short, network byte order作者: superadmin 时间: 2009-8-4 13:51
清除dmesg的内容，设置setenforce 1; setenforce 0，重新开始进程，首先运行setkey，然后运行audit2allow –d，将会显示：allow unconfined_t default_t:association setcontext;
这意味着unconfined_t尝试和default_t一起设置上下文，因为我们在SPD条目中使用了default_t，所以它是预期的结果，运行dmesg –c清除内核缓冲区，并尝试运行服务端和客户端（使用runcon）：
值得特别感谢的是那些为这个技术努力工作的人们，将来他们会使网络架构更安全，这些人包括：James Morris, Venkat Yekkirala, Joy Latten, Paul Moore (实现了NetLabel)等
附录A：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define PORT 3490 // the port client will be connecting to
#define MAXDATASIZE 100 // max number of bytes we can get at once
int main(int argc, char *argv[])
{
int sockfd, numbytes;
char buf[MAXDATASIZE];
struct hostent *he;
struct sockaddr_in their_addr; // connector's address information
security_context_t con = NULL;
if (argc != 2) {
fprintf(stderr,"usage: client hostnamen");
exit(1);
}
if ((he=gethostbyname(argv[1])) == NULL) { // get the host info
herror("gethostbyname");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
their_addr.sin_family = AF_INET; // host byte order
their_addr.sin_port = htons(PORT); // short, network byte order
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(their_addr.sin_zero), '', 8); // zero the rest of the struct
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
perror("connect");
exit(1);
}
if ((numbytes=recv(sockfd, buf, MAXDATASIZE-1, 0)) == -1) {
perror("recv");
exit(1);
}
if (getpeercon(sockfd, &con)) {
perror("getpeercon");
}
buf[numbytes] = '';
printf("Received: %s from %sn",buf, con);
close(sockfd);
return 0;
}
附录B：
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define MYPORT 3490 // the port users will be connecting to
#define BACKLOG 10 // how many pending connections queue will hold
void sigchld_handler(int s)
{
while(waitpid(-1, NULL, WNOHANG) > 0);
}
int main(void)
{
int sockfd, new_fd; // listen on sock_fd, new connection on new_fd
struct sockaddr_in my_addr; // my address information
struct sockaddr_in their_addr; // connector's address information
socklen_t sin_size;
struct sigaction sa;
int yes=1;
char buf[255];
socklen_t len=254;
security_context_t con = NULL;
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}
if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) {
perror("setsockopt");
exit(1);
}
my_addr.sin_family = AF_INET; // host byte order
my_addr.sin_port = htons(MYPORT); // short, network byte order
