Marking grammar
Status: available on main, in testifysec/connectors/internal/marking/.
A connector's --classification value is parsed by this grammar. A marking that does not parse is an error; the parser never guesses.
Vocabulary
The tokens the parser knows live in one data file,
testifysec/connectors/internal/marking/tokens.json, each with the regulation or manual it comes
from. Adding a token means adding it there with its source. This page describes the structure;
the file is the list.
Characters
The input is upper-cased and must match ^[A-Z0-9 ,/-]{1,512}$: letters, digits, space, comma,
slash and hyphen, at most 512 characters. A newline, <, . or anything else is refused.
Structure
A marking is groups separated by //. The first group is the level; the rest follow in a fixed
order, and a group may appear once.
| Order | Group | Example values | Allowed with |
|---|---|---|---|
| 0 | Level | UNCLASSIFIED, CONFIDENTIAL, SECRET, TOP SECRET, and a controlled unclassified level | always first |
| 1 | Compartments (SCI) | a control system, optionally with -SUFFIX sub-compartments | classified levels |
| 2 | Special access programs | SAR- followed by an identifier | classified levels |
| 3 | Atomic energy markings | restricted data and its variants | any |
| 4 | Foreign government information | FGI, optionally followed by country codes | any |
| 5 | Controlled unclassified categories | the categories for the controlled unclassified level | that level only |
| 6 | Dissemination controls | originator and imagery controls, foreign-release limits, proprietary | see below |
| 7 | Non-intelligence controls | limited, exclusive and no distribution, and agency-specific labels | any |
REL TO and DISPLAY ONLY lists sit in the dissemination group. Inside any other group, values
are separated by / and may come in any order; the parser prints them in a canonical order.
Below CONFIDENTIAL only the limited-dissemination controls defined for the controlled
unclassified level are allowed; a classified-only control on an unclassified marking is refused.
Release lists
REL TO lists start with USA, then ISO 3166-1 alpha-3 country codes in alphabetical order, then
coalition codes (ACGU, FVEY, NATO), which expand to their members when markings are
compared. A list may appear once. A code that exists only in another standard is refused. A
marking cannot carry both a release list and the control that forbids foreign release.
Banner form only
--classification takes the banner form only, such as SECRET//REL TO USA, FVEY. Portion marks
such as (S//REL TO USA, FVEY), abbreviated control names and retired legacy markings are
refused.
Examples
| Input | Result |
|---|---|
SECRET | parses |
SECRET//REL TO USA, FVEY | parses |
secret//rel to usa, fvey | parses; upper-cased |
CONFIDENTIAL//REL TO USA, CAN, GBR | parses |
CONFIDENTIAL//REL TO USA, GBR, CAN | refused: countries after USA must be in alphabetical order |
SECRET/REL TO USA, FVEY | refused: a single / does not separate groups |
SECRET//REL TO FVEY, USA | refused: USA must come first |
(S//REL TO USA, FVEY) | refused: portion marks are not accepted |
SECRET//REL TO USA, XYZ | refused: unknown country code |
These examples were run against the parser; SECRET dominates
SECRET//REL TO USA, FVEY and not the reverse.
Comparing markings
The rules for dominance (may data with marking B flow to a place accredited for A?) and
join (the high-water mark of two markings) are in
classification markings. In code they are
Dominates and Join in dominance.go; the Lean model in
PR #182 checks both against 441 pairs each.
Reference generated from the product documentation. Match commands and support details to your installed release.