forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
2.3 KiB
56 lines
2.3 KiB
=================================== |
|
NetLabel CIPSO/IPv4 Protocol Engine |
|
=================================== |
|
|
|
Paul Moore, [email protected] |
|
|
|
May 17, 2006 |
|
|
|
Overview |
|
======== |
|
|
|
The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial |
|
IP Security Option (CIPSO) draft from July 16, 1992. A copy of this |
|
draft can be found in this directory |
|
(draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made |
|
it to an RFC standard it has become a de-facto standard for labeled |
|
networking and is used in many trusted operating systems. |
|
|
|
Outbound Packet Processing |
|
========================== |
|
|
|
The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by |
|
adding the CIPSO label to the socket. This causes all packets leaving the |
|
system through the socket to have the CIPSO IP option applied. The socket's |
|
CIPSO label can be changed at any point in time, however, it is recommended |
|
that it is set upon the socket's creation. The LSM can set the socket's CIPSO |
|
label by using the NetLabel security module API; if the NetLabel "domain" is |
|
configured to use CIPSO for packet labeling then a CIPSO IP option will be |
|
generated and attached to the socket. |
|
|
|
Inbound Packet Processing |
|
========================= |
|
|
|
The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the |
|
IP layer without any special handling required by the LSM. However, in order |
|
to decode and translate the CIPSO label on the packet the LSM must use the |
|
NetLabel security module API to extract the security attributes of the packet. |
|
This is typically done at the socket layer using the 'socket_sock_rcv_skb()' |
|
LSM hook. |
|
|
|
Label Translation |
|
================= |
|
|
|
The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security |
|
attributes such as sensitivity level and category to values which are |
|
appropriate for the host. These mappings are defined as part of a CIPSO |
|
Domain Of Interpretation (DOI) definition and are configured through the |
|
NetLabel user space communication layer. Each DOI definition can have a |
|
different security attribute mapping table. |
|
|
|
Label Translation Cache |
|
======================= |
|
|
|
The NetLabel system provides a framework for caching security attribute |
|
mappings from the network labels to the corresponding LSM identifiers. The |
|
CIPSO/IPv4 protocol engine supports this caching mechanism.
|
|
|