| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556 |
- ===================================
- NetLabel CIPSO/IPv4 Protocol Engine
- ===================================
- Paul Moore, [email protected]
- May 17, 2006
- Overview
- ========
- The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial
- IP Security Option (CIPSO) draft from July 16, 1992. A copy of this
- draft can be found in this directory
- (draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made
- it to an RFC standard it has become a de-facto standard for labeled
- networking and is used in many trusted operating systems.
- Outbound Packet Processing
- ==========================
- The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by
- adding the CIPSO label to the socket. This causes all packets leaving the
- system through the socket to have the CIPSO IP option applied. The socket's
- CIPSO label can be changed at any point in time, however, it is recommended
- that it is set upon the socket's creation. The LSM can set the socket's CIPSO
- label by using the NetLabel security module API; if the NetLabel "domain" is
- configured to use CIPSO for packet labeling then a CIPSO IP option will be
- generated and attached to the socket.
- Inbound Packet Processing
- =========================
- The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the
- IP layer without any special handling required by the LSM. However, in order
- to decode and translate the CIPSO label on the packet the LSM must use the
- NetLabel security module API to extract the security attributes of the packet.
- This is typically done at the socket layer using the 'socket_sock_rcv_skb()'
- LSM hook.
- Label Translation
- =================
- The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security
- attributes such as sensitivity level and category to values which are
- appropriate for the host. These mappings are defined as part of a CIPSO
- Domain Of Interpretation (DOI) definition and are configured through the
- NetLabel user space communication layer. Each DOI definition can have a
- different security attribute mapping table.
- Label Translation Cache
- =======================
- The NetLabel system provides a framework for caching security attribute
- mappings from the network labels to the corresponding LSM identifiers. The
- CIPSO/IPv4 protocol engine supports this caching mechanism.
|
