0001 ===================================
0002 NetLabel CIPSO/IPv4 Protocol Engine
0003 ===================================
0004
0005 Paul Moore, paul.moore@hp.com
0006
0007 May 17, 2006
0008
0009 Overview
0010 ========
0011
0012 The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial
0013 IP Security Option (CIPSO) draft from July 16, 1992. A copy of this
0014 draft can be found in this directory
0015 (draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made
0016 it to an RFC standard it has become a de-facto standard for labeled
0017 networking and is used in many trusted operating systems.
0018
0019 Outbound Packet Processing
0020 ==========================
0021
0022 The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by
0023 adding the CIPSO label to the socket. This causes all packets leaving the
0024 system through the socket to have the CIPSO IP option applied. The socket's
0025 CIPSO label can be changed at any point in time, however, it is recommended
0026 that it is set upon the socket's creation. The LSM can set the socket's CIPSO
0027 label by using the NetLabel security module API; if the NetLabel "domain" is
0028 configured to use CIPSO for packet labeling then a CIPSO IP option will be
0029 generated and attached to the socket.
0030
0031 Inbound Packet Processing
0032 =========================
0033
0034 The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the
0035 IP layer without any special handling required by the LSM. However, in order
0036 to decode and translate the CIPSO label on the packet the LSM must use the
0037 NetLabel security module API to extract the security attributes of the packet.
0038 This is typically done at the socket layer using the 'socket_sock_rcv_skb()'
0039 LSM hook.
0040
0041 Label Translation
0042 =================
0043
0044 The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security
0045 attributes such as sensitivity level and category to values which are
0046 appropriate for the host. These mappings are defined as part of a CIPSO
0047 Domain Of Interpretation (DOI) definition and are configured through the
0048 NetLabel user space communication layer. Each DOI definition can have a
0049 different security attribute mapping table.
0050
0051 Label Translation Cache
0052 =======================
0053
0054 The NetLabel system provides a framework for caching security attribute
0055 mappings from the network labels to the corresponding LSM identifiers. The
0056 CIPSO/IPv4 protocol engine supports this caching mechanism.
