diff options
Diffstat (limited to 'Documentation/netlabel/cipso_ipv4.txt')
| -rw-r--r-- | Documentation/netlabel/cipso_ipv4.txt | 49 |
1 files changed, 0 insertions, 49 deletions
diff --git a/Documentation/netlabel/cipso_ipv4.txt b/Documentation/netlabel/cipso_ipv4.txt deleted file mode 100644 index a6075481fd60..000000000000 --- a/Documentation/netlabel/cipso_ipv4.txt +++ /dev/null @@ -1,49 +0,0 @@ -NetLabel CIPSO/IPv4 Protocol Engine -============================================================================== -Paul Moore, paul.moore@hp.com - -May 17, 2006 - - * Overview - -The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial -IP Security Option (CIPSO) draft from July 16, 1992. A copy of this -draft can be found in this directory -(draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made -it to an RFC standard it has become a de-facto standard for labeled -networking and is used in many trusted operating systems. - - * Outbound Packet Processing - -The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by -adding the CIPSO label to the socket. This causes all packets leaving the -system through the socket to have the CIPSO IP option applied. The socket's -CIPSO label can be changed at any point in time, however, it is recommended -that it is set upon the socket's creation. The LSM can set the socket's CIPSO -label by using the NetLabel security module API; if the NetLabel "domain" is -configured to use CIPSO for packet labeling then a CIPSO IP option will be -generated and attached to the socket. - - * Inbound Packet Processing - -The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the -IP layer without any special handling required by the LSM. However, in order -to decode and translate the CIPSO label on the packet the LSM must use the -NetLabel security module API to extract the security attributes of the packet. -This is typically done at the socket layer using the 'socket_sock_rcv_skb()' -LSM hook. - - * Label Translation - -The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security -attributes such as sensitivity level and category to values which are -appropriate for the host. These mappings are defined as part of a CIPSO -Domain Of Interpretation (DOI) definition and are configured through the -NetLabel user space communication layer. Each DOI definition can have a -different security attribute mapping table. - - * Label Translation Cache - -The NetLabel system provides a framework for caching security attribute -mappings from the network labels to the corresponding LSM identifiers. The -CIPSO/IPv4 protocol engine supports this caching mechanism. |