Lines Matching refs:the
12 This Internet Draft provides the high level specification for a Commercial
13 IP Security Option (CIPSO). This draft reflects the version as approved by
14 the CIPSO IETF Working Group. Distribution of this memo is unlimited.
17 of the Internet Engineering Task Force (IETF), its Areas, and its Working
27 Please check the I-D abstract listing contained in each Internet Draft
28 directory to learn the current status of this or any other Internet Draft.
35 Currently the Internet Protocol includes two security options. One of
36 these options is the DoD Basic Security Option (BSO) (Type 130) which allows
41 is referred to as the DoD Extended Security Option (ESO). The values for
42 the fixed fields within these two options are administered by the Defense
47 no longer built specifically for a particular group in the defense or
51 The small number of ESO format codes can not support all the possible
53 designed to only support the United States DoD. CIPSO has been designed
54 to support multiple security policies. This Internet Draft provides the
78 collection of systems which agree on the meaning of particular values
79 in the security option. An authority that has been assigned a DOI
82 mapping to hosts within the authority's domain. These mappings may be
84 mappings available to anyone other than the systems that are included in
85 the DOI.
88 once in a datagram. All multi-octet fields in the option are defined to be
109 This field is 1 octet in length. It is the total length of the option
110 including the type and length fields. With the current IP header length
111 restriction of 40 octets the value of this field MUST not exceed 40.
117 not appear as the DOI identifier in any CIPSO option. Implementations
118 should assume that the DOI identifier field is not aligned on any particular
121 To conserve space in the protocol, security levels and categories are
137 use the number 5 to represent Unclassified while another group may use the
139 to identify which mapping was used for the values within the option.
145 for interoperability. CIPSO uses sets of "tags" to contain the security
146 information relevant to the data in the IP packet. Each tag begins with
147 a tag type identifier followed by the length of the tag and ends with the
149 are defined to be transmitted in network byte order. Like the DOI
150 identifier field in the CIPSO header, implementations should assume that
154 be guaranteed if CIPSO is not the first IP option.
158 identifiers are greater than 127 are defined by the DOI authority and may
160 types, implementations will require the DOI identifier as well as the tag
161 number to determine the security policy and the format associated with the
179 In the three tag types described in this document, the length and count
180 restrictions are based on the current IP limitation of 40 octets for all
181 IP options. If the IP header is later expanded, then the length and count
182 restrictions specified in this document may increase to use the full area
189 and support the same security policy. The three tags defined in this
190 Internet Draft belong to the Mandatory Access Control (MAC) Sensitivity
202 class and support the MAC Sensitivity security policy.
207 This is referred to as the "bit-mapped" tag type. Tag type 1 is included
208 in the MAC Sensitivity tag type class. The format of this tag type is as
228 This field is 1 octet in length. It is the total length of the tag type
229 including the type and length fields. With the current IP header length
230 restriction of 40 bytes the value within this field is between 4 and 34.
235 This field is 1 octet in length and always has the value of 0. Its purpose
236 is to align the category bitmap field on an even octet boundary. This will
243 are ordered with 0 being the minimum value and 255 representing the maximum
250 provides representation of categories 0 to 239. The ordering of the bits
252 the most significant bit of the first byte and category 15 is represented
253 by the least significant bit of the second byte. Figure 4 graphically
254 shows this ordering. Bit N is binary 1 if category N is part of the label
255 for the datagram, and bit N is binary 0 if category N is not part of the
256 label. Except for the optimized tag 1 format described in the next section,
268 minimal encoding SHOULD be used resulting in no trailing zero octets in the
283 does not change. The only change is to the category bitmap which is set to
284 a constant length of 10 octets. Trailing octets required to fill out the 10
286 because it makes the total length of the CIPSO option 20 octets. If CIPSO
287 is the only option then the option will be full word aligned and additional
293 This is referred to as the "enumerated" tag type. It is used to describe
294 large but sparsely populated sets of categories. Tag type 2 is in the MAC
314 This field is 1 octet in length. It is the total length of the tag type
315 including the type and length fields. With the current IP header length
316 restriction of 40 bytes the value within this field is between 4 and 34.
321 This field is 1 octet in length and always has the value of 0. Its purpose
322 is to align the category field on an even octet boundary. This will
340 are ordered with 0 being the minimum value and 255 representing the
350 value. The categories MUST be listed in ascending order within the tag.
355 This is referred to as the "range" tag type. It is used to represent
357 in the sensitivity label. Tag type 5 is in the MAC Sensitivity tag type
377 This field is 1 octet in length. It is the total length of the tag type
378 including the type and length fields. With the current IP header length
379 restriction of 40 bytes the value within this field is between 4 and 34.
384 This field is 1 octet in length and always has the value of 0. Its purpose
385 is to align the category range field on an even octet boundary. This will
403 are ordered with 0 being the minimum value and 255 representing the maximum
409 A category range is a 4 octet field comprised of the 2 octet index of the
410 highest numbered category followed by the 2 octet index of the lowest
411 numbered category. These range endpoints are inclusive within the range of
412 categories. All categories within a range are included in the sensitivity
414 category endpoint for the last pair in the tag MAY be omitted and SHOULD be
423 the non-optimized form. In addition, a CIPSO implementation MUST be able
424 to receive any valid tag type 1 even those using the optimized tag type 1
432 host is defined to be the origination or destination system for an IP
440 An implementation of CIPSO on a host MUST have the capability to reject a
441 datagram for reasons that the information contained can not be adequately
442 protected by the receiving host or if acceptance may result in violation of
443 the host or network security policy. In addition, a CIPSO gateway or router
445 adequate protection or may violate the network's security policy. To
446 provide this capability the following minimal set of configuration
449 HOST_LABEL_MAX - This parameter contains the maximum sensitivity label that
451 greater than this maximum MUST be rejected by the CIPSO host. This
453 not be defined explicitly as it can be implicitly derived from the
454 PORT_LABEL_MAX parameters for the associated interfaces.
467 HOST_LABEL_MIN - This parameter contains the minimum sensitivity label that
469 than this minimum MUST be rejected by the CIPSO host. This parameter does
471 explicitly as it can be implicitly derived from the PORT_LABEL_MIN
472 parameters for the associated interfaces.
474 PORT_LABEL_MAX - This parameter contains the maximum sensitivity label for
477 rejected by the CIPSO system. The label within this parameter MUST be
478 less than or equal to the label within the HOST_LABEL_MAX parameter. This
481 PORT_LABEL_MIN - This parameter contains the minimum sensitivity label for
484 rejected by the CIPSO system. The label within this parameter MUST be
485 greater than or equal to the label within the HOST_LABEL_MIN parameter.
491 going out this port MUST use the specified DOI identifier. All CIPSO
492 hosts and gateways MUST support either this parameter, the NET_DOI
493 parameter, or the HOST_DOI parameter.
497 for the particular IP network MUST use the specified DOI identifier. All
498 CIPSO hosts and gateways MUST support either this parameter, the PORT_DOI
499 parameter, or the HOST_DOI parameter.
503 the particular IP host will use the specified DOI identifier. All CIPSO
504 hosts and gateways MUST support either this parameter, the PORT_DOI
505 parameter, or the NET_DOI parameter.
507 This list represents the minimal set of configuration parameters required
511 the port and host label ranges.
516 The labels represented by the PORT_LABEL_MAX and PORT_LABEL_MIN parameters
518 want to have the range parameters expressed in CIPSO format so that incoming
520 against the range. If multiple DOIs are supported by one of these CIPSO
535 The port range will usually represent the total set of labels that may
536 exist on the logical network accessed through the corresponding network
538 allowed to enter the CIPSO system.
544 support the parameters described above. These limited implementations are
546 the CIPSO label that may be inserted in datagrams that exit the host. In
547 addition, the host MUST reject any incoming datagram that has a label which
548 is not equivalent to the NET_LABEL parameter.
553 This section describes the processing requirements for incoming and
554 outgoing IP datagrams. Just providing the correct CIPSO label format
556 receiving system will handle the CIPSO label. Wrong assumptions may
558 requirements described below represent the minimal set needed for
561 however at the risk of restricting creativity and limiting vendor
568 associated with them, either contained in the datagram or assigned to the
569 receiving port. Without this label the host, gateway, or router will not
570 have the information it needs to make security decisions. This security
571 label will be obtained from the CIPSO if the option is present in the
573 datagrams. This label will be compared against the PORT (if appropriate)
576 If any field within the CIPSO option, such as the DOI identifier, is not
577 recognized the IP datagram is discarded and an ICMP "parameter problem"
579 parameter" (code 0) and the pointer is set to the start of the CIPSO field
582 If the contents of the CIPSO are valid but the security label is
583 outside of the configured host or port label range, the datagram is
585 and returned. The code field of the ICMP is set to "communication with
599 (code 10). The value of the code field used is dependent upon whether
600 the originator of the ICMP message is acting as a CIPSO host or a CIPSO
601 gateway. The recipient of the ICMP message MUST be able to handle either
603 IP packet because it is too large to fit in the IP options area.
605 If the error is triggered by receipt of an ICMP message, the message
615 the system administrator to identify tag types that may safely be
626 networks that have CIPSO and non-CIPSO hosts and the non-CIPSO hosts
627 all operate at the same label.
629 If a CIPSO option is required and none is found, the datagram is
631 returned to the originator of the datagram. The code field of the ICMP
632 is set to "option missing" (code 1) and the ICMP pointer is set to 134
633 (the value of the option type for the missing CIPSO option).
639 from the MAC Sensitivity class MAY be included in a CIPSO option. Given
640 the current set of defined tag types, this means that CIPSO labels at
643 All datagrams leaving a CIPSO system MUST meet the following condition:
647 If this condition is not satisfied the datagram MUST be discarded.
648 If the CIPSO system only supports one port, the HOST_LABEL_MIN and the
649 HOST_LABEL_MAX parameters MAY be substituted for the PORT parameters in
650 the above condition.
664 the administrator. If port level DOI identifier assignment is used, then
665 the PORT_DOI configuration parameter MUST contain the DOI identifier to
666 use. If network level DOI assignment is used, then the NET_DOI parameter
667 MUST contain the DOI identifier to use. And if host level DOI assignment
668 is employed, then the HOST_DOI parameter MUST contain the DOI identifier
689 to the label of the datagram that caused the ICMP message. If the ICMP was
690 generated due to a problem associated with the original CIPSO label then the
693 a. Use the CIPSO label of the original IP datagram
694 b. Drop the original datagram with no return message generated
696 In most cases these options will have the same effect. If you can not
697 interpret the label or if it is outside the label range of your host or
698 interface then an ICMP message with the same label will probably not be
699 able to exit the system.
705 the Internet Assigned Numbers Authority (IANA).
710 Much of the material in this RFC is based on (and copied from) work
712 IP Security Option at the INTEROP 89, Commercial IPSO Workshop.
717 To submit mail for distribution to members of the IETF CIPSO Working
741 for the Internet Protocol", Stephen Kent, IAB, 1 March, 1991.