NetLabel CIPSO/IPv4 Protocol Engine | Linux 6.18.37

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약·해설

cipso_ipv4.rst:1-56

NetLabel CIPSO/IPv4 engine은 socket의 CIPSO label을 outbound packet의 IP option으로 적용하고, inbound option은 IP layer에서 검증한 뒤 LSM API로 security attribute를 추출합니다. Network label 값은 DOI별 mapping table을 거쳐 host identifier로 변환되며 결과를 cache할 수 있습니다.

Outbound CIPSO labeling

LSMNetLabel security-module APICIPSO DOI/domain policySocket CIPSO labelOutbound packet IP option

Domain policy가 CIPSO를 선택하면 socket 생성 시 label을 붙이고 모든 전송 packet에 적용합니다.

Inbound CIPSO 처리

Inbound IPv4 packetCIPSO IP optionIP layer 검증`socket_sock_rcv_skb()` hookNetLabel APILSM security attributes

IP layer 검증과 LSM attribute 추출의 책임을 분리합니다.

DOI 변환과 cache

CIPSO sensitivity/categoryDOI mapping tableHost security attributesLSM identifiers

Network labelNetLabel translation cacheCached LSM identifiers

Network label의 sensitivity·category를 host별 LSM identifier로 바꿉니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기

1 ===================================

2 NetLabel CIPSO/IPv4 Protocol Engine

3 ===================================

5 Paul Moore, [email protected]

7 May 17, 2006

9 Overview

10 ========

12 The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial

13 IP Security Option (CIPSO) draft from July 16, 1992. A copy of this

14 draft can be found in this directory

15 (draft-ietf-cipso-ipsecurity-01.txt). While the IETF draft never made

16 it to an RFC standard it has become a de-facto standard for labeled

17 networking and is used in many trusted operating systems.

19 Outbound Packet Processing

20 ==========================

22 The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by

23 adding the CIPSO label to the socket. This causes all packets leaving the

24 system through the socket to have the CIPSO IP option applied. The socket's

25 CIPSO label can be changed at any point in time, however, it is recommended

26 that it is set upon the socket's creation. The LSM can set the socket's CIPSO

27 label by using the NetLabel security module API; if the NetLabel "domain" is

28 configured to use CIPSO for packet labeling then a CIPSO IP option will be

29 generated and attached to the socket.

31 Inbound Packet Processing

32 =========================

34 The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the

35 IP layer without any special handling required by the LSM. However, in order

36 to decode and translate the CIPSO label on the packet the LSM must use the

37 NetLabel security module API to extract the security attributes of the packet.

38 This is typically done at the socket layer using the 'socket_sock_rcv_skb()'

39 LSM hook.

41 Label Translation

42 =================

44 The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security

45 attributes such as sensitivity level and category to values which are

46 appropriate for the host. These mappings are defined as part of a CIPSO

47 Domain Of Interpretation (DOI) definition and are configured through the

48 NetLabel user space communication layer. Each DOI definition can have a

49 different security attribute mapping table.

51 Label Translation Cache

52 =======================

54 The NetLabel system provides a framework for caching security attribute

55 mappings from the network labels to the corresponding LSM identifiers. The

56 CIPSO/IPv4 protocol engine supports this caching mechanism.

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

CIPSO/IPv4 protocol engine 개요

1-18

NetLabel CIPSO/IPv4 Protocol Engine

Paul Moore, [email protected]

2006년 5월 17일

개요

NetLabel CIPSO/IPv4 protocol engine은 1992년 7월 16일의 IETF Commercial IP Security Option(CIPSO) draft를 바탕으로 합니다. 이 directory의 `draft-ietf-cipso-ipsecurity-01.txt`에 사본이 있습니다.

이 IETF draft는 RFC 표준이 되지는 못했지만 labeled networking의 사실상 표준이 되어 많은 trusted operating system에서 사용됩니다.

===================================
NetLabel CIPSO/IPv4 Protocol Engine
===================================

Paul Moore, [email protected]

May 17, 2006

Overview
========

The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial
IP Security Option (CIPSO) draft from July 16, 1992.  A copy of this
draft can be found in this directory
(draft-ietf-cipso-ipsecurity-01.txt).  While the IETF draft never made
it to an RFC standard it has become a de-facto standard for labeled
networking and is used in many trusted operating systems.

Outbound packet 처리

19-30

CIPSO/IPv4 engine은 socket에 CIPSO label을 추가하여 packet에 CIPSO IP option을 적용합니다. 그 socket을 통해 system을 나가는 모든 packet에 option이 붙습니다.

Socket의 CIPSO label은 언제든 바꿀 수 있지만 socket 생성 시 설정하는 것이 권장됩니다. LSM은 NetLabel security-module API로 label을 설정합니다. NetLabel domain이 packet labeling에 CIPSO를 사용하도록 구성되었다면 CIPSO IP option을 생성해 socket에 연결합니다.

Outbound Packet Processing
==========================

The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by
adding the CIPSO label to the socket.  This causes all packets leaving the
system through the socket to have the CIPSO IP option applied.  The socket's
CIPSO label can be changed at any point in time, however, it is recommended
that it is set upon the socket's creation.  The LSM can set the socket's CIPSO
label by using the NetLabel security module API; if the NetLabel "domain" is
configured to use CIPSO for packet labeling then a CIPSO IP option will be
generated and attached to the socket.

Inbound packet 처리

31-40

CIPSO/IPv4 engine은 IP layer에서 발견한 모든 CIPSO IP option을 검증하며 LSM의 별도 처리가 필요하지 않습니다.

다만 packet의 CIPSO label을 decode하고 host의 security attribute로 변환하려면 LSM이 NetLabel security-module API로 packet attribute를 추출해야 합니다. 보통 socket layer의 `socket_sock_rcv_skb()` LSM hook에서 수행합니다.

Inbound Packet Processing
=========================

The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the
IP layer without any special handling required by the LSM.  However, in order
to decode and translate the CIPSO label on the packet the LSM must use the
NetLabel security module API to extract the security attributes of the packet.
This is typically done at the socket layer using the 'socket_sock_rcv_skb()'
LSM hook.

DOI 변환과 cache

41-56

Label 변환

CIPSO/IPv4 engine은 sensitivity level과 category 같은 CIPSO security attribute를 host에 맞는 값으로 변환합니다.

Mapping은 CIPSO Domain Of Interpretation(DOI) definition에 속하며 NetLabel userspace communication layer를 통해 구성합니다. DOI definition마다 서로 다른 security-attribute mapping table을 가질 수 있습니다.

Label 변환 cache

NetLabel은 network label의 security attribute와 대응 LSM identifier 사이의 mapping을 cache하는 framework를 제공합니다. CIPSO/IPv4 engine은 이 cache mechanism을 지원합니다.

Label Translation
=================

The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security
attributes such as sensitivity level and category to values which are
appropriate for the host.  These mappings are defined as part of a CIPSO
Domain Of Interpretation (DOI) definition and are configured through the
NetLabel user space communication layer.  Each DOI definition can have a
different security attribute mapping table.

Label Translation Cache
=======================

The NetLabel system provides a framework for caching security attribute
mappings from the network labels to the corresponding LSM identifiers.  The
CIPSO/IPv4 protocol engine supports this caching mechanism.