Re: Labeled networking packets

[Paul Moore <paul.moore@hp.com>]

James Morris wrote:
> On Fri, 22 Sep 2006, Paul Moore wrote:
>>Venkat Yekkirala wrote:
>>
>>>OK, here's what we will do:
>>>
>>>1. We will have getpeercon() fail if there's no labeled-SA.
>>
>>... or NetLabel :)  What do you propose we do if there is both a SA and
>>NetLabel label, bearing in mind that NetLabel may be a full context?
> 
> I don't think we should have both of these possible for the same packet.  
> It's too complicated. 

That makes sense, what should we do in the case that we receive a packet
 on a labeled SA with a CIPSO option - drop it and send an ICMP error?
That seems like the logical solution, but I'm not sure that is one that
everyone will like.

> Remember: CIPSO is just a legacy technology which is useful for talking to 
> existing CIPSO systems.  We should not be making the rest of the code jump 
> through hoops to accomodate things it was never intended for, such as 
> integrated IPsec protection.
>
> The preferred & recommended means to implement labeled networking is via 
> the new xfrm labeling.  If you want to talk to legacy CIPSO systems the 
> way they already talk to each other, fine, but don't expect anything more 
> than that.

I stil think there may be some advantages to decoupling the labeling
from IPsec/XFRM, but following this idea right now starts getting away
from the current subject which I don't is right.  Also, since NetLabel
carrying more than a MLS label is all conjecture at this point I don't
think it's worth discussing any more than what has already been said.

The point I have been trying to make with all of this is that I think we
can find a solution where it doesn't matter if it is a full context or a
MLS-only context.  However, if we can't accomplish that, then we need to
find something that at least allows the different systems to exist on
the same machine, not necessarily the same connection.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.