draft-ietf-cipso-ipsecurity-01.txt 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791
  1. IETF CIPSO Working Group
  2. 16 July, 1992
  3. COMMERCIAL IP SECURITY OPTION (CIPSO 2.2)
  4. 1. Status
  5. This Internet Draft provides the high level specification for a Commercial
  6. IP Security Option (CIPSO). This draft reflects the version as approved by
  7. the CIPSO IETF Working Group. Distribution of this memo is unlimited.
  8. This document is an Internet Draft. Internet Drafts are working documents
  9. of the Internet Engineering Task Force (IETF), its Areas, and its Working
  10. Groups. Note that other groups may also distribute working documents as
  11. Internet Drafts.
  12. Internet Drafts are draft documents valid for a maximum of six months.
  13. Internet Drafts may be updated, replaced, or obsoleted by other documents
  14. at any time. It is not appropriate to use Internet Drafts as reference
  15. material or to cite them other than as a "working draft" or "work in
  16. progress."
  17. Please check the I-D abstract listing contained in each Internet Draft
  18. directory to learn the current status of this or any other Internet Draft.
  19. 2. Background
  20. Currently the Internet Protocol includes two security options. One of
  21. these options is the DoD Basic Security Option (BSO) (Type 130) which allows
  22. IP datagrams to be labeled with security classifications. This option
  23. provides sixteen security classifications and a variable number of handling
  24. restrictions. To handle additional security information, such as security
  25. categories or compartments, another security option (Type 133) exists and
  26. is referred to as the DoD Extended Security Option (ESO). The values for
  27. the fixed fields within these two options are administered by the Defense
  28. Information Systems Agency (DISA).
  29. Computer vendors are now building commercial operating systems with
  30. mandatory access controls and multi-level security. These systems are
  31. no longer built specifically for a particular group in the defense or
  32. intelligence communities. They are generally available commercial systems
  33. for use in a variety of government and civil sector environments.
  34. The small number of ESO format codes can not support all the possible
  35. applications of a commercial security option. The BSO and ESO were
  36. designed to only support the United States DoD. CIPSO has been designed
  37. to support multiple security policies. This Internet Draft provides the
  38. format and procedures required to support a Mandatory Access Control
  39. security policy. Support for additional security policies shall be
  40. defined in future RFCs.
  41. Internet Draft, Expires 15 Jan 93 [PAGE 1]
  42. CIPSO INTERNET DRAFT 16 July, 1992
  43. 3. CIPSO Format
  44. Option type: 134 (Class 0, Number 6, Copy on Fragmentation)
  45. Option length: Variable
  46. This option permits security related information to be passed between
  47. systems within a single Domain of Interpretation (DOI). A DOI is a
  48. collection of systems which agree on the meaning of particular values
  49. in the security option. An authority that has been assigned a DOI
  50. identifier will define a mapping between appropriate CIPSO field values
  51. and their human readable equivalent. This authority will distribute that
  52. mapping to hosts within the authority's domain. These mappings may be
  53. sensitive, therefore a DOI authority is not required to make these
  54. mappings available to anyone other than the systems that are included in
  55. the DOI.
  56. This option MUST be copied on fragmentation. This option appears at most
  57. once in a datagram. All multi-octet fields in the option are defined to be
  58. transmitted in network byte order. The format of this option is as follows:
  59. +----------+----------+------//------+-----------//---------+
  60. | 10000110 | LLLLLLLL | DDDDDDDDDDDD | TTTTTTTTTTTTTTTTTTTT |
  61. +----------+----------+------//------+-----------//---------+
  62. TYPE=134 OPTION DOMAIN OF TAGS
  63. LENGTH INTERPRETATION
  64. Figure 1. CIPSO Format
  65. 3.1 Type
  66. This field is 1 octet in length. Its value is 134.
  67. 3.2 Length
  68. This field is 1 octet in length. It is the total length of the option
  69. including the type and length fields. With the current IP header length
  70. restriction of 40 octets the value of this field MUST not exceed 40.
  71. 3.3 Domain of Interpretation Identifier
  72. This field is an unsigned 32 bit integer. The value 0 is reserved and MUST
  73. not appear as the DOI identifier in any CIPSO option. Implementations
  74. should assume that the DOI identifier field is not aligned on any particular
  75. byte boundary.
  76. To conserve space in the protocol, security levels and categories are
  77. represented by numbers rather than their ASCII equivalent. This requires
  78. a mapping table within CIPSO hosts to map these numbers to their
  79. corresponding ASCII representations. Non-related groups of systems may
  80. Internet Draft, Expires 15 Jan 93 [PAGE 2]
  81. CIPSO INTERNET DRAFT 16 July, 1992
  82. have their own unique mappings. For example, one group of systems may
  83. use the number 5 to represent Unclassified while another group may use the
  84. number 1 to represent that same security level. The DOI identifier is used
  85. to identify which mapping was used for the values within the option.
  86. 3.4 Tag Types
  87. A common format for passing security related information is necessary
  88. for interoperability. CIPSO uses sets of "tags" to contain the security
  89. information relevant to the data in the IP packet. Each tag begins with
  90. a tag type identifier followed by the length of the tag and ends with the
  91. actual security information to be passed. All multi-octet fields in a tag
  92. are defined to be transmitted in network byte order. Like the DOI
  93. identifier field in the CIPSO header, implementations should assume that
  94. all tags, as well as fields within a tag, are not aligned on any particular
  95. octet boundary. The tag types defined in this document contain alignment
  96. bytes to assist alignment of some information, however alignment can not
  97. be guaranteed if CIPSO is not the first IP option.
  98. CIPSO tag types 0 through 127 are reserved for defining standard tag
  99. formats. Their definitions will be published in RFCs. Tag types whose
  100. identifiers are greater than 127 are defined by the DOI authority and may
  101. only be meaningful in certain Domains of Interpretation. For these tag
  102. types, implementations will require the DOI identifier as well as the tag
  103. number to determine the security policy and the format associated with the
  104. tag. Use of tag types above 127 are restricted to closed networks where
  105. interoperability with other networks will not be an issue. Implementations
  106. that support a tag type greater than 127 MUST support at least one DOI that
  107. requires only tag types 1 to 127.
  108. Tag type 0 is reserved. Tag types 1, 2, and 5 are defined in this
  109. Internet Draft. Types 3 and 4 are reserved for work in progress.
  110. The standard format for all current and future CIPSO tags is shown below:
  111. +----------+----------+--------//--------+
  112. | TTTTTTTT | LLLLLLLL | IIIIIIIIIIIIIIII |
  113. +----------+----------+--------//--------+
  114. TAG TAG TAG
  115. TYPE LENGTH INFORMATION
  116. Figure 2: Standard Tag Format
  117. In the three tag types described in this document, the length and count
  118. restrictions are based on the current IP limitation of 40 octets for all
  119. IP options. If the IP header is later expanded, then the length and count
  120. restrictions specified in this document may increase to use the full area
  121. provided for IP options.
  122. 3.4.1 Tag Type Classes
  123. Tag classes consist of tag types that have common processing requirements
  124. and support the same security policy. The three tags defined in this
  125. Internet Draft belong to the Mandatory Access Control (MAC) Sensitivity
  126. Internet Draft, Expires 15 Jan 93 [PAGE 3]
  127. CIPSO INTERNET DRAFT 16 July, 1992
  128. class and support the MAC Sensitivity security policy.
  129. 3.4.2 Tag Type 1
  130. This is referred to as the "bit-mapped" tag type. Tag type 1 is included
  131. in the MAC Sensitivity tag type class. The format of this tag type is as
  132. follows:
  133. +----------+----------+----------+----------+--------//---------+
  134. | 00000001 | LLLLLLLL | 00000000 | LLLLLLLL | CCCCCCCCCCCCCCCCC |
  135. +----------+----------+----------+----------+--------//---------+
  136. TAG TAG ALIGNMENT SENSITIVITY BIT MAP OF
  137. TYPE LENGTH OCTET LEVEL CATEGORIES
  138. Figure 3. Tag Type 1 Format
  139. 3.4.2.1 Tag Type
  140. This field is 1 octet in length and has a value of 1.
  141. 3.4.2.2 Tag Length
  142. This field is 1 octet in length. It is the total length of the tag type
  143. including the type and length fields. With the current IP header length
  144. restriction of 40 bytes the value within this field is between 4 and 34.
  145. 3.4.2.3 Alignment Octet
  146. This field is 1 octet in length and always has the value of 0. Its purpose
  147. is to align the category bitmap field on an even octet boundary. This will
  148. speed many implementations including router implementations.
  149. 3.4.2.4 Sensitivity Level
  150. This field is 1 octet in length. Its value is from 0 to 255. The values
  151. are ordered with 0 being the minimum value and 255 representing the maximum
  152. value.
  153. 3.4.2.5 Bit Map of Categories
  154. The length of this field is variable and ranges from 0 to 30 octets. This
  155. provides representation of categories 0 to 239. The ordering of the bits
  156. is left to right or MSB to LSB. For example category 0 is represented by
  157. the most significant bit of the first byte and category 15 is represented
  158. by the least significant bit of the second byte. Figure 4 graphically
  159. shows this ordering. Bit N is binary 1 if category N is part of the label
  160. for the datagram, and bit N is binary 0 if category N is not part of the
  161. label. Except for the optimized tag 1 format described in the next section,
  162. Internet Draft, Expires 15 Jan 93 [PAGE 4]
  163. CIPSO INTERNET DRAFT 16 July, 1992
  164. minimal encoding SHOULD be used resulting in no trailing zero octets in the
  165. category bitmap.
  166. octet 0 octet 1 octet 2 octet 3 octet 4 octet 5
  167. XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX . . .
  168. bit 01234567 89111111 11112222 22222233 33333333 44444444
  169. number 012345 67890123 45678901 23456789 01234567
  170. Figure 4. Ordering of Bits in Tag 1 Bit Map
  171. 3.4.2.6 Optimized Tag 1 Format
  172. Routers work most efficiently when processing fixed length fields. To
  173. support these routers there is an optimized form of tag type 1. The format
  174. does not change. The only change is to the category bitmap which is set to
  175. a constant length of 10 octets. Trailing octets required to fill out the 10
  176. octets are zero filled. Ten octets, allowing for 80 categories, was chosen
  177. because it makes the total length of the CIPSO option 20 octets. If CIPSO
  178. is the only option then the option will be full word aligned and additional
  179. filler octets will not be required.
  180. 3.4.3 Tag Type 2
  181. This is referred to as the "enumerated" tag type. It is used to describe
  182. large but sparsely populated sets of categories. Tag type 2 is in the MAC
  183. Sensitivity tag type class. The format of this tag type is as follows:
  184. +----------+----------+----------+----------+-------------//-------------+
  185. | 00000010 | LLLLLLLL | 00000000 | LLLLLLLL | CCCCCCCCCCCCCCCCCCCCCCCCCC |
  186. +----------+----------+----------+----------+-------------//-------------+
  187. TAG TAG ALIGNMENT SENSITIVITY ENUMERATED
  188. TYPE LENGTH OCTET LEVEL CATEGORIES
  189. Figure 5. Tag Type 2 Format
  190. 3.4.3.1 Tag Type
  191. This field is one octet in length and has a value of 2.
  192. 3.4.3.2 Tag Length
  193. This field is 1 octet in length. It is the total length of the tag type
  194. including the type and length fields. With the current IP header length
  195. restriction of 40 bytes the value within this field is between 4 and 34.
  196. 3.4.3.3 Alignment Octet
  197. This field is 1 octet in length and always has the value of 0. Its purpose
  198. is to align the category field on an even octet boundary. This will
  199. Internet Draft, Expires 15 Jan 93 [PAGE 5]
  200. CIPSO INTERNET DRAFT 16 July, 1992
  201. speed many implementations including router implementations.
  202. 3.4.3.4 Sensitivity Level
  203. This field is 1 octet in length. Its value is from 0 to 255. The values
  204. are ordered with 0 being the minimum value and 255 representing the
  205. maximum value.
  206. 3.4.3.5 Enumerated Categories
  207. In this tag, categories are represented by their actual value rather than
  208. by their position within a bit field. The length of each category is 2
  209. octets. Up to 15 categories may be represented by this tag. Valid values
  210. for categories are 0 to 65534. Category 65535 is not a valid category
  211. value. The categories MUST be listed in ascending order within the tag.
  212. 3.4.4 Tag Type 5
  213. This is referred to as the "range" tag type. It is used to represent
  214. labels where all categories in a range, or set of ranges, are included
  215. in the sensitivity label. Tag type 5 is in the MAC Sensitivity tag type
  216. class. The format of this tag type is as follows:
  217. +----------+----------+----------+----------+------------//-------------+
  218. | 00000101 | LLLLLLLL | 00000000 | LLLLLLLL | Top/Bottom | Top/Bottom |
  219. +----------+----------+----------+----------+------------//-------------+
  220. TAG TAG ALIGNMENT SENSITIVITY CATEGORY RANGES
  221. TYPE LENGTH OCTET LEVEL
  222. Figure 6. Tag Type 5 Format
  223. 3.4.4.1 Tag Type
  224. This field is one octet in length and has a value of 5.
  225. 3.4.4.2 Tag Length
  226. This field is 1 octet in length. It is the total length of the tag type
  227. including the type and length fields. With the current IP header length
  228. restriction of 40 bytes the value within this field is between 4 and 34.
  229. 3.4.4.3 Alignment Octet
  230. This field is 1 octet in length and always has the value of 0. Its purpose
  231. is to align the category range field on an even octet boundary. This will
  232. speed many implementations including router implementations.
  233. Internet Draft, Expires 15 Jan 93 [PAGE 6]
  234. CIPSO INTERNET DRAFT 16 July, 1992
  235. 3.4.4.4 Sensitivity Level
  236. This field is 1 octet in length. Its value is from 0 to 255. The values
  237. are ordered with 0 being the minimum value and 255 representing the maximum
  238. value.
  239. 3.4.4.5 Category Ranges
  240. A category range is a 4 octet field comprised of the 2 octet index of the
  241. highest numbered category followed by the 2 octet index of the lowest
  242. numbered category. These range endpoints are inclusive within the range of
  243. categories. All categories within a range are included in the sensitivity
  244. label. This tag may contain a maximum of 7 category pairs. The bottom
  245. category endpoint for the last pair in the tag MAY be omitted and SHOULD be
  246. assumed to be 0. The ranges MUST be non-overlapping and be listed in
  247. descending order. Valid values for categories are 0 to 65534. Category
  248. 65535 is not a valid category value.
  249. 3.4.5 Minimum Requirements
  250. A CIPSO implementation MUST be capable of generating at least tag type 1 in
  251. the non-optimized form. In addition, a CIPSO implementation MUST be able
  252. to receive any valid tag type 1 even those using the optimized tag type 1
  253. format.
  254. 4. Configuration Parameters
  255. The configuration parameters defined below are required for all CIPSO hosts,
  256. gateways, and routers that support multiple sensitivity labels. A CIPSO
  257. host is defined to be the origination or destination system for an IP
  258. datagram. A CIPSO gateway provides IP routing services between two or more
  259. IP networks and may be required to perform label translations between
  260. networks. A CIPSO gateway may be an enhanced CIPSO host or it may just
  261. provide gateway services with no end system CIPSO capabilities. A CIPSO
  262. router is a dedicated IP router that routes IP datagrams between two or more
  263. IP networks.
  264. An implementation of CIPSO on a host MUST have the capability to reject a
  265. datagram for reasons that the information contained can not be adequately
  266. protected by the receiving host or if acceptance may result in violation of
  267. the host or network security policy. In addition, a CIPSO gateway or router
  268. MUST be able to reject datagrams going to networks that can not provide
  269. adequate protection or may violate the network's security policy. To
  270. provide this capability the following minimal set of configuration
  271. parameters are required for CIPSO implementations:
  272. HOST_LABEL_MAX - This parameter contains the maximum sensitivity label that
  273. a CIPSO host is authorized to handle. All datagrams that have a label
  274. greater than this maximum MUST be rejected by the CIPSO host. This
  275. parameter does not apply to CIPSO gateways or routers. This parameter need
  276. not be defined explicitly as it can be implicitly derived from the
  277. PORT_LABEL_MAX parameters for the associated interfaces.
  278. Internet Draft, Expires 15 Jan 93 [PAGE 7]
  279. CIPSO INTERNET DRAFT 16 July, 1992
  280. HOST_LABEL_MIN - This parameter contains the minimum sensitivity label that
  281. a CIPSO host is authorized to handle. All datagrams that have a label less
  282. than this minimum MUST be rejected by the CIPSO host. This parameter does
  283. not apply to CIPSO gateways or routers. This parameter need not be defined
  284. explicitly as it can be implicitly derived from the PORT_LABEL_MIN
  285. parameters for the associated interfaces.
  286. PORT_LABEL_MAX - This parameter contains the maximum sensitivity label for
  287. all datagrams that may exit a particular network interface port. All
  288. outgoing datagrams that have a label greater than this maximum MUST be
  289. rejected by the CIPSO system. The label within this parameter MUST be
  290. less than or equal to the label within the HOST_LABEL_MAX parameter. This
  291. parameter does not apply to CIPSO hosts that support only one network port.
  292. PORT_LABEL_MIN - This parameter contains the minimum sensitivity label for
  293. all datagrams that may exit a particular network interface port. All
  294. outgoing datagrams that have a label less than this minimum MUST be
  295. rejected by the CIPSO system. The label within this parameter MUST be
  296. greater than or equal to the label within the HOST_LABEL_MIN parameter.
  297. This parameter does not apply to CIPSO hosts that support only one network
  298. port.
  299. PORT_DOI - This parameter is used to assign a DOI identifier value to a
  300. particular network interface port. All CIPSO labels within datagrams
  301. going out this port MUST use the specified DOI identifier. All CIPSO
  302. hosts and gateways MUST support either this parameter, the NET_DOI
  303. parameter, or the HOST_DOI parameter.
  304. NET_DOI - This parameter is used to assign a DOI identifier value to a
  305. particular IP network address. All CIPSO labels within datagrams destined
  306. for the particular IP network MUST use the specified DOI identifier. All
  307. CIPSO hosts and gateways MUST support either this parameter, the PORT_DOI
  308. parameter, or the HOST_DOI parameter.
  309. HOST_DOI - This parameter is used to assign a DOI identifier value to a
  310. particular IP host address. All CIPSO labels within datagrams destined for
  311. the particular IP host will use the specified DOI identifier. All CIPSO
  312. hosts and gateways MUST support either this parameter, the PORT_DOI
  313. parameter, or the NET_DOI parameter.
  314. This list represents the minimal set of configuration parameters required
  315. to be compliant. Implementors are encouraged to add to this list to
  316. provide enhanced functionality and control. For example, many security
  317. policies may require both incoming and outgoing datagrams be checked against
  318. the port and host label ranges.
  319. 4.1 Port Range Parameters
  320. The labels represented by the PORT_LABEL_MAX and PORT_LABEL_MIN parameters
  321. MAY be in CIPSO or local format. Some CIPSO systems, such as routers, may
  322. want to have the range parameters expressed in CIPSO format so that incoming
  323. labels do not have to be converted to a local format before being compared
  324. against the range. If multiple DOIs are supported by one of these CIPSO
  325. Internet Draft, Expires 15 Jan 93 [PAGE 8]
  326. CIPSO INTERNET DRAFT 16 July, 1992
  327. systems then multiple port range parameters would be needed, one set for
  328. each DOI supported on a particular port.
  329. The port range will usually represent the total set of labels that may
  330. exist on the logical network accessed through the corresponding network
  331. interface. It may, however, represent a subset of these labels that are
  332. allowed to enter the CIPSO system.
  333. 4.2 Single Label CIPSO Hosts
  334. CIPSO implementations that support only one label are not required to
  335. support the parameters described above. These limited implementations are
  336. only required to support a NET_LABEL parameter. This parameter contains
  337. the CIPSO label that may be inserted in datagrams that exit the host. In
  338. addition, the host MUST reject any incoming datagram that has a label which
  339. is not equivalent to the NET_LABEL parameter.
  340. 5. Handling Procedures
  341. This section describes the processing requirements for incoming and
  342. outgoing IP datagrams. Just providing the correct CIPSO label format
  343. is not enough. Assumptions will be made by one system on how a
  344. receiving system will handle the CIPSO label. Wrong assumptions may
  345. lead to non-interoperability or even a security incident. The
  346. requirements described below represent the minimal set needed for
  347. interoperability and that provide users some level of confidence.
  348. Many other requirements could be added to increase user confidence,
  349. however at the risk of restricting creativity and limiting vendor
  350. participation.
  351. 5.1 Input Procedures
  352. All datagrams received through a network port MUST have a security label
  353. associated with them, either contained in the datagram or assigned to the
  354. receiving port. Without this label the host, gateway, or router will not
  355. have the information it needs to make security decisions. This security
  356. label will be obtained from the CIPSO if the option is present in the
  357. datagram. See section 4.1.2 for handling procedures for unlabeled
  358. datagrams. This label will be compared against the PORT (if appropriate)
  359. and HOST configuration parameters defined in section 3.
  360. If any field within the CIPSO option, such as the DOI identifier, is not
  361. recognized the IP datagram is discarded and an ICMP "parameter problem"
  362. (type 12) is generated and returned. The ICMP code field is set to "bad
  363. parameter" (code 0) and the pointer is set to the start of the CIPSO field
  364. that is unrecognized.
  365. If the contents of the CIPSO are valid but the security label is
  366. outside of the configured host or port label range, the datagram is
  367. discarded and an ICMP "destination unreachable" (type 3) is generated
  368. and returned. The code field of the ICMP is set to "communication with
  369. destination network administratively prohibited" (code 9) or to
  370. Internet Draft, Expires 15 Jan 93 [PAGE 9]
  371. CIPSO INTERNET DRAFT 16 July, 1992
  372. "communication with destination host administratively prohibited"
  373. (code 10). The value of the code field used is dependent upon whether
  374. the originator of the ICMP message is acting as a CIPSO host or a CIPSO
  375. gateway. The recipient of the ICMP message MUST be able to handle either
  376. value. The same procedure is performed if a CIPSO can not be added to an
  377. IP packet because it is too large to fit in the IP options area.
  378. If the error is triggered by receipt of an ICMP message, the message
  379. is discarded and no response is permitted (consistent with general ICMP
  380. processing rules).
  381. 5.1.1 Unrecognized tag types
  382. The default condition for any CIPSO implementation is that an
  383. unrecognized tag type MUST be treated as a "parameter problem" and
  384. handled as described in section 4.1. A CIPSO implementation MAY allow
  385. the system administrator to identify tag types that may safely be
  386. ignored. This capability is an allowable enhancement, not a
  387. requirement.
  388. 5.1.2 Unlabeled Packets
  389. A network port may be configured to not require a CIPSO label for all
  390. incoming datagrams. For this configuration a CIPSO label must be
  391. assigned to that network port and associated with all unlabeled IP
  392. datagrams. This capability might be used for single level networks or
  393. networks that have CIPSO and non-CIPSO hosts and the non-CIPSO hosts
  394. all operate at the same label.
  395. If a CIPSO option is required and none is found, the datagram is
  396. discarded and an ICMP "parameter problem" (type 12) is generated and
  397. returned to the originator of the datagram. The code field of the ICMP
  398. is set to "option missing" (code 1) and the ICMP pointer is set to 134
  399. (the value of the option type for the missing CIPSO option).
  400. 5.2 Output Procedures
  401. A CIPSO option MUST appear only once in a datagram. Only one tag type
  402. from the MAC Sensitivity class MAY be included in a CIPSO option. Given
  403. the current set of defined tag types, this means that CIPSO labels at
  404. first will contain only one tag.
  405. All datagrams leaving a CIPSO system MUST meet the following condition:
  406. PORT_LABEL_MIN <= CIPSO label <= PORT_LABEL_MAX
  407. If this condition is not satisfied the datagram MUST be discarded.
  408. If the CIPSO system only supports one port, the HOST_LABEL_MIN and the
  409. HOST_LABEL_MAX parameters MAY be substituted for the PORT parameters in
  410. the above condition.
  411. The DOI identifier to be used for all outgoing datagrams is configured by
  412. Internet Draft, Expires 15 Jan 93 [PAGE 10]
  413. CIPSO INTERNET DRAFT 16 July, 1992
  414. the administrator. If port level DOI identifier assignment is used, then
  415. the PORT_DOI configuration parameter MUST contain the DOI identifier to
  416. use. If network level DOI assignment is used, then the NET_DOI parameter
  417. MUST contain the DOI identifier to use. And if host level DOI assignment
  418. is employed, then the HOST_DOI parameter MUST contain the DOI identifier
  419. to use. A CIPSO implementation need only support one level of DOI
  420. assignment.
  421. 5.3 DOI Processing Requirements
  422. A CIPSO implementation MUST support at least one DOI and SHOULD support
  423. multiple DOIs. System and network administrators are cautioned to
  424. ensure that at least one DOI is common within an IP network to allow for
  425. broadcasting of IP datagrams.
  426. CIPSO gateways MUST be capable of translating a CIPSO option from one
  427. DOI to another when forwarding datagrams between networks. For
  428. efficiency purposes this capability is only a desired feature for CIPSO
  429. routers.
  430. 5.4 Label of ICMP Messages
  431. The CIPSO label to be used on all outgoing ICMP messages MUST be equivalent
  432. to the label of the datagram that caused the ICMP message. If the ICMP was
  433. generated due to a problem associated with the original CIPSO label then the
  434. following responses are allowed:
  435. a. Use the CIPSO label of the original IP datagram
  436. b. Drop the original datagram with no return message generated
  437. In most cases these options will have the same effect. If you can not
  438. interpret the label or if it is outside the label range of your host or
  439. interface then an ICMP message with the same label will probably not be
  440. able to exit the system.
  441. 6. Assignment of DOI Identifier Numbers =
  442. Requests for assignment of a DOI identifier number should be addressed to
  443. the Internet Assigned Numbers Authority (IANA).
  444. 7. Acknowledgements
  445. Much of the material in this RFC is based on (and copied from) work
  446. done by Gary Winiger of Sun Microsystems and published as Commercial
  447. IP Security Option at the INTEROP 89, Commercial IPSO Workshop.
  448. 8. Author's Address
  449. To submit mail for distribution to members of the IETF CIPSO Working
  450. Group, send mail to: cipso@wdl1.wdl.loral.com.
  451. Internet Draft, Expires 15 Jan 93 [PAGE 11]
  452. CIPSO INTERNET DRAFT 16 July, 1992
  453. To be added to or deleted from this distribution, send mail to:
  454. cipso-request@wdl1.wdl.loral.com.
  455. 9. References
  456. RFC 1038, "Draft Revised IP Security Option", M. St. Johns, IETF, January
  457. 1988.
  458. RFC 1108, "U.S. Department of Defense Security Options
  459. for the Internet Protocol", Stephen Kent, IAB, 1 March, 1991.
  460. Internet Draft, Expires 15 Jan 93 [PAGE 12]