Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4c12d6c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (353 commits)
  [IPV6] ADDRCONF: Mobile IPv6 Home Address support.
  [IPV6] ADDRCONF: Allow non-DAD'able addresses.
  [IPV6] NDISC: Fix is_router flag setting.
  [IPV6] ADDRCONF: Convert addrconf_lock to RCU.
  [IPV6] NDISC: Add proxy_ndp sysctl.
  [IPV6] NDISC: Set per-entry is_router flag in Proxy NA.
  [IPV6] NDISC: Avoid updating neighbor cache for proxied address in receiving NA.
  [IPV6]: Don't forward packets to proxied link-local address.
  [IPV6] NDISC: Handle NDP messages to proxied addresses.
  [NETFILTER]: PPTP conntrack: fix another GRE keymap leak
  [NETFILTER]: PPTP conntrack: fix GRE keymap leak
  [NETFILTER]: PPTP conntrack: fix PPTP_IN_CALL message types
  [NETFILTER]: PPTP conntrack: check call ID before changing state
  [NETFILTER]: PPTP conntrack: clean up debugging cruft
  [NETFILTER]: PPTP conntrack: consolidate header parsing
  [NETFILTER]: PPTP conntrack: consolidate header size checks
  [NETFILTER]: PPTP conntrack: simplify expectation handling
  [NETFILTER]: PPTP conntrack: remove unnecessary cid/pcid header pointers
  [NETFILTER]: PPTP conntrack: fix header definitions
  [NETFILTER]: PPTP conntrack: remove more dead code
  ...
parents 73af07de 3b9f9a1c

CREDITS

+7 −0
Original line number Diff line number Diff line
@@ -2384,6 +2384,13 @@ N: Thomas Molina 
E: tmolina@cablespeed.com

D: bug fixes, documentation, minor hackery



N: Paul Moore

E: paul.moore@hp.com

D: NetLabel author

S: Hewlett-Packard

S: 110 Spit Brook Road

S: Nashua, NH 03062



N: James Morris

E: jmorris@namei.org

W: http://namei.org/

Documentation/00-INDEX

+2 −0
Original line number Diff line number Diff line
@@ -184,6 +184,8 @@ mtrr.txt 
	- how to use PPro Memory Type Range Registers to increase performance.

nbd.txt

	- info on a TCP implementation of a network block device.

netlabel/

	- directory with information on the NetLabel subsystem.

networking/

	- directory with info on various aspects of networking with Linux.

nfsroot.txt

Documentation/netlabel/00-INDEX

0 → 100644
+10 −0
Original line number Diff line number Diff line 
00-INDEX

	- this file.

cipso_ipv4.txt

	- documentation on the IPv4 CIPSO protocol engine.

draft-ietf-cipso-ipsecurity-01.txt

	- IETF draft of the CIPSO protocol, dated 16 July 1992.

introduction.txt

	- NetLabel introduction, READ THIS FIRST.

lsm_interface.txt

	- documentation on the NetLabel kernel security module API.

Documentation/netlabel/cipso_ipv4.txt

0 → 100644
+48 −0
Original line number Diff line number Diff line 
NetLabel CIPSO/IPv4 Protocol Engine

==============================================================================

Paul Moore, paul.moore@hp.com



May 17, 2006



 * Overview



The NetLabel CIPSO/IPv4 protocol engine is based on the IETF Commercial IP

Security Option (CIPSO) draft from July 16, 1992.  A copy of this draft can be

found in this directory, consult '00-INDEX' for the filename.  While the IETF

draft never made it to an RFC standard it has become a de-facto standard for

labeled networking and is used in many trusted operating systems.



 * Outbound Packet Processing



The CIPSO/IPv4 protocol engine applies the CIPSO IP option to packets by

adding the CIPSO label to the socket.  This causes all packets leaving the

system through the socket to have the CIPSO IP option applied.  The socket's

CIPSO label can be changed at any point in time, however, it is recommended

that it is set upon the socket's creation.  The LSM can set the socket's CIPSO

label by using the NetLabel security module API; if the NetLabel "domain" is

configured to use CIPSO for packet labeling then a CIPSO IP option will be

generated and attached to the socket.



 * Inbound Packet Processing



The CIPSO/IPv4 protocol engine validates every CIPSO IP option it finds at the

IP layer without any special handling required by the LSM.  However, in order

to decode and translate the CIPSO label on the packet the LSM must use the

NetLabel security module API to extract the security attributes of the packet.

This is typically done at the socket layer using the 'socket_sock_rcv_skb()'

LSM hook.



 * Label Translation



The CIPSO/IPv4 protocol engine contains a mechanism to translate CIPSO security

attributes such as sensitivity level and category to values which are

appropriate for the host.  These mappings are defined as part of a CIPSO

Domain Of Interpretation (DOI) definition and are configured through the

NetLabel user space communication layer.  Each DOI definition can have a

different security attribute mapping table.



 * Label Translation Cache



The NetLabel system provides a framework for caching security attribute

mappings from the network labels to the corresponding LSM identifiers.  The

CIPSO/IPv4 protocol engine supports this caching mechanism.

Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt

0 → 100644
+791 −0

File added.

Preview size limit exceeded, changes collapsed.