Subject: Re: [nfsv4] WG last call for Registry Specification for MAC Security Label Formats

From: RJ Atkinson <[email-masked]>
Date: Tue, 16 Sep 2014 15:48:17 -0400

On 29  Aug 2014, at 17:51 , Tom Haynes wrote:
>> Section 4:   IPSO (RFC-1108)
>> 
>> Section 4 also should cite and discuss RFC-1108 (IPSO), which remains 
>> the most widely implemented IPv4 security option and remains in widespread 
>> deployment.
> 
> Okay
> 
>> Also, IPSO should be allocated a "Label Format Selector" 
>> in the Initial Registry of Section 6.1.
> 
> Done
> 
>> 
>> To the best of my knowledge, IPSO is the *only* IP label option that
>> is supported by very widely deployed commercial IP routers.  The
>> router-based interface-oriented IPSO ACL support makes IPSO desirable
>> in a number of existing (both long-standing and recent) MLS network
>> deployments.  Cisco IOS has supported IPSO-based packet filtering for 
>> ~2 decades and still supports that today).  (Aside: CALIPSO was designed 
>> to be practical to implement even in ASIC/FPGA-based IP routers; CIPSO 
>> is completely hopeless in this regard because of the complexity of the 
>> CIPSO option parsing.)
>> 
>> If desired, I can supply a brief paragraph describing IPSO as candidate
>> new text for Section 4.
> 
> Please, that would be appreciated.

Tom,

Candidate new text for the IPSO portion of Section 4 follows,
please edit to taste:

       4.x   IP Security Option (IPSO), Basic Security Option (BSO)

               The "IP Security Option (IPSO)" label format is
               defined in RFC-1108.  IANA has assigned IPv4 Option
               130 to the IPSO Basic Security Option (BSO).  IPSO is 
               the only IPv4 sensitivity label option implemented in 
               commercial IP routers.  IPSO BSO continues to have 
               widespread implementation in hosts, and widespread 
               deployment.  For the purposes of this I-D, only the 
               BSO labels in Table 1 on Page 3 of RFC-1108 are used.
               
               In some locales, the BSO value "(Reserved 2)" is used 
               for marking information that is considered "Restricted" 
               by local policy, where "Restricted" is less sensitive
               than "Confidential" but more sensitive than "Unclassified".

My apologies for the tardy response.  I hope this is useful.

(Aside: I don't see how the IPSO Extended Security Option (ESO) 
would be useful in the context of labelled NFS, but perhaps I've 
overlooked something.  I am quite happy to be educated.)

Yours,

Ran Atkinson

---

From: Thomas Haynes <[email-masked]>
Date: Tue, 16 Sep 2014 16:19:34 -0400

Hi Ran,

Thanks for the help.

I've pushed a new version of the I-D with your earlier comments and the
ones from Dave Noveck.

I'd appreciate if you could confirm I have addressed your comments
sufficiently.

Thanks,
Tom

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 17 Sep 2014 21:03:00 -0400

> I'd appreciate if you could confirm I have addressed your comments

The updated draft seems fine to me.
Thank you very much.

Ran