[PATCH] network_support: Update LibreSwan configuration

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Update ipsec.conf file that describes the labeled ipsec entries.

Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx>
---
This was used to test the updated LibreSwan that now supports
selinux_check_access(3) from https://github.com/libreswan/libreswan

 src/network_support.md | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/src/network_support.md b/src/network_support.md
index 36af1f4..4a3fd38 100644
--- a/src/network_support.md
+++ b/src/network_support.md
@@ -452,11 +452,45 @@ Context type identifier has never been defined in any standard. Pluto is
 configurable and defaults to '*32001*', this is the IPSEC Security
 Association Attribute identifier reserved for private use. Racoon is
 hard coded to a value of '*10*', therefore the pluto ***ipsec.conf**(5)*
-file must be configured as follows:
+configuration file *secctx-attr-type* entry must be set as shown in the
+following example:
 
 ```
 config setup
-        secctx-attr-type=10
+	protostack=netkey
+	plutodebug=all
+	logfile=/var/log/pluto/pluto.log
+	logappend=no
+	# A "secctx-attr-type" MUST be present:
+	secctx-attr-type=10
+	# Labeled IPSEC only supports the following values:
+	#   10 = ECN_TUNNEL - Used by racoon(8)
+	#   32001 = Default - Reserved for private use (see RFC 2407)
+	# These are the "IPSEC Security Association Attributes"
+
+conn selinux_labeled_ipsec_test
+	# ikev2 MUST be "no" as labeled ipsec is not yet supported by IKEV2
+	# There is a draft IKEV2 labeled ipsec document (July '20) at:
+	#   https://tools.ietf.org/html/draft-ietf-ipsecme-labeled-ipsec-03
+	ikev2=no
+	auto=start
+	rekey=no
+	authby=secret # set in '/etc/ipsec.secrets'
+	type=transport
+	left=192.168.1.198
+	right=192.168.1.148
+	ike=3des-sha1
+	phase2=esp
+	phase2alg=3des-sha1
+	# The 'policy-label' entry is used to determine whether SELinux will
+	# allow or deny the request using the labels from:
+	#   connection policy label from the applicable SAD entry
+	#   connection flow label from the applicable SPD entry (this is taken
+	#   from the 'conn <name> policy-label' entry).
+	# selinux_check_access(SAD, SPD, "association", "polmatch", NULL);
+	policy-label=system_u:object_r:ipsec_spd_t:s0
+	leftprotoport=tcp
+	rightprotoport=tcp
 ```
 
 The Fedora version of racoon has added functionality to support
-- 
2.26.2




[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux