Commit 1d2fe8dd authored by Brickner_cp's avatar Brickner_cp

Security Option upgraded to RFC 1108.

parent 90639a7b
......@@ -50,32 +50,16 @@ namespace PcapDotNet.Core.Test
case IpV4OptionType.Security:
IpV4OptionSecurity securityOption = (IpV4OptionSecurity)option;
switch (securityOption.Level)
switch (securityOption.ClassificationLevel)
{
case IpV4OptionSecurityLevel.EncryptedForTransmissionOnly:
yield return "Security: EFTO";
break;
case IpV4OptionSecurityLevel.Mmmm:
yield return "Security: " + securityOption.Level.ToString().ToUpper();
break;
case IpV4OptionSecurityLevel.TopSecret:
yield return "Security: Top secret";
break;
case IpV4OptionSecurityLevel.Prog:
yield return "Security: Unknown (0x" + ((ushort)securityOption.Level).ToString("x4") + ")";
break;
default:
yield return "Security: " + securityOption.Level;
yield return "Security: " + securityOption.ClassificationLevel;
break;
}
yield return "Compartments: " + securityOption.Compartments;
yield return "Handling restrictions: ";
yield return "Transmission control code: ";
// yield return "Compartments: " + securityOption.Compartments;
// yield return "Handling restrictions: ";
// yield return "Transmission control code: ";
break;
case IpV4OptionType.LooseSourceRouting:
......
......@@ -308,18 +308,10 @@ namespace PcapDotNet.Core.Test
break;
}
IpV4Option option = options[currentOptionIndex++];
if (option.OptionType == IpV4OptionType.Security)
continue; // Wireshark doesn't support
field.AssertShow(option.GetWiresharkString());
var optionShows = field.Fields().Select(
delegate(XElement optionField)
{
string optionFieldShow = optionField.Show();
if (optionFieldShow.StartsWith("Handling restrictions: "))
optionFieldShow = "Handling restrictions: ";
else if (optionFieldShow.StartsWith("Transmission control code: "))
optionFieldShow = "Transmission control code: ";
return optionFieldShow;
});
var optionShows = from f in field.Fields() select f.Show();
Assert.IsTrue(optionShows.SequenceEqual(option.GetWiresharkSubfieldStrings()));
}
......
......@@ -169,18 +169,6 @@ namespace PcapDotNet.Packets.Test
}
}
[TestMethod]
public void IpV4OptionsTest()
{
IpV4Options actual = new IpV4Options(new IpV4OptionSecurity(IpV4OptionSecurityLevel.Unclassified, 12345, 54321, (UInt24)123456));
IpV4Options expected = new IpV4Options(new IpV4OptionSecurity(IpV4OptionSecurityLevel.Unclassified, 12345, 54321, (UInt24)123456),
IpV4Option.End);
Assert.AreEqual(expected, actual);
Assert.IsTrue(expected.IsValid);
Assert.IsTrue(actual.IsValid);
}
[TestMethod]
[ExpectedException(typeof(ArgumentOutOfRangeException))]
public void IpV4OptionTimestampOverflowErrorTest()
......
......@@ -92,7 +92,7 @@ namespace PcapDotNet.Packets.TestUtils
throw new ArgumentOutOfRangeException("maximumOptionLength", maximumOptionLength, "option length must be positive");
List<IpV4OptionType> impossibleOptionTypes = new List<IpV4OptionType>();
if (maximumOptionLength < IpV4OptionSecurity.OptionLength)
if (maximumOptionLength < IpV4OptionSecurity.OptionMinimumLength)
impossibleOptionTypes.Add(IpV4OptionType.Security);
if (maximumOptionLength < IpV4OptionRoute.OptionMinimumLength)
{
......@@ -114,8 +114,13 @@ namespace PcapDotNet.Packets.TestUtils
return IpV4Option.Nop;
case IpV4OptionType.Security:
return new IpV4OptionSecurity(random.NextEnum<IpV4OptionSecurityLevel>(), random.NextUShort(), random.NextUShort(),
random.NextUInt24());
IpV4OptionSecurityProtectionAuthority protectionAuthority = IpV4OptionSecurityProtectionAuthority.None;
int protectionAuthorityLength = random.Next(maximumOptionLength - IpV4OptionSecurity.OptionMinimumLength);
if (protectionAuthorityLength > 0)
protectionAuthority = random.NextEnum<IpV4OptionSecurityProtectionAuthority>();
return new IpV4OptionSecurity(random.NextEnum<IpV4OptionSecurityClassificationLevel>(), protectionAuthority,
(byte)(IpV4OptionSecurity.OptionMinimumLength + protectionAuthorityLength));
case IpV4OptionType.LooseSourceRouting:
case IpV4OptionType.StrictSourceRouting:
......
......@@ -9,7 +9,6 @@
<Word>endianity</Word>
<Word>prespecified</Word>
<Word>ttl</Word>
<Word>mmmm</Word> <!-- Still couldn't find out what this mean -->
<Word>satnet</Word>
<Word>bbn</Word> <!-- Probably BBN Technologies (originally Bolt, Beranek and Newman) -->
<Word>aris</Word>
......
......@@ -4,102 +4,101 @@ using PcapDotNet.Base;
namespace PcapDotNet.Packets.IpV4
{
/// <summary>
/// This option provides a way for hosts to send security, compartmentation, handling restrictions, and TCC (closed user group) parameters.
/// This option identifies the U.S. classification level at which the datagram is to be protected
/// and the authorities whose protection rules apply to each datagram.
///
/// The format for this option is as follows:
/// +--------+--------+---//---+---//---+---//---+---//---+
/// |10000010|00001011|SSS SSS|CCC CCC|HHH HHH| TCC |
/// +--------+--------+---//---+---//---+---//---+---//---+
/// Type=130 Length=11
/// This option is used by end systems and intermediate systems of aninternet to:
///
/// Must be copied on fragmentation.
/// This option appears at most once in a datagram.
/// a. Transmit from source to destination in a network standard representation the common security labels required by computer security models,
///
/// b. Validate the datagram as appropriate for transmission from the source and delivery to the destination,
///
/// c. Ensure that the route taken by the datagram is protected to the level required by all protection authorities indicated on the datagram.
/// In order to provide this facility in a general Internet environment, interior and exterior gateway protocols must be augmented
/// to include security label information in support of routing control.
///
/// The DoD Basic Security option must be copied on fragmentation.
/// This option appears at most once in a datagram.
/// Some security systems require this to be the first option if more than one option is carried in the IP header,
/// but this is not a generic requirement levied by this specification.
///
/// The format of the DoD Basic Security option is as follows:
/// +------------+------------+------------+-------------//----------+
/// | 10000010 | XXXXXXXX | SSSSSSSS | AAAAAAA[1] AAAAAAA0 |
/// | | | | [0] |
/// +------------+------------+------------+-------------//----------+
/// TYPE = 130 LENGTH CLASSIFICATION PROTECTION
/// LEVEL AUTHORITY
/// FLAGS
/// </summary>
public class IpV4OptionSecurity : IpV4OptionComplex, IEquatable<IpV4OptionSecurity>
{
/// <summary>
/// The number of bytes this option take.
/// The minimum number of bytes this option take.
/// </summary>
public const int OptionLength = 11;
public const int OptionMinimumLength = 3;
/// <summary>
/// The number of bytes this option's value take.
/// The minimum number of bytes this option's value take.
/// </summary>
public const int OptionValueLength = OptionLength - OptionHeaderLength;
public const int OptionValueMinimumLength = OptionMinimumLength - OptionHeaderLength;
/// <summary>
/// Create the security option from the different security field values.
/// </summary>
/// <param name="level">Specifies one of the levels of security.</param>
/// <param name="compartments">
/// Compartments (C field): 16 bits
/// An all zero value is used when the information transmitted is not compartmented.
/// Other values for the compartments field may be obtained from the Defense Intelligence Agency.
/// <param name="classificationLevel">
/// This field specifies the (U.S.) classification level at which the datagram must be protected.
/// The information in the datagram must be protected at this level.
/// </param>
/// <param name="handlingRestrictions">
/// Handling Restrictions (H field): 16 bits
/// The values for the control and release markings are alphanumeric digraphs
/// and are defined in the Defense Intelligence Agency Manual DIAM 65-19, "Standard Security Markings".
/// <param name="protectionAuthority">
/// This field identifies the National Access Programs or Special Access Programs
/// which specify protection rules for transmission and processing of the information contained in the datagram.
/// </param>
/// <param name="transmissionControlCode">
/// Transmission Control Code (TCC field): 24 bits
/// Provides a means to segregate traffic and define controlled communities of interest among subscribers.
/// The TCC values are trigraphs, and are available from HQ DCA Code 530.
/// <param name="length">
/// The number of bytes this option will take.
/// </param>
public IpV4OptionSecurity(IpV4OptionSecurityLevel level, ushort compartments,
ushort handlingRestrictions, UInt24 transmissionControlCode)
public IpV4OptionSecurity(IpV4OptionSecurityClassificationLevel classificationLevel, IpV4OptionSecurityProtectionAuthority protectionAuthority, byte length)
: base(IpV4OptionType.Security)
{
_level = level;
_compartments = compartments;
_handlingRestrictions = handlingRestrictions;
_transmissionControlCode = transmissionControlCode;
if (length < OptionMinimumLength)
throw new ArgumentOutOfRangeException("length", length, "Minimum option length is " + OptionMinimumLength);
if (length == OptionMinimumLength && protectionAuthority != IpV4OptionSecurityProtectionAuthority.None)
{
throw new ArgumentException("Can't have a protection authority without minimum of " + OptionValueMinimumLength + 1 + " length",
"protectionAuthority");
}
_classificationLevel = classificationLevel;
_protectionAuthority = protectionAuthority;
_length = length;
}
/// <summary>
/// Specifies one of the levels of security.
/// This field specifies the (U.S.) classification level at which the datagram must be protected.
/// The information in the datagram must be protected at this level.
/// </summary>
public IpV4OptionSecurityLevel Level
public IpV4OptionSecurityClassificationLevel ClassificationLevel
{
get { return _level; }
get { return _classificationLevel; }
}
/// <summary>
/// Compartments (C field): 16 bits
/// An all zero value is used when the information transmitted is not compartmented.
/// Other values for the compartments field may be obtained from the Defense Intelligence Agency.
/// This field identifies the National Access Programs or Special Access Programs
/// which specify protection rules for transmission and processing of the information contained in the datagram.
/// </summary>
public ushort Compartments
public IpV4OptionSecurityProtectionAuthority ProtectionAuthority
{
get { return _compartments; }
}
/// <summary>
/// Handling Restrictions (H field): 16 bits
/// The values for the control and release markings are alphanumeric digraphs
/// and are defined in the Defense Intelligence Agency Manual DIAM 65-19, "Standard Security Markings".
/// </summary>
public ushort HandlingRestrictions
{
get { return _handlingRestrictions; }
get { return _protectionAuthority; }
}
/// <summary>
/// Transmission Control Code (TCC field): 24 bits
/// Provides a means to segregate traffic and define controlled communities of interest among subscribers.
/// The TCC values are trigraphs, and are available from HQ DCA Code 530.
/// </summary>
public UInt24 TransmissionControlCode
{
get { return _transmissionControlCode; }
}
/// <summary>
/// The number of bytes this option will take.
/// </summary>
public override int Length
{
get { return OptionLength; }
get { return _length; }
}
/// <summary>
......@@ -118,10 +117,9 @@ namespace PcapDotNet.Packets.IpV4
if (other == null)
return false;
return Level == other.Level &&
Compartments == other.Compartments &&
HandlingRestrictions == other.HandlingRestrictions &&
TransmissionControlCode == other.TransmissionControlCode;
return ClassificationLevel == other.ClassificationLevel &&
ProtectionAuthority == other.ProtectionAuthority &&
Length == other.Length;
}
/// <summary>
......@@ -133,43 +131,73 @@ namespace PcapDotNet.Packets.IpV4
}
/// <summary>
/// The hash code is the xor of the following hash code: base class hash code, level and compartments, handling restrictions, transmission control code.
/// The hash code is the xor of the base class hash code
/// with the hash code of the combination of the classification level, protection authority and length.
/// </summary>
/// <returns></returns>
public override int GetHashCode()
{
return base.GetHashCode() ^
(((ushort)Level << 16) | Compartments).GetHashCode() ^
(HandlingRestrictions << 16).GetHashCode() ^
TransmissionControlCode.GetHashCode();
((((byte)ClassificationLevel) << 16) | (((byte)ProtectionAuthority) << 8) | Length).GetHashCode();
}
internal static IpV4OptionSecurity ReadOptionSecurity(byte[] buffer, ref int offset, byte valueLength)
{
if (valueLength != OptionValueLength)
if (valueLength < OptionValueMinimumLength)
return null;
IpV4OptionSecurityLevel level = (IpV4OptionSecurityLevel)buffer.ReadUShort(ref offset, Endianity.Big);
ushort compartments = buffer.ReadUShort(ref offset, Endianity.Big);
ushort handlingRestrictions = buffer.ReadUShort(ref offset, Endianity.Big);
UInt24 transmissionControlCode = buffer.ReadUInt24(ref offset, Endianity.Big);
return new IpV4OptionSecurity(level, compartments, handlingRestrictions, transmissionControlCode);
// Classification level
IpV4OptionSecurityClassificationLevel classificationLevel = (IpV4OptionSecurityClassificationLevel)buffer[offset++];
if (classificationLevel != IpV4OptionSecurityClassificationLevel.Confidential &&
classificationLevel != IpV4OptionSecurityClassificationLevel.Secret &&
classificationLevel != IpV4OptionSecurityClassificationLevel.TopSecret &&
classificationLevel != IpV4OptionSecurityClassificationLevel.Unclassified)
{
return null;
}
// Protection authority
int protectionAuthorityLength = valueLength - OptionValueMinimumLength;
IpV4OptionSecurityProtectionAuthority protectionAuthority = IpV4OptionSecurityProtectionAuthority.None;
if (protectionAuthorityLength > 0)
{
for (int i = 0; i < protectionAuthorityLength - 1; ++i)
{
if ((buffer[offset + i] & 0x01) == 0)
return null;
}
if ((buffer[offset + protectionAuthorityLength - 1] & 0x01) != 0)
return null;
protectionAuthority = (IpV4OptionSecurityProtectionAuthority)(buffer[offset] & 0xFE);
}
offset += protectionAuthorityLength;
return new IpV4OptionSecurity(classificationLevel, protectionAuthority, (byte)(OptionMinimumLength + protectionAuthorityLength));
}
internal override void Write(byte[] buffer, ref int offset)
{
base.Write(buffer, ref offset);
buffer[offset++] = (byte)Length;
buffer.Write(ref offset, (ushort)Level, Endianity.Big);
buffer.Write(ref offset, Compartments, Endianity.Big);
buffer.Write(ref offset, HandlingRestrictions, Endianity.Big);
buffer.Write(ref offset, TransmissionControlCode, Endianity.Big);
buffer[offset++] = (byte)ClassificationLevel;
int protectionAuthorityLength = Length - OptionMinimumLength;
if (protectionAuthorityLength > 0)
{
buffer[offset++] = (byte)ProtectionAuthority;
if (protectionAuthorityLength > 1)
{
buffer[offset - 1] |= 0x01;
for (int i = 0; i != protectionAuthorityLength - 2; ++i)
buffer[offset++] = 0x01;
buffer[offset++] = 0x00;
}
}
}
private readonly IpV4OptionSecurityLevel _level;
private readonly ushort _compartments;
private readonly ushort _handlingRestrictions;
private readonly UInt24 _transmissionControlCode;
private readonly IpV4OptionSecurityClassificationLevel _classificationLevel;
private readonly IpV4OptionSecurityProtectionAuthority _protectionAuthority;
private readonly byte _length;
}
}
\ No newline at end of file
namespace PcapDotNet.Packets.IpV4
{
/// <summary>
/// Security (S field): 16 bits
/// </summary>
public enum IpV4OptionSecurityLevel : ushort
/// This field specifies the (U.S.) classification level at which the datagram must be protected.
/// The information in the datagram must be protected at this level.
/// The bit string values in this table were chosen to achieve a minimum Hamming distance of four (4) between any two valid values.
/// This specific assignment of classification level names to values has been defined for compatibility
/// with security devices which have already been developed and deployed.
/// </summary>
public enum IpV4OptionSecurityClassificationLevel : byte
{
/// <summary>
/// Unclassified
/// </summary>
Unclassified = 0x0000,
/// <summary>
/// Confidential
/// </summary>
Confidential = 0xF135,
/// <summary>
/// Encrypted For Transmission Only (EFTO)
/// </summary>
EncryptedForTransmissionOnly = 0x789A,
/// <summary>
/// MMMM
/// </summary>
Mmmm = 0xBC4D,
/// <summary>
/// PROG
/// Top Secret
/// </summary>
Prog = 0x5E26,
TopSecret = 0x3D,
/// <summary>
/// Restricted
/// Secret
/// </summary>
Restricted = 0xAF13,
Secret = 0x5A,
/// <summary>
/// Secret
/// Confidential
/// </summary>
Secret = 0xD788,
Confidential = 0x96,
/// <summary>
/// Top Secret
/// Unclassified
/// </summary>
TopSecret = 0x6BC5
Unclassified = 0xAB
}
}
\ No newline at end of file
using System;
namespace PcapDotNet.Packets.IpV4
{
/// <summary>
/// This field identifies the National Access Programs or Special Access Programs
/// which specify protection rules for transmission and processing of the information contained in the datagram.
/// Protection authority flags do NOT represent accreditation authorities, though the semantics are superficially similar.
/// </summary>
[Flags]
public enum IpV4OptionSecurityProtectionAuthority : byte
{
/// <summary>
/// No protection authorities.
/// </summary>
None = 0x00,
/// <summary>
/// Designated Approving Authority per DOD 5200.28
/// </summary>
Genser = 0x80,
/// <summary>
/// Single Integrated Operational Plan - Extremely Sensitive Information (SIOP-ESI).
/// Department of Defense Organization of the Joint Chiefs of Staff
/// Attn: J6 Washington, DC 20318-6000
/// </summary>
SingleIntegrationOptionalPlanExtremelySensitiveInformation = 0x40,
/// <summary>
/// Sensitive Compartmented Information (SCI).
/// Director of Central Intelligence
/// Attn: Chairman, Information Handling Committee, Intelligence Community Staff Washington, D.C. 20505
/// </summary>
SensitiveCompartmentedInformation = 0x20,
/// <summary>
/// National Security Agency (NSA).
/// 9800 Savage Road Attn: T03 Ft. Meade, MD 20755-6000
/// </summary>
Nsa = 0x10,
/// <summary>
/// Department of Energy (DOE).
/// Attn: DP343.2 Washington, DC 20545
/// </summary>
DeparmentOfEnergy = 0x08
}
}
\ No newline at end of file
......@@ -31,8 +31,8 @@ namespace PcapDotNet.Packets.IpV4
NoOperation = 1,
/// <summary>
/// Security.
/// Used to carry Security, Compartmentation, User Group (TCC), and Handling Restriction Codes compatible with DOD requirements.
/// DoD Basic Security:
/// Used to carry the classification level and protection authority flags.
/// </summary>
Security = 130,
......
......@@ -75,12 +75,13 @@
<Compile Include="IpV4\IpV4Option.cs" />
<Compile Include="IpV4\IpV4OptionComplex.cs" />
<Compile Include="IpV4\IpV4OptionLooseSourceRouting.cs" />
<Compile Include="IpV4\IpV4OptionSecurityProtectionAuthority.cs" />
<Compile Include="IpV4\IpV4OptionSimple.cs" />
<Compile Include="IpV4\IpV4OptionRecordRoute.cs" />
<Compile Include="IpV4\IpV4OptionRoute.cs" />
<Compile Include="IpV4\IpV4Options.cs" />
<Compile Include="IpV4\IpV4OptionSecurity.cs" />
<Compile Include="IpV4\IpV4OptionSecurityLevel.cs" />
<Compile Include="IpV4\IpV4OptionSecurityClassificationLevel.cs" />
<Compile Include="IpV4\IpV4OptionStreamIdentifier.cs" />
<Compile Include="IpV4\IpV4OptionStrictSourceRouting.cs" />
<Compile Include="IpV4\IpV4OptionTimedAddress.cs" />
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment