Output marking Telnet option
Extracted elements (18)
A CNTL flag was introduced (rather than fixing banner position to the top) because different systems may require the security banner at the bottom or sides of the screen, and the design anticipates this variation without mandating a single layout.
The option was motivated by the DoD Trusted Computer System Evaluation Criteria (Section 3.1.1.3.2.3), which requires security level labels on all human-readable output for certain military systems. Embedding banners per screen in application data was the prior approach, but was inefficient.
Transmitting the banner once via subnegotiation and having User-Telnet maintain it automatically is more efficient than Server-Telnet embedding the banner in every screen of data. It also frees Server-Telnet from needing to know the output device's page size.
After output marking is established, User-Telnet must remap all cursor-addressing operations from the application so that they target only the usable (non-banner) portion of the screen; failure to do so would cause application output to overwrite the security banner.
After acknowledging output marking (ACK), User-Telnet must translate all cursor-control commands so that application data is mapped to the application portion of the screen, leaving the banner region reserved.
CRLF within the banner data is interpreted as end-of-line for multiline banners; no trailing CRLF is required after the final line of banner data.
If a WILL/DO OUTMRK exchange is not followed by the OUTMRK subnegotiation, User-Telnet may terminate the option by sending DON'T OUTMRK.
The default state for both sides is WON'T OUTMRK and DON'T OUTMRK, meaning output marking information will not be exchanged unless explicitly negotiated.
To terminate output marking, Server-Telnet transmits 'WON'T OUTMRK'. User-Telnet should then notify Server-Telnet of the new effective page size.
Four standard Telnet negotiation commands are defined: IAC WILL OUTMRK (sender willing to send marking), IAC WON'T OUTMRK (sender refuses to send), IAC DO OUTMRK (sender willing to receive marking), and IAC DON'T OUTMRK (sender refuses to accept marking).
The ACK response 'IAC SB OUTMRK ACK IAC SE' (ACK = ASCII 6) is sent by User-Telnet to accept the banner data and commit to performing output marking as specified.
The CNTL octet encodes banner placement: D (Default, User-Telnet decides), T (Top of screen), B (Bottom of screen), L (Left side, precise meaning TBD), R (Right side, precise meaning TBD). T and B (or R and L) are used together when multiple banners are desired.
The NAK response 'IAC SB OUTMRK NAK IAC SE' (NAK = ASCII 21) is sent by User-Telnet when the supplied banner data is unacceptable, requiring Server-Telnet to restart the sequence with different data or terminate the connection.
The OUTMRK Telnet option is assigned option code 27. It allows a Server-Telnet to transmit a display banner to User-Telnet via subnegotiation, which User-Telnet renders on-screen independently of application data.
The primary purpose of this option is to support mandatory security labeling of terminal sessions as required by the DoD TCSEC. By displaying a persistent banner that is managed by User-Telnet rather than application data, the label cannot be suppressed or spoofed by the server application.
Option negotiation proceeds: either side sends WILL OUTMRK or DO OUTMRK; the receiving party responds with DO or WILL respectively. Server-Telnet then sends the SB subnegotiation with CNTL and data. User-Telnet replies ACK to accept or NAK to reject. On ACK, marking is active; on NAK, Server-Telnet must retry or disconnect. Marking is terminated by Server-Telnet sending WON'T OUTMRK.
Multiple banners may be included in a single subnegotiation using the form 'IAC SB OUTMRK CNTL data GS CNTL data IAC SE', where GS is the ASCII Group Separator character (decimal 29).
The subnegotiation command 'IAC SB OUTMRK CNTL data IAC SE' carries the banner. CNTL is a single octet control flag indicating banner placement; data is ASCII banner text. CRLF separates lines within a multiline banner.