Labeled IPsec Traffic Selector Support for the Internet Key Exchange Protocol Version 2 (IKEv2)
Extracted elements (17)
The Security Label contents are intentionally opaque to the IKE implementation. The IKE implementation may have no knowledge of the label's meaning other than recognizing it as a type and opaque value to pass to the SPD, allowing MAC policy enforcement to remain in the OS/policy layer rather than the IKE layer.
The specification allows TSi and TSr to carry different Security Labels, even though this would be uncommon. Initiators that do not support different labels per direction should negotiate Child SAs serially with one label at a time rather than combining them.
TS_SECLABEL is defined as a complementary selector that must accompany an IP address TS Type, rather than being standalone, because a security label alone is insufficient to define an IPsec traffic selector — it must narrow traffic already selected by IP address range.
The TS_SECLABEL type complements but does not replace existing TS Types. Implementations must continue to handle TS_IPV4_ADDR_RANGE and TS_IPV6_ADDR_RANGE per RFC 7296, and TS_SECLABEL is only valid alongside these types.
A responder that selected a TS with TS_SECLABEL MUST use the Security Label for all selector operations on the resulting TS. It MUST NOT select a TS_SECLABEL without using the specified Security Label, even if it deems the Security Label optional.
A zero-length Security Label MUST NOT be used. If a received TS payload contains a TS_SECLABEL with a zero-length Security Label, that TS payload MUST be ignored. A zero-length Security Label MUST NOT be interpreted as a wildcard.
If different IP ranges can only use different specific Security Labels, these MUST NOT be combined into one Child SA negotiation; each combination must be negotiated in a separate Child SA negotiation.
If the Security Label TS Type is optional and the responder did not include TS_SECLABEL in its response, the initiator installs the Child SA without a Security Label. If the initiator required TS_SECLABEL, it MUST NOT install the Child SA and MUST send a Delete notification so the responder can uninstall its Child SA.
If the TSi payload contains a TS_SECLABEL, the responder MUST create each TS response for the other TS Types using its normal rules and then add exactly one TS_SECLABEL to the TS payload(s). If this is not possible, it MUST return a TS_UNACCEPTABLE Error Notify payload.
TS_SECLABEL does not support narrowing or wildcards and MUST be used as an exact match value.
TS_SECLABEL MUST NOT be the only TS Type present in a TS payload; it MUST be accompanied by an IP address Traffic Selector Type (TS_IPV4_ADDR_RANGE and/or TS_IPV6_ADDR_RANGE). If a TS payload is received with only TS_SECLABEL TS Types, the exchange MUST be aborted with a TS_UNACCEPTABLE Error Notify message.
When multiple Security Labels are offered by the initiator, the responder MUST select exactly one of the Security Labels.
A TS payload is a set of one or more Traffic Selectors of the same or different TS Types. The TSi/TSr payloads MUST contain at least one TS Type per RFC 7296 Section 2.9; this document adds TS_SECLABEL as a valid additional TS Type requiring a companion IP address TS Type.
TS_SECLABEL is a new IKEv2 Traffic Selector Type (value 10) that carries a single opaque security label for use in Mandatory Access Control (MAC) environments. It enables negotiating security labels as additional selectors for the Security Policy Database (SPD) to restrict traffic allowed over an IPsec SA.
IANA has added TS_SECLABEL (value 10) to the 'IKEv2 Traffic Selector Types' registry defined in RFC 7296, with RFC 9478 as the reference.
A packet matching an SPD entry for all components except the Security Label is treated as 'not matching'. If no other SPD entries match, mislabeled traffic might be transmitted in the clear. The specification presumes that other MAC methods prevent mislabeled traffic from reaching the IPsec subsystem, or that the IPsec subsystem installs a REJECT/DISCARD rule to prevent unlabeled traffic from being transmitted without IPsec protection.
The TS_SECLABEL payload consists of a one-octet TS Type field (set to 10), a one-octet Reserved field, a two-octet unsigned integer Selector Length field (including the header), and a variable-length opaque Security Label field of at least one octet.