topic Re: ICMP method_name in tlrules in Secure OS Software for Linux

ICMP method_name in tlrules

Chris Watson — Mon, 31 Dec 2001 15:51:24 GMT

These doesn't appear to be either a ICMP method_name in tlrules.

I am trying to enable ping to the system compartment, and I have tried adding 'method all' but the client can;t get a response.

How can I get hplx to respond to a ping?

Re: ICMP method_name in tlrules

Ron Vladick — Fri, 04 Jan 2002 16:08:28 GMT

Currently ICMP messages are not supported. ICMP messages will only work in the syshi compartment.

Re: ICMP method_name in tlrules

Chris Watson — Fri, 04 Jan 2002 16:22:19 GMT

Ron,

Could you expand on this a little.

From another machine I want to ping hp-tlx.

tlrules appear to handle socket communications, and seeing as ICMP are not sockified I don't understand how tlx handles this.

Do I control ICMP by controlling UDP?

You state that ICMP will work in syshi. If I am pinging from another machine, what is going to echo the request?

Re: ICMP method_name in tlrules

Joy Leima — Wed, 09 Jan 2002 12:54:09 GMT

Incoming ICMP messages are not affected. IP responds to these. Secure Linux won't interfere with the operations of ICMP or any other low level IP operations. It is when a process tries to receive (or send) a packet that the compartmentalization will come into play.

Re: ICMP method_name in tlrules

Ron Vladick — Wed, 09 Jan 2002 13:47:39 GMT

To further clarify,

Why can a client ping Secure Linux/Linux?
- a) icmp replies is a built in networking function. These requests are handled by the network driver before it passes the request up the stack to the tcp/udp functions.

ICMP has some configuable options:
These parameters reside in /proc/sys/net/ipv4

icmp_echo_ignore_all icmp_ignore_bogus_error_responses icmp_ratemask
icmp_echo_ignore_broadcasts icmp_ratelimit
is configurable

The icmp_echo_ignore_all parameter can be set to 1 for Secure Linux to not reply to client icmp requests.