The CIPSO label is derived from the actual label of the data on the sending Trusted Solaris computer.
The trusted networking software puts a CIPSO label and a DOI (domain of interpretation) number into the IP option for outgoing packets and also looks for a CIPSO label and DOI in the IP option of incoming packets, if the trusted network template entry assigned to the remote host meets one of these criteria:
Assigns the host the CIPSO host type
Assigns the host the Trusted Solaris host type, setting the IP label type to CIPSO
Assigns the host the TSIX host type, setting the IP label type to CIPSO
The CIPSO label that is inserted into outgoing packets is derived by the trusted networking software from the actual label associated with the data. Sometimes Trusted Solaris labels match directly to a CIPSO label. For example, the label of CONFIDENTIAL matches the CIPSO label of CONFIDENTIAL. However, most Trusted Solaris labels do not map directly to CIPSO labels.
At a site that plans to use CIPSO labels for trusted routing or wishes to communicate with a host with a host type of CIPSO, the Security Administrator role should plan ahead to configure the site's labels so they map well to CIPSO labels.
A DOI (domain of interpretation) must also be specified, and the same DOI must be:
Assigned to the sending host
In a routing table entry for all gateways through which messages travel and understood by routers
Assigned to the destination host
The Security Administrator role needs to plan ahead to ensure that the labels defined in the label_encodings(4) file map well to CIPSO labels. See Trusted Solaris Label Administration.