Introduce experimental support for MAC in the AppleTalk/EtherTalk stack.

Label link layer mbufs as they are created for transmission, check
mbufs before delivering them to sockets, label mbufs as they are created
from sockets, and preserve mbuf labels if mbufs are copied.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs

1 files changed, 10 insertions, 0 deletions

diff --git a/sys/netatalk/ddp_input.c b/sys/netatalk/ddp_input.c
index 4ef497b..6db107f 100644
--- a/sys/netatalk/ddp_input.c
+++ b/sys/netatalk/ddp_input.c
@@ -5,9 +5,12 @@
  * $FreeBSD$
  */
 
+#include "opt_mac.h"
+
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
+#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/signalvar.h>
 #include <sys/socket.h>
@@ -395,6 +398,13 @@ ddp_input( m, ifp, elh, phase )
 	return;
     }
 
+#ifdef MAC
+    if (mac_check_socket_deliver(ddp->ddp_socket, m) != 0) {
+	m_freem( m );
+	return;
+    }
+#endif
+
     /* 
      * If we found one, deliver th epacket to the socket
      */