diff options
author | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
commit | 9c969b771a32651104f16586408deb67d7039014 (patch) | |
tree | 9ae16c9f3cb9780bbad2d9f596380ed1094d201c /sys/netgraph | |
parent | c428ace885437d38f0343448bc61807c6e7a690c (diff) | |
download | FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.zip FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.tar.gz |
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/netgraph')
-rw-r--r-- | sys/netgraph/bluetooth/socket/ng_btsocket.c | 12 | ||||
-rw-r--r-- | sys/netgraph/ng_socket.c | 6 |
2 files changed, 12 insertions, 6 deletions
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket.c b/sys/netgraph/bluetooth/socket/ng_btsocket.c index e8ad4ad..383a063 100644 --- a/sys/netgraph/bluetooth/socket/ng_btsocket.c +++ b/sys/netgraph/bluetooth/socket/ng_btsocket.c @@ -79,7 +79,8 @@ static struct pr_usrreqs ng_btsocket_hci_raw_usrreqs = { ng_btsocket_hci_raw_sockaddr, /* sockaddr */ sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; /* @@ -106,7 +107,8 @@ static struct pr_usrreqs ng_btsocket_l2cap_raw_usrreqs = { ng_btsocket_l2cap_raw_sockaddr, /* sockaddr */ sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; /* @@ -133,7 +135,8 @@ static struct pr_usrreqs ng_btsocket_l2cap_usrreqs = { ng_btsocket_l2cap_sockaddr, /* sockaddr */ sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; /* @@ -160,7 +163,8 @@ static struct pr_usrreqs ng_btsocket_rfcomm_usrreqs = { ng_btsocket_rfcomm_sockaddr, /* sockaddr */ sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; /* diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c index f841a0e..e3be7d1 100644 --- a/sys/netgraph/ng_socket.c +++ b/sys/netgraph/ng_socket.c @@ -978,7 +978,8 @@ static struct pr_usrreqs ngc_usrreqs = { ng_setsockaddr, sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; static struct pr_usrreqs ngd_usrreqs = { @@ -1001,7 +1002,8 @@ static struct pr_usrreqs ngd_usrreqs = { ng_setsockaddr, sosend, soreceive, - sopoll + sopoll, + pru_sosetlabel_null }; /* |