diff options
author | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
commit | 9c969b771a32651104f16586408deb67d7039014 (patch) | |
tree | 9ae16c9f3cb9780bbad2d9f596380ed1094d201c /sys/netinet/udp_usrreq.c | |
parent | c428ace885437d38f0343448bc61807c6e7a690c (diff) | |
download | FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.zip FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.tar.gz |
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/netinet/udp_usrreq.c')
-rw-r--r-- | sys/netinet/udp_usrreq.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 4b755af..60ec82b 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -469,7 +469,7 @@ udp_append(last, ip, n, off) } #endif /*FAST_IPSEC*/ #ifdef MAC - if (mac_check_socket_deliver(last->inp_socket, n) != 0) { + if (mac_check_inpcb_deliver(last, n) != 0) { m_freem(n); return; } @@ -1119,5 +1119,5 @@ struct pr_usrreqs udp_usrreqs = { pru_connect2_notsupp, in_control, udp_detach, udp_disconnect, pru_listen_notsupp, udp_peeraddr, pru_rcvd_notsupp, pru_rcvoob_notsupp, udp_send, pru_sense_null, udp_shutdown, - udp_sockaddr, sosend, soreceive, sopoll + udp_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel }; |