summaryrefslogtreecommitdiffstats
path: root/sys/netipx
diff options
context:
space:
mode:
authorrwatson <rwatson@FreeBSD.org>2003-11-18 00:39:07 +0000
committerrwatson <rwatson@FreeBSD.org>2003-11-18 00:39:07 +0000
commit9c969b771a32651104f16586408deb67d7039014 (patch)
tree9ae16c9f3cb9780bbad2d9f596380ed1094d201c /sys/netipx
parentc428ace885437d38f0343448bc61807c6e7a690c (diff)
downloadFreeBSD-src-9c969b771a32651104f16586408deb67d7039014.zip
FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.tar.gz
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/netipx')
-rw-r--r--sys/netipx/ipx_usrreq.c4
-rw-r--r--sys/netipx/spx_usrreq.c4
2 files changed, 4 insertions, 4 deletions
diff --git a/sys/netipx/ipx_usrreq.c b/sys/netipx/ipx_usrreq.c
index 376d8fb..383d2af 100644
--- a/sys/netipx/ipx_usrreq.c
+++ b/sys/netipx/ipx_usrreq.c
@@ -92,7 +92,7 @@ struct pr_usrreqs ipx_usrreqs = {
ipx_connect, pru_connect2_notsupp, ipx_control, ipx_detach,
ipx_disconnect, pru_listen_notsupp, ipx_peeraddr, pru_rcvd_notsupp,
pru_rcvoob_notsupp, ipx_send, pru_sense_null, ipx_shutdown,
- ipx_sockaddr, sosend, soreceive, sopoll
+ ipx_sockaddr, sosend, soreceive, sopoll, pru_sosetlabel_null
};
struct pr_usrreqs ripx_usrreqs = {
@@ -100,7 +100,7 @@ struct pr_usrreqs ripx_usrreqs = {
ipx_connect, pru_connect2_notsupp, ipx_control, ipx_detach,
ipx_disconnect, pru_listen_notsupp, ipx_peeraddr, pru_rcvd_notsupp,
pru_rcvoob_notsupp, ipx_send, pru_sense_null, ipx_shutdown,
- ipx_sockaddr, sosend, soreceive, sopoll
+ ipx_sockaddr, sosend, soreceive, sopoll, pru_sosetlabel_null
};
/*
diff --git a/sys/netipx/spx_usrreq.c b/sys/netipx/spx_usrreq.c
index 371e85e..1424754 100644
--- a/sys/netipx/spx_usrreq.c
+++ b/sys/netipx/spx_usrreq.c
@@ -112,7 +112,7 @@ struct pr_usrreqs spx_usrreqs = {
spx_connect, pru_connect2_notsupp, ipx_control, spx_detach,
spx_usr_disconnect, spx_listen, ipx_peeraddr, spx_rcvd,
spx_rcvoob, spx_send, pru_sense_null, spx_shutdown,
- ipx_sockaddr, sosend, soreceive, sopoll
+ ipx_sockaddr, sosend, soreceive, sopoll, pru_sosetlabel_null
};
struct pr_usrreqs spx_usrreq_sps = {
@@ -120,7 +120,7 @@ struct pr_usrreqs spx_usrreq_sps = {
spx_connect, pru_connect2_notsupp, ipx_control, spx_detach,
spx_usr_disconnect, spx_listen, ipx_peeraddr, spx_rcvd,
spx_rcvoob, spx_send, pru_sense_null, spx_shutdown,
- ipx_sockaddr, sosend, soreceive, sopoll
+ ipx_sockaddr, sosend, soreceive, sopoll, pru_sosetlabel_null
};
void
OpenPOWER on IntegriCloud