Continue to move from generic network entry points in the TrustedBSD MAC

Framework by moving from mac_mbuf_create_netlayer() to more specific
entry points for specific network services:

- mac_netinet_firewall_reply() to be used when replying to in-bound TCP
  segments in pf and ipfw (etc).

- Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and
  add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite
  a label in place, but in others we apply the label to a new mbuf.

Obtained from:	TrustedBSD Project

1 files changed, 0 insertions, 11 deletions

diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index af05875..c451a29 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -334,17 +334,6 @@ mac_mbuf_create_multicast_encap(struct mbuf *m, struct ifnet *ifp,
 	MAC_IFNET_UNLOCK(ifp);
 }
 
-void
-mac_mbuf_create_netlayer(struct mbuf *m, struct mbuf *mnew)
-{
-	struct label *mlabel, *mnewlabel;
-
-	mlabel = mac_mbuf_to_label(m);
-	mnewlabel = mac_mbuf_to_label(mnew);
-
-	MAC_PERFORM(mbuf_create_netlayer, m, mlabel, mnew, mnewlabel);
-}
-
 int
 mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
 {