diff options
author | rwatson <rwatson@FreeBSD.org> | 2003-12-17 14:55:11 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2003-12-17 14:55:11 +0000 |
commit | 8315bb904de1f1c34053b85fab46b2f15bea6d42 (patch) | |
tree | 6f403547f45a548d093633ddb92a1c06f17404e9 /sys/security/mac/mac_net.c | |
parent | 71deee9e60194502532d1e090e2a0342fd47c484 (diff) | |
download | FreeBSD-src-8315bb904de1f1c34053b85fab46b2f15bea6d42.zip FreeBSD-src-8315bb904de1f1c34053b85fab46b2f15bea6d42.tar.gz |
Switch TCP over to using the inpcb label when responding in timed
wait, rather than the socket label. This avoids reaching up to
the socket layer during connection close, which requires locking
changes. To do this, introduce MAC Framework entry point
mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond()
instead of calling mac_create_mbuf_from_socket() or
mac_create_mbuf_netlayer(). Introduce MAC Policy entry point
mpo_create_mbuf_from_inpcb(), and implementations for various
policies, which generally just copy label data from the inpcb to
the mbuf. Assert the inpcb lock in the entry point since we
require consistency for the inpcb label reference.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/security/mac/mac_net.c')
-rw-r--r-- | sys/security/mac/mac_net.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index 8337a19..9e5cfe5 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -589,6 +589,17 @@ mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) } void +mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m) +{ + struct label *mlabel; + + INP_LOCK_ASSERT(inp); + mlabel = mbuf_to_label(m); + + MAC_PERFORM(create_mbuf_from_inpcb, inp, inp->inp_label, m, mlabel); +} + +void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { struct label *oldmbuflabel, *newmbuflabel; |