From 9c969b771a32651104f16586408deb67d7039014 Mon Sep 17 00:00:00 2001
From: rwatson <rwatson@FreeBSD.org>
Date: Tue, 18 Nov 2003 00:39:07 +0000
Subject: Introduce a MAC label reference in 'struct inpcb', which caches the  
 MAC label referenced from 'struct socket' in the IPv4 and IPv6-based
 protocols.  This permits MAC labels to be checked during network delivery
 operations without dereferencing inp->inp_socket to get to so->so_label,
 which will eventually avoid our having to grab the socket lock during
 delivery at the network layer.

This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.

For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks.  Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.

Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.

Reviewed by:	sam, bms
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
---
 sys/kern/uipc_sockbuf.c | 10 ++++++++++
 sys/kern/uipc_socket2.c | 10 ++++++++++
 sys/kern/uipc_usrreq.c  |  2 +-
 3 files changed, 21 insertions(+), 1 deletion(-)

(limited to 'sys/kern')

diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index c4a4c09..64199fc 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -1042,6 +1042,16 @@ pru_sense_null(struct socket *so, struct stat *sb)
 }
 
 /*
+ * For protocol types that don't keep cached copies of labels in their
+ * pcbs, provide a null sosetlabel that does a NOOP.
+ */
+void
+pru_sosetlabel_null(struct socket *so)
+{
+
+}
+
+/*
  * Make a copy of a sockaddr in a malloced buffer of type M_SONAME.
  */
 struct sockaddr *
diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c
index c4a4c09..64199fc 100644
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -1042,6 +1042,16 @@ pru_sense_null(struct socket *so, struct stat *sb)
 }
 
 /*
+ * For protocol types that don't keep cached copies of labels in their
+ * pcbs, provide a null sosetlabel that does a NOOP.
+ */
+void
+pru_sosetlabel_null(struct socket *so)
+{
+
+}
+
+/*
  * Make a copy of a sockaddr in a malloced buffer of type M_SONAME.
  */
 struct sockaddr *
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index fec4050..1075709 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -450,7 +450,7 @@ struct pr_usrreqs uipc_usrreqs = {
 	uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect,
 	uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp,
 	uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr,
-	sosend, soreceive, sopoll
+	sosend, soreceive, sopoll, pru_sosetlabel_null
 };
 
 int
-- 
cgit v1.1