From 9c969b771a32651104f16586408deb67d7039014 Mon Sep 17 00:00:00 2001 From: rwatson Date: Tue, 18 Nov 2003 00:39:07 +0000 Subject: Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/netnatm/natm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys/netnatm') diff --git a/sys/netnatm/natm.c b/sys/netnatm/natm.c index b9beb03c..c1f9850 100644 --- a/sys/netnatm/natm.c +++ b/sys/netnatm/natm.c @@ -396,7 +396,7 @@ struct pr_usrreqs natm_usrreqs = { natm_usr_detach, natm_usr_disconnect, pru_listen_notsupp, natm_usr_peeraddr, pru_rcvd_notsupp, pru_rcvoob_notsupp, natm_usr_send, pru_sense_null, natm_usr_shutdown, - natm_usr_sockaddr, sosend, soreceive, sopoll + natm_usr_sockaddr, sosend, soreceive, sopoll, pru_sosetlabel_null }; #else /* !FREEBSD_USRREQS */ -- cgit v1.1