diff options
author | Robert Watson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
---|---|---|
committer | Robert Watson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
commit | a557af222b70694470f63e2a0f1bf58c9dcc73fd (patch) | |
tree | 9ae16c9f3cb9780bbad2d9f596380ed1094d201c /sys/netatm | |
parent | b17f40bbda6fee5e88662d68a7d8d372929f4986 (diff) | |
download | src-a557af222b70694470f63e2a0f1bf58c9dcc73fd.tar.gz src-a557af222b70694470f63e2a0f1bf58c9dcc73fd.zip |
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Notes
Notes:
svn path=/head/; revision=122875
Diffstat (limited to 'sys/netatm')
-rw-r--r-- | sys/netatm/atm_aal5.c | 3 | ||||
-rw-r--r-- | sys/netatm/atm_usrreq.c | 4 |
2 files changed, 6 insertions, 1 deletions
diff --git a/sys/netatm/atm_aal5.c b/sys/netatm/atm_aal5.c index 9c11b93f7e88..81fcce8af7dc 100644 --- a/sys/netatm/atm_aal5.c +++ b/sys/netatm/atm_aal5.c @@ -112,7 +112,8 @@ struct pr_usrreqs atm_aal5_usrreqs = { atm_aal5_sockaddr, /* pru_sockaddr */ sosend, /* pru_sosend */ soreceive, /* pru_soreceive */ - sopoll /* pru_sopoll */ + sopoll, /* pru_sopoll */ + pru_sosetlabel_null /* pru_sosetlabel */ }; /* diff --git a/sys/netatm/atm_usrreq.c b/sys/netatm/atm_usrreq.c index 4cc78b753db1..9b587416d0b9 100644 --- a/sys/netatm/atm_usrreq.c +++ b/sys/netatm/atm_usrreq.c @@ -83,6 +83,10 @@ struct pr_usrreqs atm_dgram_usrreqs = { pru_sense_null, /* pru_sense */ atm_proto_notsupp1, /* pru_shutdown */ atm_proto_notsupp3, /* pru_sockaddr */ + NULL, /* pru_sosend */ + NULL, /* pru_soreceive */ + NULL, /* pru_sooll */ + pru_sosetlabel_null /* pru_sosetlabel */ }; |