Introduce a MAC label reference in 'struct inpcb', which caches

the   MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols.  This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.

This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.

For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks.  Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.

Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.

Reviewed by:	sam, bms
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

2 files changed, 12 insertions, 6 deletions

diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket.c b/sys/netgraph/bluetooth/socket/ng_btsocket.c
index e8ad4adee3e9..383a06348267 100644
--- a/sys/netgraph/bluetooth/socket/ng_btsocket.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket.c
@@ -79,7 +79,8 @@ static struct pr_usrreqs	ng_btsocket_hci_raw_usrreqs = {
 	ng_btsocket_hci_raw_sockaddr,	/* sockaddr */
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 /*
@@ -106,7 +107,8 @@ static struct pr_usrreqs	ng_btsocket_l2cap_raw_usrreqs = {
 	ng_btsocket_l2cap_raw_sockaddr,	/* sockaddr */
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 /*
@@ -133,7 +135,8 @@ static struct pr_usrreqs	ng_btsocket_l2cap_usrreqs = {
 	ng_btsocket_l2cap_sockaddr,	/* sockaddr */
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 /*
@@ -160,7 +163,8 @@ static struct pr_usrreqs	ng_btsocket_rfcomm_usrreqs = {
 	ng_btsocket_rfcomm_sockaddr,	/* sockaddr */
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 /* 
diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c
index f841a0e70f18..e3be7d106542 100644
--- a/sys/netgraph/ng_socket.c
+++ b/sys/netgraph/ng_socket.c
@@ -978,7 +978,8 @@ static struct pr_usrreqs ngc_usrreqs = {
 	ng_setsockaddr,
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 static struct pr_usrreqs ngd_usrreqs = {
@@ -1001,7 +1002,8 @@ static struct pr_usrreqs ngd_usrreqs = {
 	ng_setsockaddr,
 	sosend,
 	soreceive,
-	sopoll
+	sopoll,
+	pru_sosetlabel_null
 };
 
 /*