Date: Sat, 17 Jun 2006 23:59:07 +0200 From: Max Laier <max@love2party.net> To: trustedbsd-discuss@freebsd.org Cc: zhouyi zhou <zhouyi04@ios.cn> Subject: Re: MAC Framework has confict with IP firewall Message-ID: <200606172359.13019.max@love2party.net> In-Reply-To: <20060327184133.5a35b20f.zhouyi04@ios.cn> References: <20060327184133.5a35b20f.zhouyi04@ios.cn>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1179575.iaKKNL2654 Content-Type: multipart/mixed; boundary="Boundary-01=_ssHlE+Zw452i3vn" Content-Transfer-Encoding: 7bit Content-Disposition: inline --Boundary-01=_ssHlE+Zw452i3vn Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Monday 27 March 2006 12:41, zhouyi zhou wrote: > MAC Framework has conflict with IP firewall > because in function ipfw_tick of file ip_fw2.c, the mbuf is created > without MAC label being initialized and send directly to ip_output. Christian Brueffer made me aware of this problem. Here is what we believe= =20 should work as a temporary workaround to this problem. The final solution= =20 would involve assigning a label with firewall states (derived from the pack= et=20 that creates the state) and then using this label for the mbuf created for= =20 keepalives etc. The attached modifies biba, lomac and mls. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --Boundary-01=_ssHlE+Zw452i3vn-- --nextPart1179575.iaKKNL2654 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQBElHsxXyyEoT62BG0RAqD9AJ9rWD9Syo78B8XbkOeDD8Hzbzdj2ACeMdKS Z6QnWge5UvAFNAQJyHytxeA= =XSgG -----END PGP SIGNATURE----- --nextPart1179575.iaKKNL2654--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200606172359.13019.max>