From owner-cvs-all@FreeBSD.ORG Wed Dec 13 06:00:58 2006 Return-Path: X-Original-To: cvs-all@FreeBSD.org Delivered-To: cvs-all@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 57BB116A412; Wed, 13 Dec 2006 06:00:58 +0000 (UTC) (envelope-from csjp@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [69.147.83.41]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0A23A43C9D; Wed, 13 Dec 2006 05:59:31 +0000 (GMT) (envelope-from csjp@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id kBD60vdc065201; Wed, 13 Dec 2006 06:00:57 GMT (envelope-from csjp@repoman.freebsd.org) Received: (from csjp@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id kBD60vqk065200; Wed, 13 Dec 2006 06:00:57 GMT (envelope-from csjp) Message-Id: <200612130600.kBD60vqk065200@repoman.freebsd.org> From: "Christian S.J. Peron" Date: Wed, 13 Dec 2006 06:00:57 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Cc: Subject: cvs commit: src/sys/netinet tcp_syncache.c src/sys/security/mac mac_framework.h mac_inet.c src/sys/sys mac_policy.h X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Dec 2006 06:00:58 -0000 csjp 2006-12-13 06:00:57 UTC FreeBSD src repository Modified files: sys/netinet tcp_syncache.c sys/security/mac mac_framework.h mac_inet.c sys/sys mac_policy.h Log: Fix LOR between the syncache and inpcb locks when MAC is present in the kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes Revision Changes Path 1.103 +44 -43 src/sys/netinet/tcp_syncache.c 1.76 +4 -0 src/sys/security/mac/mac_framework.h 1.5 +54 -0 src/sys/security/mac/mac_inet.c 1.79 +10 -0 src/sys/sys/mac_policy.h