From owner-cvs-src@FreeBSD.ORG Mon Nov 17 16:40:38 2003 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3EA9916A4CE for ; Mon, 17 Nov 2003 16:40:38 -0800 (PST) Received: from floyd.stormweb.net (floyd.stormweb.net [65.39.129.201]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1292D43FF2 for ; Mon, 17 Nov 2003 16:40:22 -0800 (PST) (envelope-from abuse@stormweb.ca) Received: (qmail 50183 invoked by uid 110); 18 Nov 2003 00:40:21 -0000 Received: (qmail 50169 invoked from network); 18 Nov 2003 00:40:20 -0000 Received: from mx2.freebsd.org (216.136.204.119) by floyd.stormweb.net with SMTP; 18 Nov 2003 00:40:20 -0000 Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 90DC85664A for ; Mon, 17 Nov 2003 16:39:48 -0800 (PST) (envelope-from owner-src-committers@FreeBSD.org) Received: by hub.freebsd.org (Postfix) id E4D6416A52F; Mon, 17 Nov 2003 16:39:42 -0800 (PST) Received: by hub.freebsd.org (Postfix, from userid 538) id A68CE16A4D0; Mon, 17 Nov 2003 16:39:41 -0800 (PST) Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C2E7316A4CE; Mon, 17 Nov 2003 16:39:08 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0D02543F75; Mon, 17 Nov 2003 16:39:08 -0800 (PST) (envelope-from rwatson@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.9/8.12.9) with ESMTP id hAI0d7XJ082502; Mon, 17 Nov 2003 16:39:07 -0800 (PST) (envelope-from rwatson@repoman.freebsd.org) Received: (from rwatson@localhost) by repoman.freebsd.org (8.12.9/8.12.9/Submit) id hAI0d7kd082501; Mon, 17 Nov 2003 16:39:07 -0800 (PST) (envelope-from rwatson) Message-Id: <200311180039.hAI0d7kd082501@repoman.freebsd.org> From: Robert Watson Date: Mon, 17 Nov 2003 16:39:07 -0800 (PST) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Sender: owner-src-committers@FreeBSD.org Precedence: bulk X-Loop: FreeBSD.ORG X-SpamGuard: checked X-SpamScore: 0.0|10 Subject: cvs commit: src/sys/kern uipc_socket2.c uipc_usrreq.c src/sys/modules/null Makefile src/sys/net raw_usrreq.c rtsock.c src/sys/netatalk ddp_usrreq.c src/sys/netatm atm_aal5.c atm_usrreq.c src/sys/netgraph ng_socket.c ... X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Nov 2003 00:40:38 -0000 rwatson 2003/11/17 16:39:07 PST FreeBSD src repository Modified files: sys/kern uipc_socket2.c uipc_usrreq.c sys/modules/null Makefile sys/net raw_usrreq.c rtsock.c sys/netatalk ddp_usrreq.c sys/netatm atm_aal5.c atm_usrreq.c sys/netgraph ng_socket.c sys/netgraph/bluetooth/socket ng_btsocket.c sys/netinet in_pcb.c in_pcb.h ip_divert.c raw_ip.c tcp_input.c tcp_usrreq.c udp_usrreq.c sys/netinet6 raw_ip6.c udp6_usrreq.c sys/netipsec keysock.c sys/netipx ipx_usrreq.c spx_usrreq.c sys/netkey keysock.c sys/netnatm natm.c sys/security/mac mac_net.c sys/security/mac_biba mac_biba.c sys/security/mac_ifoff mac_ifoff.c sys/security/mac_lomac mac_lomac.c sys/security/mac_mls mac_mls.c sys/security/mac_stub mac_stub.c sys/security/mac_test mac_test.c sys/sys mac.h mac_policy.h protosw.h Log: Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Revision Changes Path 1.118 +10 -0 src/sys/kern/uipc_socket2.c 1.112 +1 -1 src/sys/kern/uipc_usrreq.c 1.2 +1 -0 src/sys/modules/null/Makefile 1.30 +1 -1 src/sys/net/raw_usrreq.c 1.96 +1 -1 src/sys/net/rtsock.c 1.33 +2 -1 src/sys/netatalk/ddp_usrreq.c 1.18 +2 -1 src/sys/netatm/atm_aal5.c 1.21 +4 -0 src/sys/netatm/atm_usrreq.c 1.5 +8 -4 src/sys/netgraph/bluetooth/socket/ng_btsocket.c 1.45 +4 -2 src/sys/netgraph/ng_socket.c 1.131 +40 -7 src/sys/netinet/in_pcb.c 1.66 +3 -0 src/sys/netinet/in_pcb.h 1.79 +1 -1 src/sys/netinet/ip_divert.c 1.121 +2 -2 src/sys/netinet/raw_ip.c 1.215 +2 -2 src/sys/netinet/tcp_input.c 1.88 +2 -2 src/sys/netinet/tcp_usrreq.c 1.141 +2 -2 src/sys/netinet/udp_usrreq.c 1.34 +1 -1 src/sys/netinet6/raw_ip6.c 1.39 +1 -1 src/sys/netinet6/udp6_usrreq.c 1.7 +2 -1 src/sys/netipsec/keysock.c 1.39 +2 -2 src/sys/netipx/ipx_usrreq.c 1.40 +2 -2 src/sys/netipx/spx_usrreq.c 1.26 +2 -1 src/sys/netkey/keysock.c 1.31 +1 -1 src/sys/netnatm/natm.c 1.110 +96 -1 src/sys/security/mac/mac_net.c 1.70 +45 -0 src/sys/security/mac_biba/mac_biba.c 1.8 +13 -0 src/sys/security/mac_ifoff/mac_ifoff.c 1.24 +45 -0 src/sys/security/mac_lomac/mac_lomac.c 1.57 +45 -0 src/sys/security/mac_mls/mac_mls.c 1.35 +28 -0 src/sys/security/mac_stub/mac_stub.c 1.37 +71 -0 src/sys/security/mac_test/mac_test.c 1.51 +7 -0 src/sys/sys/mac.h 1.45 +12 -0 src/sys/sys/mac_policy.h 1.42 +2 -0 src/sys/sys/protosw.h