Introduce two new MAC Framework and MAC policy entry points:
mac_reflect_mbuf_icmp() mac_reflect_mbuf_tcp() These entry points permit MAC policies to do "update in place" changes to the labels on ICMP and TCP mbuf headers when an ICMP or TCP response is generated to a packet outside of the context of an existing socket. For example, in respond to a ping or a RST packet to a SYN on a closed port. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
This commit is contained in:
parent
eb8c7f9992
commit
baee0c3e66
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=119245
@ -648,6 +648,9 @@ icmp_reflect(m)
|
||||
goto done;
|
||||
}
|
||||
match:
|
||||
#ifdef MAC
|
||||
mac_reflect_mbuf_icmp(m);
|
||||
#endif
|
||||
t = IA_SIN(ia)->sin_addr;
|
||||
ip->ip_src = t;
|
||||
ip->ip_ttl = ip_defttl;
|
||||
|
@ -488,10 +488,10 @@ tcp_respond(tp, ipgen, th, m, ack, seq, flags)
|
||||
mac_create_mbuf_from_socket(tp->t_inpcb->inp_socket, m);
|
||||
} else {
|
||||
/*
|
||||
* XXXMAC: This will need to call a mac function that
|
||||
* modifies the mbuf label in place for TCP datagrams
|
||||
* not associated with a PCB.
|
||||
* Packet is not associated with a socket, so possibly
|
||||
* update the label in place.
|
||||
*/
|
||||
mac_reflect_mbuf_tcp(m);
|
||||
}
|
||||
#endif
|
||||
nth->th_seq = htonl(seq);
|
||||
|
@ -488,10 +488,10 @@ tcp_respond(tp, ipgen, th, m, ack, seq, flags)
|
||||
mac_create_mbuf_from_socket(tp->t_inpcb->inp_socket, m);
|
||||
} else {
|
||||
/*
|
||||
* XXXMAC: This will need to call a mac function that
|
||||
* modifies the mbuf label in place for TCP datagrams
|
||||
* not associated with a PCB.
|
||||
* Packet is not associated with a socket, so possibly
|
||||
* update the label in place.
|
||||
*/
|
||||
mac_reflect_mbuf_tcp(m);
|
||||
}
|
||||
#endif
|
||||
nth->th_seq = htonl(seq);
|
||||
|
Loading…
Reference in New Issue
Block a user