d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0c59c145ed
freebsd-dev/sys/netinet
History
Christian S.J. Peron 826cef3d75 Fix LOR between the syncache and inpcb locks when MAC is present in the 
kernel.  This LOR snuck in with some of the recent syncache changes.  To
fix this, the inpcb handling was changed:

- Hang a MAC label off the syncache object
- When the syncache entry is initially created, we pickup the PCB lock
  is held because we extract information from it while initializing the
  syncache entry.  While we do this, copy the MAC label associated with
  the PCB and use it for the syncache entry.
- When the packet is transmitted, copy the label from the syncache entry
  to the mbuf so it can be processed by security policies which analyze
  mbuf labels.

This change required that the MAC framework be extended to support the
label copy operations from the PCB to the syncache entry, and then from
the syncache entry to the mbuf.

These functions really should be referencing the syncache structure instead
of the label.  However, due to some of the complexities associated with
exposing this syncache structure we operate directly on it's label pointer.
This should be OK since we aren't making any access control decisions within
this code directly, we are merely allocating and copying label storage so
we can properly initialize mbuf labels for any packets the syncache code
might create.

This also has a nice side effect of caching.  Prior to this change, the
PCB would be looked up/locked for each packet transmitted.  Now the label
is cached at the time the syncache entry is initialized.

Submitted by:	andre [1]
Discussed with:	rwatson

[1] andre submitted the tcp_syncache.c changes
2006-12-13 06:00:57 +00:00
..
libalias Make libalias.conf parsing a bit smarter. 2006-12-01 16:34:53 +00:00
accf_data.c
accf_http.c
icmp6.h
icmp_var.h
if_atm.c
if_atm.h
if_ether.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
if_ether.h
igmp_var.h
igmp.c Improve style(9) conformance of igmp.c. 2006-12-04 00:41:48 +00:00
igmp.h
in_cksum.c
in_gif.c
in_gif.h
in_pcb.c Consistently use #ifdef INET6 rather than mixing and matching with 2006-11-30 10:54:54 +00:00
in_pcb.h
in_proto.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
in_rmx.c
in_systm.h
in_var.h The IPv4 code should clean up multicast group state when an interface 2006-09-28 10:04:07 +00:00
in.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
in.h
ip6.h
ip_carp.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_carp.h Make sure that carp_header is 36 bytes long 2006-12-01 18:37:41 +00:00
ip_divert.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_divert.h
ip_dummynet.c - Use non-recursive mutex. MTX_RECURSE is unnecessary since rev. 1.70 2006-10-29 12:09:24 +00:00
ip_dummynet.h
ip_ecn.c
ip_ecn.h
ip_encap.c
ip_encap.h
ip_fastfwd.c
ip_fw2.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
ip_fw_pfil.c revert last change.. premature.. need to wait until if_ethersubr.c 2006-10-21 00:16:31 +00:00
ip_fw.h
ip_gre.c
ip_gre.h
ip_icmp.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_icmp.h
ip_id.c
ip_input.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_ipsec.c
ip_ipsec.h
ip_mroute.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_mroute.h Nits. 2006-09-29 16:16:41 +00:00
ip_options.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_options.h
ip_output.c Back out revision 1.264. 2006-12-10 13:44:00 +00:00
ip_var.h
ip.h
ipprotosw.h
pim_var.h
pim.h
raw_ip.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
sctp_asconf.c -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_asconf.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_auth.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_auth.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_bsd_addr.c Tons of fixes to get all the 64bit issues removed. 2006-11-05 13:25:18 +00:00
sctp_bsd_addr.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_constants.h In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_crc32.c Revert previous commit, and instead make the expression in rev. 1.2 2006-11-05 14:36:59 +00:00
sctp_crc32.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_header.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_indata.c Turns out we would reset the TSN seq counter during 2006-11-11 15:59:01 +00:00
sctp_indata.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_input.c In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_input.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_lock_bsd.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_os_bsd.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_os.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_output.c In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_output.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_pcb.c -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_pcb.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_peeloff.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_peeloff.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_structs.h -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_timer.c Remove bogus casts that Randall for some reason didn't borrow 2006-11-04 08:19:01 +00:00
sctp_timer.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_uio.h Turns out we would reset the TSN seq counter during 2006-11-11 15:59:01 +00:00
sctp_usrreq.c Fixes an issue with handling of stream reset. When a 2006-11-09 21:01:07 +00:00
sctp_var.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctputil.c In ip6_sprintf no longer use and return one of eight static buffers 2006-12-12 17:44:46 +00:00
sctputil.h In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
tcp_debug.c
tcp_debug.h
tcp_fsm.h
tcp_hostcache.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_input.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_output.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
tcp_reass.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_sack.c
tcp_seq.h
tcp_subr.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
tcp_syncache.c Fix LOR between the syncache and inpcb locks when MAC is present in the 2006-12-13 06:00:57 +00:00
tcp_timer.c Back when we had T/TCP support, we used to apply different 2006-09-07 13:06:00 +00:00
tcp_timer.h if min is greater than max, prefer max over min... I managed to get a 2006-09-25 07:22:39 +00:00
tcp_timewait.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
tcp_usrreq.c Change error codes returned by protocol operations when an inpcb is 2006-11-22 17:16:54 +00:00
tcp_var.h Rewrite of TCP syncookies to remove locking requirements and to enhance 2006-09-13 13:08:27 +00:00
tcp.h
tcpip.h
udp_usrreq.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
udp_var.h
udp.h