c488362e1a
kernel access control. Instrument the TCP socket code for packet generation and delivery: label outgoing mbufs with the label of the socket, and check socket and mbuf labels before permitting delivery to a socket. Assign labels to newly accepted connections when the syncache/cookie code has done its business. Also set peer labels as convenient. Currently, MAC policies cannot influence the PCB matching algorithm, so cannot implement polyinstantiation. Note that there is at least one case where a PCB is not available due to the TCP packet not being associated with any socket, so we don't label in that case, but need to handle it in a special manner. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs |
||
---|---|---|
.. | ||
libalias | ||
accf_data.c | ||
accf_http.c | ||
icmp6.h | ||
icmp_var.h | ||
if_atm.c | ||
if_atm.h | ||
if_ether.c | ||
if_ether.h | ||
igmp_var.h | ||
igmp.c | ||
igmp.h | ||
in_cksum.c | ||
in_gif.c | ||
in_gif.h | ||
in_pcb.c | ||
in_pcb.h | ||
in_proto.c | ||
in_rmx.c | ||
in_systm.h | ||
in_var.h | ||
in.c | ||
in.h | ||
ip6.h | ||
ip_divert.c | ||
ip_dummynet.c | ||
ip_dummynet.h | ||
ip_ecn.c | ||
ip_ecn.h | ||
ip_encap.c | ||
ip_encap.h | ||
ip_flow.c | ||
ip_flow.h | ||
ip_fw2.c | ||
ip_fw.c | ||
ip_fw.h | ||
ip_icmp.c | ||
ip_icmp.h | ||
ip_id.c | ||
ip_input.c | ||
ip_mroute.c | ||
ip_mroute.h | ||
ip_output.c | ||
ip_var.h | ||
ip.h | ||
ipprotosw.h | ||
raw_ip.c | ||
tcp_debug.c | ||
tcp_debug.h | ||
tcp_fsm.h | ||
tcp_input.c | ||
tcp_output.c | ||
tcp_reass.c | ||
tcp_seq.h | ||
tcp_subr.c | ||
tcp_syncache.c | ||
tcp_timer.c | ||
tcp_timer.h | ||
tcp_timewait.c | ||
tcp_usrreq.c | ||
tcp_var.h | ||
tcp.h | ||
tcpip.h | ||
udp_usrreq.c | ||
udp_var.h | ||
udp.h |