freebsd-nq/sys/security
Robert Watson 2d92ec9858 Switch TCP over to using the inpcb label when responding in timed
wait, rather than the socket label.  This avoids reaching up to
the socket layer during connection close, which requires locking
changes.  To do this, introduce MAC Framework entry point
mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond()
instead of calling mac_create_mbuf_from_socket() or
mac_create_mbuf_netlayer().  Introduce MAC Policy entry point
mpo_create_mbuf_from_inpcb(), and implementations for various
policies, which generally just copy label data from the inpcb to
the mbuf.  Assert the inpcb lock in the entry point since we
require consistency for the inpcb label reference.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
2003-12-17 14:55:11 +00:00
..
mac Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00
mac_biba Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00
mac_bsdextended
mac_ifoff
mac_lomac Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00
mac_mls Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00
mac_none
mac_partition
mac_portacl
mac_seeotheruids
mac_stub Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00
mac_test Switch TCP over to using the inpcb label when responding in timed 2003-12-17 14:55:11 +00:00