d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ad6d629763
freebsd-skq/sys/netinet
History
Christian S.J. Peron 826cef3d75 Fix LOR between the syncache and inpcb locks when MAC is present in the 
kernel.  This LOR snuck in with some of the recent syncache changes.  To
fix this, the inpcb handling was changed:

- Hang a MAC label off the syncache object
- When the syncache entry is initially created, we pickup the PCB lock
  is held because we extract information from it while initializing the
  syncache entry.  While we do this, copy the MAC label associated with
  the PCB and use it for the syncache entry.
- When the packet is transmitted, copy the label from the syncache entry
  to the mbuf so it can be processed by security policies which analyze
  mbuf labels.

This change required that the MAC framework be extended to support the
label copy operations from the PCB to the syncache entry, and then from
the syncache entry to the mbuf.

These functions really should be referencing the syncache structure instead
of the label.  However, due to some of the complexities associated with
exposing this syncache structure we operate directly on it's label pointer.
This should be OK since we aren't making any access control decisions within
this code directly, we are merely allocating and copying label storage so
we can properly initialize mbuf labels for any packets the syncache code
might create.

This also has a nice side effect of caching.  Prior to this change, the
PCB would be looked up/locked for each packet transmitted.  Now the label
is cached at the time the syncache entry is initialized.

Submitted by:	andre [1]
Discussed with:	rwatson

[1] andre submitted the tcp_syncache.c changes
2006-12-13 06:00:57 +00:00
..
libalias Make libalias.conf parsing a bit smarter. 2006-12-01 16:34:53 +00:00
accf_data.c
accf_http.c /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
icmp6.h sync with KAME regarding NDP 2005-10-21 16:23:01 +00:00
icmp_var.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
if_atm.c Add newline to debuging printf. 2005-08-26 15:27:18 +00:00
if_atm.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
if_ether.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
if_ether.h Add CARP (Common Address Redundancy Protocol), which allows multiple 2005-02-22 13:04:05 +00:00
igmp_var.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
igmp.c Improve style(9) conformance of igmp.c. 2006-12-04 00:41:48 +00:00
igmp.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
in_cksum.c /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
in_gif.c With exception of the if_name() macro, all definitions in net_osdep.h 2006-08-04 21:27:40 +00:00
in_gif.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
in_pcb.c Consistently use #ifdef INET6 rather than mixing and matching with 2006-11-30 10:54:54 +00:00
in_pcb.h Fix race conditions on enumerating pcb lists by moving the initialization 2006-07-18 22:34:27 +00:00
in_proto.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
in_rmx.c Complete timebase (time_second -> time_uptime) conversion. 2006-07-05 23:37:21 +00:00
in_systm.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
in_var.h The IPv4 code should clean up multicast group state when an interface 2006-09-28 10:04:07 +00:00
in.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
in.h Fix a long-standing limitation in IPv4 multicast group membership. 2006-05-14 14:22:49 +00:00
ip6.h move RFC3542 related definitions into ip6.h. 2005-07-20 10:30:52 +00:00
ip_carp.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_carp.h Make sure that carp_header is 36 bytes long 2006-12-01 18:37:41 +00:00
ip_divert.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_divert.h
ip_dummynet.c - Use non-recursive mutex. MTX_RECURSE is unnecessary since rev. 1.70 2006-10-29 12:09:24 +00:00
ip_dummynet.h When sending a packet from dummynet, indicate that we're forwarding 2006-02-14 06:36:39 +00:00
ip_ecn.c /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
ip_ecn.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
ip_encap.c With exception of the if_name() macro, all definitions in net_osdep.h 2006-08-04 21:27:40 +00:00
ip_encap.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
ip_fastfwd.c Remove the IPFIREWALL_FORWARD_EXTENDED option and make it on by default as it always was 2006-08-17 00:37:03 +00:00
ip_fw2.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
ip_fw_pfil.c revert last change.. premature.. need to wait until if_ethersubr.c 2006-10-21 00:16:31 +00:00
ip_fw.h comply with style police 2006-08-18 22:36:05 +00:00
ip_gre.c Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
ip_gre.h Fix stack corruptions on amd64. 2006-01-21 10:44:34 +00:00
ip_icmp.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_icmp.h Pass icmp_error() the MTU argument directly instead of 2005-05-04 13:09:19 +00:00
ip_id.c /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
ip_input.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_ipsec.c Remove unneeded mac.h include. 2006-07-06 13:25:01 +00:00
ip_ipsec.h Move the IPSEC related code blocks to their own file to unclutter 2006-02-01 13:55:03 +00:00
ip_mroute.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
ip_mroute.h Nits. 2006-09-29 16:16:41 +00:00
ip_options.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
ip_options.h Move MAX_IPOPTLEN and struct ipoption back into ip_var.h as 2005-11-19 14:01:32 +00:00
ip_output.c Back out revision 1.264. 2006-12-10 13:44:00 +00:00
ip_var.h Fix a long-standing limitation in IPv4 multicast group membership. 2006-05-14 14:22:49 +00:00
ip.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
ipprotosw.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
pim_var.h Remove public declarations of variables that were forgotten when they were 2005-08-10 07:10:02 +00:00
pim.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
raw_ip.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
sctp_asconf.c -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_asconf.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_auth.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_auth.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_bsd_addr.c Tons of fixes to get all the 64bit issues removed. 2006-11-05 13:25:18 +00:00
sctp_bsd_addr.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_constants.h In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_crc32.c Revert previous commit, and instead make the expression in rev. 1.2 2006-11-05 14:36:59 +00:00
sctp_crc32.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_header.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_indata.c Turns out we would reset the TSN seq counter during 2006-11-11 15:59:01 +00:00
sctp_indata.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_input.c In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_input.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_lock_bsd.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_os_bsd.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_os.h Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ I 2006-11-03 17:21:53 +00:00
sctp_output.c In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
sctp_output.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_pcb.c -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_pcb.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_peeloff.c Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_peeloff.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_structs.h -Fixes first of all the getcred on IPv6 and V4. The 2006-11-08 00:21:13 +00:00
sctp_timer.c Remove bogus casts that Randall for some reason didn't borrow 2006-11-04 08:19:01 +00:00
sctp_timer.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp_uio.h Turns out we would reset the TSN seq counter during 2006-11-11 15:59:01 +00:00
sctp_usrreq.c Fixes an issue with handling of stream reset. When a 2006-11-09 21:01:07 +00:00
sctp_var.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctp.h Ok, here it is, we finally add SCTP to current. Note that this 2006-11-03 15:23:16 +00:00
sctputil.c In ip6_sprintf no longer use and return one of eight static buffers 2006-12-12 17:44:46 +00:00
sctputil.h In a true restart case, the send_lock was 2006-11-11 22:44:12 +00:00
tcp_debug.c /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
tcp_debug.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
tcp_fsm.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
tcp_hostcache.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_input.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_output.c Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h 2006-10-22 11:52:19 +00:00
tcp_reass.c MFp4: 92972, 98913 + one more change 2006-12-12 12:17:58 +00:00
tcp_sack.c Eliminate debug code that catches bugs in the hinting of sack variables 2006-04-06 17:21:16 +00:00
tcp_seq.h Remove T/TCP RFC1644 Connection Count comparison macros. They are no longer 2006-06-18 14:24:12 +00:00
tcp_subr.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
tcp_syncache.c Fix LOR between the syncache and inpcb locks when MAC is present in the 2006-12-13 06:00:57 +00:00
tcp_timer.c Back when we had T/TCP support, we used to apply different 2006-09-07 13:06:00 +00:00
tcp_timer.h if min is greater than max, prefer max over min... I managed to get a 2006-09-25 07:22:39 +00:00
tcp_timewait.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
tcp_usrreq.c Change error codes returned by protocol operations when an inpcb is 2006-11-22 17:16:54 +00:00
tcp_var.h Rewrite of TCP syncookies to remove locking requirements and to enhance 2006-09-13 13:08:27 +00:00
tcp.h Add missing TH_PUSH to the TH_FLAGS enumeration. 2006-02-18 16:50:08 +00:00
tcpip.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
udp_usrreq.c Sweep kernel replacing suser(9) calls with priv(9) calls, assigning 2006-11-06 13:42:10 +00:00
udp_var.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00
udp.h /* -> /*- for license, minor formatting changes 2005-01-07 01:45:51 +00:00