PERFORCE change 113362 for review

Todd Miller millert at FreeBSD.org
Mon Jan 22 16:23:25 UTC 2007


http://perforce.freebsd.org/chv.cgi?CH=113362

Change 113362 by millert at millert_macbook on 2007/01/22 16:22:40

	Add address family and socket type to mac_ifnet_check_transmit()
	and mac_inpcb_check_deliver() so we have the info sedarwin
	needs to make policy decisions for ifnets.
	
	This requires a hack to find the socket type of an mbuf for
	mac_ifnet_check_transmit().  A better solution may be
	possible by changing where the entrypoint is called.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/net/dlil.c#7 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/raw_ip.c#8 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/tcp_input.c#8 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/udp_usrreq.c#4 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_framework.h#38 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_inet.c#4 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_net.c#13 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_policy.h#46 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/net/dlil.c#7 (text+ko) ====

@@ -1023,6 +1023,47 @@
 	return result;
 }
 
+#ifdef MAC
+#include <netinet/ip6.h>
+#include <netinet/ip.h>
+static int dlil_get_socket_type(struct mbuf **mp, int family, int raw)
+{
+	struct mbuf *m;
+	struct ip *ip;
+	struct ip6_hdr *ip6;
+	int type = SOCK_RAW;
+
+	if (!raw) {
+		switch (family) {
+		case PF_INET:
+			m = m_pullup(*mp, sizeof(struct ip));
+			if (m == NULL)
+				break;
+			*mp = m;
+			ip = mtod(m, struct ip *);
+			if (ip->ip_p == IPPROTO_TCP)
+				type = SOCK_STREAM;
+			else if (ip->ip_p == IPPROTO_UDP)
+				type = SOCK_DGRAM;
+			break;
+		case PF_INET6:
+			m = m_pullup(*mp, sizeof(struct ip6_hdr));
+			if (m == NULL)
+				break;
+			*mp = m;
+			ip6 = mtod(m, struct ip6_hdr *);
+			if (ip6->ip6_nxt == IPPROTO_TCP)
+				type = SOCK_STREAM;
+			else if (ip6->ip6_nxt == IPPROTO_UDP)
+				type = SOCK_DGRAM;
+			break;
+		}
+	}
+
+	return (type);
+}
+#endif
+
 int
 dlil_output_list(
 	struct ifnet* ifp,
@@ -1094,7 +1135,8 @@
 
 	do {
 #ifdef MAC
-		retval = mac_ifnet_check_transmit(ifp, m);
+		retval = mac_ifnet_check_transmit(ifp, m, proto_family,
+		    dlil_get_socket_type(&m, proto_family, raw));
 		if (retval) {
 			m_freem(m);
 			goto cleanup;
@@ -1227,7 +1269,8 @@
 	}
 
 #ifdef MAC
-	retval = mac_ifnet_check_transmit(ifp, m);
+	retval = mac_ifnet_check_transmit(ifp, m, proto_family,
+	    dlil_get_socket_type(&m, proto_family, raw));
 	if (retval) {
 		m_freem(m);
 		goto cleanup;

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/raw_ip.c#8 (text+ko) ====

@@ -228,7 +228,8 @@
 #endif /*IPSEC*/
 #ifdef MAC
 			if (n && skipit == 0) {
-				if (mac_inpcb_check_deliver(last, n) != 0)
+				if (mac_inpcb_check_deliver(last, n, AF_INET,
+				    SOCK_RAW) != 0)
 					skipit = 1;
 			}
 #endif
@@ -277,7 +278,7 @@
 #endif /*IPSEC*/
 #ifdef MAC
 	if (last && skipit == 0) {
-		if (mac_inpcb_check_deliver(last, m) != 0)
+		if (mac_inpcb_check_deliver(last, m, AF_INET, SOCK_RAW) != 0)
 			skipit = 1;
 	}
 #endif

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/tcp_input.c#8 (text+ko) ====

@@ -911,7 +911,7 @@
 		tiwin = th->th_win;
 
 #ifdef MAC
-	if (mac_inpcb_check_deliver(inp, m))
+	if (mac_inpcb_check_deliver(inp, m, AF_INET, SOCK_STREAM))
 		goto drop;
 #endif
 

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/netinet/udp_usrreq.c#4 (text+ko) ====

@@ -697,7 +697,7 @@
 	struct mbuf *opts = 0;
 
 #ifdef MAC
-	if (mac_inpcb_check_deliver(last, n) != 0) {
+	if (mac_inpcb_check_deliver(last, n, AF_INET, SOCK_DGRAM) != 0) {
 		m_freem(n);
 		return;
 	}

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_framework.h#38 (text+ko) ====

@@ -154,7 +154,8 @@
 void	mac_file_label_associate(struct ucred *cred, struct fileglob *fg);
 void	mac_file_label_destroy(struct fileglob *fg);
 void	mac_file_label_init(struct fileglob *fg);
-int	mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf);
+int	mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf,
+	    int family, int type);
 void	mac_ifnet_label_associate(struct ifnet *ifp);
 void	mac_ifnet_label_destroy(struct ifnet *ifp);
 int	mac_ifnet_label_get(struct ucred *cred, struct ifreq *ifr,
@@ -163,7 +164,8 @@
 void	mac_ifnet_label_recycle(struct ifnet *ifp);
 int	mac_ifnet_label_set(struct ucred *cred, struct ifreq *ifr,
 	    struct ifnet *ifp);
-int	mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf);
+int	mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *mbuf,
+	    int family, int type);
 void	mac_inpcb_label_associate(struct socket *so, struct inpcb *inp);
 void	mac_inpcb_label_destroy(struct inpcb *inp);
 int	mac_inpcb_label_init(struct inpcb *inp, int flag);

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_inet.c#4 (text+ko) ====

@@ -246,7 +246,7 @@
 }
 
 int
-mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m)
+mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m, int family, int type)
 {
 	struct label *label;
 	int error;
@@ -256,7 +256,8 @@
 
 	label = mac_mbuf_to_label(m);
 
-	MAC_CHECK(inpcb_check_deliver, inp, inp->inp_label, m, label);
+	MAC_CHECK(inpcb_check_deliver, inp, inp->inp_label, m, label,
+	    family, type);
 
 	return (error);
 }

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_net.c#13 (text+ko) ====

@@ -377,7 +377,8 @@
 }
 
 int
-mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf)
+mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf, int family,
+    int type)
 {
 	struct label *label;
 	int error;
@@ -385,7 +386,8 @@
 	label = mac_mbuf_to_label(mbuf);
 
 	ifnet_lock_shared(ifp);
-	MAC_CHECK(ifnet_check_transmit, ifp, ifp->if_label, mbuf, label);
+	MAC_CHECK(ifnet_check_transmit, ifp, ifp->if_label, mbuf, label,
+	    family, type);
 	ifnet_lock_done(ifp);
 
 	return (error);

==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_policy.h#46 (text+ko) ====

@@ -900,6 +900,8 @@
   @param ifnetlabel Label of the network interfaces
   @param m The mbuf to be transmitted
   @param mbuflabel Label of the mbuf to be transmitted
+  @param family Address Family, AF_*
+  @param type Type of socket, SOCK_{STREAM,DGRAM,RAW}
 
   Determine whether the mbuf with label mbuflabel may be transmitted
   through the network interface represented by ifp that has the
@@ -912,7 +914,9 @@
 	struct ifnet *ifp,
 	struct label *ifnetlabel,
 	struct mbuf *m,
-	struct label *mbuflabel
+	struct label *mbuflabel,
+	int family,
+	int type
 );
 /**
   @brief Create a network interface label
@@ -1036,6 +1040,8 @@
   @param inplabel Label of the inpcb
   @param m The mbuf being received
   @param mbuflabel Label of the mbuf being received
+  @param family Address family, AF_*
+  @param type Type of socket, SOCK_{STREAM,DGRAM,RAW}
 
   Determine whether the mbuf with label mbuflabel may be received
   by the socket associated with inpcb that has the label inplabel.
@@ -1047,7 +1053,9 @@
 	struct inpcb *inp,
 	struct label *inplabel,
 	struct mbuf *m,
-	struct label *mbuflabel
+	struct label *mbuflabel,
+	int family,
+	int type
 );
 /**
   @brief Create an inpcb label


More information about the trustedbsd-cvs mailing list