m_pkthdr.label now moved to m_tag
Robert Watson
rwatson at FreeBSD.org
Tue Apr 15 05:54:48 PDT 2003
On Tue, 15 Apr 2003, Ilmar S. Habibulin wrote:
> On Mon, 14 Apr 2003, Robert Watson wrote:
>
> > Incidentally, this should also fix a number of WITNESS warnings when
> > running with labeled MAC policies because it cleans up some bugs in the
> > mapping of mbuf allocator flags to malloc flags, and also more cleanly
> > avoids blocking allocations during certain classes of mbuf head copies.
>
> So now it is possible to implement IP packet labeling? Or this feature
> would not be included?
This change is in the implementation details regarding how internalized
labels are stamped onto m_tag's -- it doesn't make any changes to where
those labels come from. As with before, I think the three most useful
approaches to take are CIPSO, IPsec, and firewall-derived labels, none of
which are implemented in the base system or MAC tree currently.
Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org Network Associates Laboratories
More information about the freebsd-current
mailing list