Re: m_pkthdr.label now moved to m_tag

From: Robert Watson <rwatson_at_FreeBSD.org>
Date: Tue, 15 Apr 2003 08:55:04 -0400 (EDT)
On Tue, 15 Apr 2003, Ilmar S. Habibulin wrote:

> On Mon, 14 Apr 2003, Robert Watson wrote:
> 
> > Incidentally, this should also fix a number of WITNESS warnings when
> > running with labeled MAC policies because it cleans up some bugs in the
> > mapping of mbuf allocator flags to malloc flags, and also more cleanly
> > avoids blocking allocations during certain classes of mbuf head copies.
> 
> So now it is possible to implement IP packet labeling? Or this feature
> would not be included? 

This change is in the implementation details regarding how internalized
labels are stamped onto m_tag's -- it doesn't make any changes to where
those labels come from.  As with before, I think the three most useful
approaches to take are CIPSO, IPsec, and firewall-derived labels, none of
which are implemented in the base system or MAC tree currently. 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert_at_fledge.watson.org      Network Associates Laboratories
Received on Tue Apr 15 2003 - 03:54:48 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:03 UTC