Date: Tue, 15 Apr 2003 08:55:04 -0400 (EDT) From: Robert Watson <rwatson@FreeBSD.org> To: "Ilmar S. Habibulin" <ilmar@watson.org> Cc: current@FreeBSD.org Subject: Re: m_pkthdr.label now moved to m_tag Message-ID: <Pine.NEB.3.96L.1030415085343.59471J-100000@fledge.watson.org> In-Reply-To: <20030415044318.D92160@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 15 Apr 2003, Ilmar S. Habibulin wrote: > On Mon, 14 Apr 2003, Robert Watson wrote: > > > Incidentally, this should also fix a number of WITNESS warnings when > > running with labeled MAC policies because it cleans up some bugs in the > > mapping of mbuf allocator flags to malloc flags, and also more cleanly > > avoids blocking allocations during certain classes of mbuf head copies. > > So now it is possible to implement IP packet labeling? Or this feature > would not be included? This change is in the implementation details regarding how internalized labels are stamped onto m_tag's -- it doesn't make any changes to where those labels come from. As with before, I think the three most useful approaches to take are CIPSO, IPsec, and firewall-derived labels, none of which are implemented in the base system or MAC tree currently. Robert N M Watson FreeBSD Core Team, TrustedBSD Projects robert@fledge.watson.org Network Associates Laboratories
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.3.96L.1030415085343.59471J-100000>