Christian S.J. Peron d94f2a68f8 Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point ... exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate		2006-09-12 04:25:13 +00:00
..
libalias	o Kill BUGS section as it is not valid since rev. 1.4 alias_pptp.c.	2006-07-04 20:39:38 +00:00
accf_data.c	add missing #include <sys/module.h>	2004-05-30 20:27:19 +00:00
accf_http.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
icmp6.h	sync with KAME regarding NDP	2005-10-21 16:23:01 +00:00
icmp_var.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
if_atm.c	Add newline to debuging printf.	2005-08-26 15:27:18 +00:00
if_atm.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
if_ether.c	There is a consensus that ifaddr.ifa_addr should never be NULL,	2006-06-29 19:22:05 +00:00
if_ether.h	Add CARP (Common Address Redundancy Protocol), which allows multiple	2005-02-22 13:04:05 +00:00
igmp.c	Consolidate all IP Options handling functions into ip_options.[ch] and	2005-11-18 20:12:40 +00:00
igmp.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
igmp_var.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
in.c	In in_control() remove the temporary in_ifaddr structure from the	2006-01-24 16:19:31 +00:00
in.h	Fix a long-standing limitation in IPv4 multicast group membership.	2006-05-14 14:22:49 +00:00
in_cksum.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
in_gif.c	With exception of the if_name() macro, all definitions in net_osdep.h	2006-08-04 21:27:40 +00:00
in_gif.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
in_pcb.c	o Backout rev. 1.125 of in_pcb.c. It appeared to behave extremely	2006-09-06 13:56:35 +00:00
in_pcb.h	Fix race conditions on enumerating pcb lists by moving the initialization	2006-07-18 22:34:27 +00:00
in_proto.c	Add RFC 3378 EtherIP support. This change makes it possible to add gif	2005-12-21 21:29:45 +00:00
in_rmx.c	Complete timebase (time_second -> time_uptime) conversion.	2006-07-05 23:37:21 +00:00
in_systm.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
in_var.h	Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer	2006-01-18 14:24:39 +00:00
ip.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
ip6.h	move RFC3542 related definitions into ip6.h.	2005-07-20 10:30:52 +00:00
ip_carp.c	Revise network interface cloning to take an optional opaque	2006-07-09 06:04:01 +00:00
ip_carp.h	o Introduce carp_multicast_cleanup(), which removes and frees	2006-03-21 14:29:48 +00:00
ip_divert.c	Fix race conditions on enumerating pcb lists by moving the initialization	2006-07-18 22:34:27 +00:00
ip_divert.h	Convert IPDIVERT into a loadable module. This makes use of the dynamic loadability	2004-10-19 21:14:57 +00:00
ip_dummynet.c	Fix following rules: pipe X (tag|altq) Y ...	2006-06-08 11:13:23 +00:00
ip_dummynet.h	When sending a packet from dummynet, indicate that we're forwarding	2006-02-14 06:36:39 +00:00
ip_ecn.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
ip_ecn.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
ip_encap.c	With exception of the if_name() macro, all definitions in net_osdep.h	2006-08-04 21:27:40 +00:00
ip_encap.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
ip_fastfwd.c	Remove the IPFIREWALL_FORWARD_EXTENDED option and make it on by default as it always was	2006-08-17 00:37:03 +00:00
ip_fw.h	comply with style police	2006-08-18 22:36:05 +00:00
ip_fw2.c	Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point	2006-09-12 04:25:13 +00:00
ip_fw_pfil.c	Reintroduce net.inet6.ip6.fw.enable sysctl to dis/enable the ipv6 processing	2006-05-12 04:41:27 +00:00
ip_gre.c	Fix the following bpf(4) race condition which can result in a panic:	2006-06-02 19:59:33 +00:00
ip_gre.h	Fix stack corruptions on amd64.	2006-01-21 10:44:34 +00:00
ip_icmp.c	Add descriptions for the sysctls:	2006-03-20 21:44:12 +00:00
ip_icmp.h	Pass icmp_error() the MTU argument directly instead of	2005-05-04 13:09:19 +00:00
ip_id.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
ip_input.c	Remove the IPFIREWALL_FORWARD_EXTENDED option and make it on by default as it always was	2006-08-17 00:37:03 +00:00
ip_ipsec.c	Remove unneeded mac.h include.	2006-07-06 13:25:01 +00:00
ip_ipsec.h	Move the IPSEC related code blocks to their own file to unclutter	2006-02-01 13:55:03 +00:00
ip_mroute.c	Initialize the new members of struct ip_moptions as	2006-05-18 19:51:08 +00:00
ip_mroute.h	Brain-o (use standard int types now).	2006-02-01 06:15:37 +00:00
ip_options.c	Remove 'ipprintfs' which were protected under DIAGNOSTIC. It doesn't	2005-11-19 17:04:52 +00:00
ip_options.h	Move MAX_IPOPTLEN and struct ipoption back into ip_var.h as	2005-11-19 14:01:32 +00:00
ip_output.c	Fix a NULL pointer dereference of ro->ro_rt->rt_flags by checking for the	2006-09-11 19:56:10 +00:00
ip_var.h	Fix a long-standing limitation in IPv4 multicast group membership.	2006-05-14 14:22:49 +00:00
ipprotosw.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
pim.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
pim_var.h	Remove public declarations of variables that were forgotten when they were	2005-08-10 07:10:02 +00:00
raw_ip.c	Check inp_flags instead of inp_vflag for INP_ONESBCAST flag.	2006-09-06 19:04:36 +00:00
tcp.h	Add missing TH_PUSH to the TH_FLAGS enumeration.	2006-02-18 16:50:08 +00:00
tcp_debug.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
tcp_debug.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
tcp_fsm.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
tcp_hostcache.c	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
tcp_input.c	Back when we had T/TCP support, we used to apply different	2006-09-07 13:06:00 +00:00
tcp_output.c	Second step of TSO (TCP segmentation offload) support in our network stack.	2006-09-07 12:53:01 +00:00
tcp_reass.c	Back when we had T/TCP support, we used to apply different	2006-09-07 13:06:00 +00:00
tcp_sack.c	Eliminate debug code that catches bugs in the hinting of sack variables	2006-04-06 17:21:16 +00:00
tcp_seq.h	Remove T/TCP RFC1644 Connection Count comparison macros. They are no longer	2006-06-18 14:24:12 +00:00
tcp_subr.c	Add a sysctl net.inet.tcp.nolocaltimewait that allows to suppress	2006-09-08 13:09:15 +00:00
tcp_syncache.c	In syncache_respond() do not reply with a MSS that is larger than what	2006-06-26 17:54:53 +00:00
tcp_timer.c	Back when we had T/TCP support, we used to apply different	2006-09-07 13:06:00 +00:00
tcp_timer.h	Back when we had T/TCP support, we used to apply different	2006-09-07 13:06:00 +00:00
tcp_timewait.c	Add a sysctl net.inet.tcp.nolocaltimewait that allows to suppress	2006-09-08 13:09:15 +00:00
tcp_usrreq.c	Change semantics of socket close and detach. Add a new protocol switch	2006-07-21 17:11:15 +00:00
tcp_var.h	Back when we had T/TCP support, we used to apply different	2006-09-07 13:06:00 +00:00
tcpip.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
udp.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00
udp_usrreq.c	Check inp_flags instead of inp_vflag for INP_ONESBCAST flag.	2006-09-06 19:04:36 +00:00
udp_var.h	/* -> /*- for license, minor formatting changes	2005-01-07 01:45:51 +00:00