Index: lib/libipsec/pfkey_dump.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/lib/libipsec/pfkey_dump.c,v
retrieving revision 1.1
diff -c -r1.1 pfkey_dump.c
*** lib/libipsec/pfkey_dump.c	12 Dec 2001 09:17:08 -0000	1.1
--- lib/libipsec/pfkey_dump.c	27 Feb 2002 13:48:50 -0000
***************
*** 361,366 ****
--- 361,377 ----
  	/* XXX DEBUG */
  	printf("refcnt=%u\n", m->sadb_msg_reserved);
  
+ 	if(m_sens) {
+ 		printf("\tMAC label: DPD=%x, sens_level=%d, integ_level=%d\n",
+ 			m_sens->sadb_sens_dpd, m_sens->sadb_sens_sens_level,
+ 			m_sens->sadb_sens_integ_level);
+ 		printf("\tcompartments: {");
+ 		ipsec_hexdump((caddr_t)m_sens + sizeof(struct sadb_sens),
+ 			m_sens->sadb_sens_sens_len +
+ 			m_sens->sadb_sens_integ_len);
+ 		printf(" }\n");
+ 	}
+ 
  	return;
  }
  
Index: sys/dev/bge/if_bge.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/dev/bge/if_bge.c,v
retrieving revision 1.5
diff -c -r1.5 if_bge.c
*** sys/dev/bge/if_bge.c	1 Feb 2002 20:30:38 -0000	1.5
--- sys/dev/bge/if_bge.c	4 Mar 2002 09:58:12 -0000
***************
*** 72,77 ****
--- 72,78 ----
  
  #include <sys/param.h>
  #include <sys/systm.h>
+ #include <sys/mac.h>
  #include <sys/sockio.h>
  #include <sys/mac.h>
  #include <sys/mbuf.h>
Index: sys/dev/gx/if_gx.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/dev/gx/if_gx.c,v
retrieving revision 1.3
diff -c -r1.3 if_gx.c
*** sys/dev/gx/if_gx.c	12 Dec 2001 10:47:02 -0000	1.3
--- sys/dev/gx/if_gx.c	4 Mar 2002 09:58:12 -0000
***************
*** 33,38 ****
--- 33,39 ----
  #include <sys/systm.h>
  #include <sys/mac.h>
  #include <sys/sockio.h>
+ #include <sys/mac.h>
  #include <sys/mbuf.h>
  #include <sys/malloc.h>
  #include <sys/kernel.h>
Index: sys/dev/streams/streams.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/dev/streams/streams.c,v
retrieving revision 1.3
diff -c -r1.3 streams.c
*** sys/dev/streams/streams.c	1 Feb 2002 20:31:08 -0000	1.3
--- sys/dev/streams/streams.c	4 Mar 2002 09:58:12 -0000
***************
*** 38,43 ****
--- 38,44 ----
  #include <sys/kernel.h>		/* SYSINIT stuff */
  #include <sys/conf.h>		/* cdevsw stuff */
  #include <sys/malloc.h>		/* malloc region definitions */
+ #include <sys/mac.h>
  #include <sys/file.h>
  #include <sys/filedesc.h>
  #include <sys/unistd.h>
Index: sys/kern/sys_socket.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/kern/sys_socket.c,v
retrieving revision 1.4
diff -c -r1.4 sys_socket.c
*** sys/kern/sys_socket.c	1 Feb 2002 20:31:38 -0000	1.4
--- sys/kern/sys_socket.c	4 Mar 2002 09:58:45 -0000
***************
*** 38,43 ****
--- 38,44 ----
  #include <sys/systm.h>
  #include <sys/file.h>
  #include <sys/protosw.h>
+ #include <sys/mac.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/filio.h>			/* XXX */
Index: sys/net/raw_cb.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/net/raw_cb.c,v
retrieving revision 1.2
diff -c -r1.2 raw_cb.c
*** sys/net/raw_cb.c	12 Dec 2001 10:02:24 -0000	1.2
--- sys/net/raw_cb.c	4 Mar 2002 09:58:46 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include <sys/param.h>
  #include <sys/malloc.h>
+ #include <sys/mac.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/domain.h>
Index: sys/netinet/accf_http.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/accf_http.c,v
retrieving revision 1.2
diff -c -r1.2 accf_http.c
*** sys/netinet/accf_http.c	12 Dec 2001 09:48:09 -0000	1.2
--- sys/netinet/accf_http.c	4 Mar 2002 11:16:45 -0000
***************
*** 33,39 ****
  #include <sys/kernel.h>
  #include <sys/sysctl.h>
  #include <sys/socketvar.h>
- #include <sys/mac.h>
  #include <sys/mbuf.h>
  
  /* check for GET/HEAD */
--- 33,38 ----
Index: sys/netinet/in_pcb.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/in_pcb.c,v
retrieving revision 1.6
diff -c -r1.6 in_pcb.c
*** sys/netinet/in_pcb.c	1 Feb 2002 20:34:08 -0000	1.6
--- sys/netinet/in_pcb.c	6 Mar 2002 13:30:19 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_ipsec.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
***************
*** 60,68 ****
--- 61,71 ----
  #include <net/route.h>
  
  #include <netinet/in.h>
+ #include <netinet/in_systm.h>
  #include <netinet/in_pcb.h>
  #include <netinet/in_var.h>
  #include <netinet/ip_var.h>
+ #include <netinet/ip.h>
  #ifdef INET6
  #include <netinet/ip6.h>
  #include <netinet6/ip6_var.h>
***************
*** 170,175 ****
--- 173,183 ----
  	if (ip6_auto_flowlabel)
  		inp->inp_flags |= IN6P_AUTOFLOWLABEL;
  #endif
+ 	/* XXX: dirty hack right now - only for IPv4 */
+ 	inp->inp_options = makeCIPSO(&so->so_label);
+ 	/*if(!inp->inp_options)
+ 	   printf("in_pcballoc(): inp->inp_options %x\n", inp->inp_options);*/
+ 
  	return (0);
  }
  
***************
*** 1041,1043 ****
--- 1049,1143 ----
  		return (0);
  	return (1);
  }
+ 
+ #if defined(MAC_MLS)
+ 
+ struct mbuf * makeCIPSO(mac_t label)
+ {
+ 	struct mbuf *m = NULL;
+ 	struct ipoption opt;
+ 	/* This is TYPE 1 CIPSO security label for transfering level and
+ 	 * compartment. XXX: there is no compartment right now
+ 	 */
+ 	char sec_label1[] = {	134, 0, 0xFF, 0xFF, 0xFF, 0xFF, 1, 8, 0, 
+ 				0, 0, 0, 0, 0 };
+ 	u_int	sec_label1_len = sizeof(sec_label1);
+ 	/* This is TYPE 7 CIPSO security label for transfering special label
+ 	 * EQUAL in UDP packets. XXX: DIRTY HACK!!!
+ 	 */
+ 	char sec_label2[] = {	134, 0, 0xFF, 0xFF, 0xFF, 0xFF, 7, 5, 
+ 				'E', 'Q', 'U', 'A', 'L' };
+ 	u_int	sec_label2_len = sizeof(sec_label2);
+ 	u_int32_t bitmask;
+ 	int i;
+ 
+ 	if(label->m_mls.mm_flags & MAC_MLS_FLAG_SINGLE)
+ 	  switch(label->m_mls.mm_single.mme_type) {
+ 		default: printf("MAC: invalid MAC label in makeCIPSO\n");break;
+ 
+ 		case MAC_MLS_TYPE_LOW:
+ 			break;
+ 
+ 		case MAC_MLS_TYPE_HIGH:
+ 			break;
+ 
+ 		case MAC_MLS_TYPE_EQUAL:
+ 
+ 			/* XXX: fill output label structure */
+ 			/* Option should look like that:
+ 			 * +---+---+------------+---+---+---+---+---+---+---+
+ 			 * |134| 14| 0xFFFFFFFF | 7 | 5 | E | Q | U | A | L |
+ 			 * +---+---+------------+---+---+---+---+---+---+---+
+ 			 */
+ 
+ 			bzero(&opt, sizeof(struct ipoption));
+ 			bcopy(sec_label2, opt.ipopt_list, sec_label2_len);
+ 			MGET(m, M_DONTWAIT, MT_DATA);
+ 			bcopy(&opt, mtod(m,caddr_t), sizeof(struct ipoption));
+ 			m->m_len = sec_label2_len + sizeof(opt.ipopt_dst) + 2; /* align! */
+ 			break;
+ 
+ 		case MAC_MLS_TYPE_LEVEL:
+ 
+ 			/* XXX: fill output label structure */
+ 			/* Option should look like that:
+ 			 * +---+---+------------+---+---+---+---+------------+
+ 			 * |134| 14| 0xFFFFFFFF | 1 | 8 | 0 | ? | ?????????? |
+ 			 * +---+---+------------+---+---+---+---+------------+
+ 			 */
+ 
+ 			bzero(&opt, sizeof(struct ipoption));
+ 			sec_label1[IPOPT_OLEN] = (u_char)sec_label1_len;
+ 			sec_label1[CIPSO_ST_TLEVEL] =
+ 				label->m_mls.mm_single.mme_level;
+ 			/*
+ 			bitmask = htonl(label->compartment);
+ 			bcopy(&bitmask, &sec_label[CIPSO_STT1_BMOFFSET], 
+ 				sizeof(u_int32_t));*/
+ 			bcopy(sec_label1, opt.ipopt_list, sec_label1_len);
+ 			MGET(m, M_DONTWAIT, MT_DATA);
+ 			bcopy(&opt, mtod(m,caddr_t), sizeof(struct ipoption));
+ 			m->m_len = sec_label1_len + sizeof(opt.ipopt_dst) + 2; /* align! */
+ 
+ 		/*	printf("makeCIPSO(): ");
+ 			if(!m)
+ 				printf(" failed to allocate mbuf");
+ 			else
+ 				for(i = 0; i < m->m_len; i++)
+ 					printf("|%x", ((int)*(m->m_data+i))&0x000000FF);
+ 			printf("\n");*/
+ 			break;
+ 	} /* switch mme_type */
+ 
+ 	return (m);
+ }
+ 
+ void remakeCIPSO(struct socket *so)
+ {
+ 	struct inpcb *inp = sotoinpcb(so);
+ 	/* XXX: FIX IT!!! */
+ 	if(inp->inp_options)
+ 		m_free(inp->inp_options);
+ 	inp->inp_options = makeCIPSO(&so->so_label);
+ }
+ #endif
Index: sys/netinet/in_pcb.h
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/in_pcb.h,v
retrieving revision 1.3
diff -c -r1.3 in_pcb.h
*** sys/netinet/in_pcb.h	12 Dec 2001 10:44:39 -0000	1.3
--- sys/netinet/in_pcb.h	4 Mar 2002 09:58:51 -0000
***************
*** 336,341 ****
--- 336,343 ----
  int	in_setsockaddr __P((struct socket *so, struct sockaddr **nam));
  void	in_pcbremlists __P((struct inpcb *inp));
  int	prison_xinpcb __P((struct proc *p, struct inpcb *inp));
+ struct mbuf * makeCIPSO(mac_t );
+ void remakeCIPSO(struct socket *);
  #endif /* _KERNEL */
  
  #endif /* !_NETINET_IN_PCB_H_ */
Index: sys/netinet/ip.h
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/ip.h,v
retrieving revision 1.2
diff -c -r1.2 ip.h
*** sys/netinet/ip.h	26 Dec 2001 02:22:41 -0000	1.2
--- sys/netinet/ip.h	4 Mar 2002 09:58:51 -0000
***************
*** 138,143 ****
--- 138,155 ----
  #define	IPOPT_OLEN		1		/* option length */
  #define IPOPT_OFFSET		2		/* offset within option */
  #define	IPOPT_MINOFF		4		/* min value of above */
+ /* CIPSO enhansments */
+ #define CIPSO_STSN_OFFSET	2	/* CIPSO Security Tag Set Name offset */
+ #define CIPSO_STSN_LEN		4	/* CIPSO Security Tag Set Name length */
+ #define CIPSO_ST_TOFFSET	6	/* CIPSO Security Tag Type offset */
+ #define CIPSO_ST_TLEN		7	/* CIPSO Security Tag Type length */
+ #define CIPSO_ST_TLEVEL		9	/* CIPSO Security Level for types 1-6 */
+ #define CIPSO_STT1_BMOFFSET	10	/* CIPSO Security Tag Type 1 bitmap */
+ #define	CIPSO_ST_TYPE1		1 /* 00000001b CIPSO Security Tag Type 1 */
+ #define	CIPSO_ST_TYPE2		2 /* 00000010b CIPSO Security Tag Type 1 */
+ #define	CIPSO_ST_TYPE5		5 /* 00000101b CIPSO Security Tag Type 1 */
+ #define	CIPSO_ST_TYPE6		6 /* 00000110b CIPSO Security Tag Type 1 */
+ #define	CIPSO_ST_TYPE7		7 /* 00000111b CIPSO Security Tag Type 1 */
  
  /*
   * Time stamp option structure.
Index: sys/netinet/ip_input.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/ip_input.c,v
retrieving revision 1.9
diff -c -r1.9 ip_input.c
*** sys/netinet/ip_input.c	3 Feb 2002 01:50:29 -0000	1.9
--- sys/netinet/ip_input.c	6 Mar 2002 13:50:35 -0000
***************
*** 46,51 ****
--- 46,52 ----
  #include "opt_mac.h"
  #include "opt_pfil_hooks.h"
  #include "opt_random_ip_id.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
***************
*** 1202,1207 ****
--- 1203,1214 ----
  	int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0;
  	struct in_addr *sin, dst;
  	n_time ntime;
+ 	u_int32_t	sts_name;	/* Security Tag Set Name */
+ 	int		st_type;	/* Security Tag Type */
+ 	int		st_length;	/* Security Tag Length */
+ 	u_int32_t	st_bitmap;	/* Security Compartment */
+ 	struct mac	packet_label;	/* Local label implementation */
+ 	int i;
  
  	dst = ip->ip_dst;
  	cp = (u_char *)(ip + 1);
***************
*** 1224,1229 ****
--- 1231,1342 ----
  			}
  		}
  		switch (opt) {
+ 
+ 		case IPOPT_CIPSO:
+ /*			printf("IP options: got CIPSO (opt %d, len %d)\n|",
+ 				opt, optlen);
+ 			for(i=0;i<optlen;i++)
+ 				printf("%x|", cp[i]&0x000000FF);
+ 			printf("\n");*/
+ /* XXX: Start label extraction here. Header parsed, so we know lengths and
+  * borders. Our label TYPE 1 looks like:
+  *                                       0  . . .  31
+  * +---+---+------------+---+---+---+---+------------+
+  * |   |   |            |   |   |   |   |            |
+  * +---+---+------------+---+---+---+---+------------+
+  *   ^   ^        ^       ^   ^   ^   ^       ^
+  *   |   |        |       |   |   |   |       +- bitmask (mac.compartment)
+  *   |   |        |       |   |   |   +- security level (mac.level)
+  *   |   |        |       |   |   +- alignment byte (00000000b)
+  *   |   |        |       |   +- security tag length
+  *   |   |        |       +- security tag type (ours will be 00000001b)
+  *   |   |        +- security tag set name (ours wiil be 0xffffffff)
+  *   |   +- security label length
+  *   +- security label identifier (134 or 10000110b)
+  *
+  * And TYPE 7 looks like:
+  * +---+---+------------+---+---+---------------+
+  * |   |   |            |   |   |               |
+  * +---+---+------------+---+---+---------------+
+  *   ^   ^        ^       ^   ^   ^  
+  *   |   |        |       |   |   +- EQUAL LABEL
+  *   |   |        |       |   +- security tag length
+  *   |   |        |       +- security tag type (ours will be 00000111b)
+  *   |   |        +- security tag set name (ours wiil be 0xffffffff)
+  *   |   +- security label length
+  *   +- security label identifier (134 or 10000110b)
+  *
+  */
+ 			/* cp[0] - security label identifier */
+ 			/* cp[1] - security label length */
+ 			/* cp[2,3,4,5] - security tag name set */
+ 			/* cp[6] - security tag type */
+ 			/* cp[7] - security tag length */
+ 			bcopy(&cp[IPOPT_OFFSET], &sts_name, CIPSO_STSN_LEN);
+ 			packet_label = m->m_pkthdr.label;
+ 			switch(sts_name) {
+ 			  case FREEBSD_MAC_SECURITY_TAG_SET_NAME:
+ 				st_type = (u_int)cp[CIPSO_ST_TOFFSET];
+ 				st_length = (u_int)cp[CIPSO_ST_TLEN];
+ 				if( st_length != (optlen - CIPSO_ST_TOFFSET) ) {
+ 				/* XXX: should generate an ICMP error message */
+ 		printf("CIPSO Security Tag Type Error. Length %d, should %d\n",
+ 					st_length, optlen - CIPSO_ST_TOFFSET);
+ 				} 
+ 				switch(st_type) {
+ 				  case CIPSO_ST_TYPE1:
+ 				/* cp[8] - alignment octet */
+ 				/* cp[9] - security label */
+ 				/* cp[10,11,12,13] - compartment bitmask */
+ 
+ 					packet_label.m_mls.mm_single.mme_level = 
+ 							cp[CIPSO_ST_TLEVEL];
+ 					packet_label.m_mls.mm_single.mme_type = 
+ 							MAC_MLS_TYPE_LEVEL;
+ /*						bcopy(&cp[CIPSO_STT1_BMOFFSET], &st_bitmap, 4);
+ 						m->m_pkthdr.maclabel.compartment = 
+ 							ntohl(st_bitmap);
+ 					printf("CIPSO: type 1 label %d(%x)\n",
+ 						m->m_pkthdr.maclabel.level,
+ 						m->m_pkthdr.maclabel.compartment);*/
+ 					break;
+ 				  case CIPSO_ST_TYPE2:
+ 					printf("CIPSO: got type 2\n");
+ 				  	break;
+ 				  case CIPSO_ST_TYPE5:
+ 					printf("CIPSO: got type 5\n");
+ 				  	break;
+ 				  case CIPSO_ST_TYPE6:
+ 					printf("CIPSO: got type 6\n");
+ 				  	break;
+ 				  case CIPSO_ST_TYPE7:
+ 					/* EQUAL LABEL must be UDP */
+ 					/* cp[8] -  'E' */
+ 					/* cp[9] -  'Q' */
+ 					/* cp[10] - 'U' */
+ 					/* cp[11] - 'A' */
+ 					/* cp[12] - 'L' */
+ 
+ 					if( cp[8] == 'E' && cp[9] == 'Q' &&
+ 					    cp[10] == 'U' && cp[11] == 'A' &&
+ 					    cp[12] == 'L') {
+ 					  packet_label.m_mls.mm_single.mme_level = 0;
+ 					  packet_label.m_mls.mm_single.mme_type = MAC_MLS_TYPE_EQUAL;
+ 					}
+ 				  	break;
+ 				  default:
+ 					printf("CIPSO default TAG TYPE\n");
+ 				  	break;
+ 				} /* switch(st_type) */
+ 				if(!mac_validate_label(&packet_label))
+ 					m->m_pkthdr.label = packet_label;
+ 				break;
+ 
+ 			  default:
+ 				printf("CIPSO default TAG SET NAME\n");
+ 				break;  
+ 			} /* switch(sts_name) */
+ 			break;
  
  		default:
  			break;
Index: sys/netinet/tcp_input.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/tcp_input.c,v
retrieving revision 1.7
diff -c -r1.7 tcp_input.c
*** sys/netinet/tcp_input.c	5 Jan 2002 20:49:22 -0000	1.7
--- sys/netinet/tcp_input.c	6 Mar 2002 13:47:58 -0000
***************
*** 816,821 ****
--- 816,850 ----
  		 */
  		if (m->m_flags & (M_BCAST|M_MCAST))
  			goto drop;
+ 
+ 		/* XXX: MAC and CIPSO labeling stuff !!! */
+ 		/* XXX: according to standard here we must check
+ 		 *	security options of packet and TCB
+ 		 */
+ 		/* Processes with equal label should accept incoming
+ 		 * connections. This is done to make services work in 
+ 		 * multilabel environment with minimum rewrites.
+ 		 */
+ 		if(m->m_flags & M_PKTHDR) {
+ 			if(inp->inp_socket->so_label.m_mls.mm_single.mme_type ==
+ 					MAC_MLS_TYPE_EQUAL) {
+ 				/* MACXXX: Is this correct ? */
+ 				inp->inp_socket->so_label = m->m_pkthdr.label;
+ 				remakeCIPSO(inp->inp_socket);
+ 			} 
+ 			/* In other cases subjects must have equal labels in 
+ 			 * order to communicate
+ 			 */
+ 			else if(!mac_equal( &inp->inp_socket->so_label,
+ 						&m->m_pkthdr.label)) {
+ 				/* LOG IT!!! 
+ 				LOG_MAC_NETWORK("TCP:LISTEN",inp->inp_socket,m);
+ 				*/
+ 				printf("MAC:TCP:LISTEN error!\n");
+ 				goto drop;
+ 			}
+ 		}
+ 
  #ifdef INET6
  		if (isipv6) {
  			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
***************
*** 1074,1079 ****
--- 1103,1120 ----
  				rstreason = BANDLIM_RST_OPENPORT;
  				goto dropwithreset;
  		}
+ 
+ 		/* XXX: MAC */
+ 		if(m->m_flags & M_PKTHDR) {
+ 			if(!mac_equal(&so->so_label, &m->m_pkthdr.label)) {
+ 				/* LOG IT!!! 
+ 				LOG_MAC_NETWORK("TCP:SYN_RECEIVED",
+ 						inp->inp_socket,m);*/
+ 				printf("MAC:TCP:SYN_RECEIVED error!\n");
+ 				goto dropwithreset;
+ 			}
+ 		}
+ 
  		break;
  
  	/*
***************
*** 1122,1127 ****
--- 1163,1179 ----
  		tp->snd_wnd = th->th_win;	/* initial send window */
  		tp->cc_recv = to.to_cc;		/* foreign CC */
  
+ 		/* XXX: MAC */
+ 		if(m->m_flags & M_PKTHDR) {
+ 			if(!mac_equal(&so->so_label, &m->m_pkthdr.label)) {
+ 				/* LOG IT!!! 
+ 				LOG_MAC_NETWORK("TCP:SYN_SENT",
+ 						inp->inp_socket,m);*/
+ 				printf("MAC:TCP:SYN_SENT error!\n");
+ 				goto drop;
+ 			}
+ 		}
+ 
  		tp->irs = th->th_seq;
  		tcp_rcvseqinit(tp);
  		if (thflags & TH_ACK) {
***************
*** 1534,1539 ****
--- 1586,1607 ----
  	    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
  		tp->ts_recent_age = ticks;
  		tp->ts_recent = to.to_tsval;
+ 	}
+ 
+ 	/* XXX: third step of TCP protocol handling algorithm.
+ 	 * security check - socket and packet labels must be equal! Else
+ 	 * send reset!
+ 	 */
+ 	if(m->m_flags & M_PKTHDR) {
+ 		if(!mac_equal(&so->so_label, &m->m_pkthdr.label) ||
+ 		    (so->so_label.m_mls.mm_single.mme_type == MAC_MLS_TYPE_EQUAL) ||
+ 		    (m->m_pkthdr.label.m_mls.mm_single.mme_type == MAC_MLS_TYPE_EQUAL)) {
+ 			/* LOG IT!
+ 			LOG_MAC_NETWORK("TCP:ESTABLISHED", inp->inp_socket,m);*/
+ 			printf("MAC:TCP:ESTABLISHED error!\n");
+ 			tp = tcp_drop(tp, ECONNRESET);
+ 			goto dropwithreset;
+ 		}
  	}
  
  	/*
Index: sys/netinet/tcp_syncache.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/tcp_syncache.c,v
retrieving revision 1.7
diff -c -r1.7 tcp_syncache.c
*** sys/netinet/tcp_syncache.c	10 Feb 2002 07:14:08 -0000	1.7
--- sys/netinet/tcp_syncache.c	4 Mar 2002 11:12:08 -0000
***************
*** 532,537 ****
--- 532,539 ----
  	struct inpcb *inp = NULL;
  	struct socket *so;
  	struct tcpcb *tp;
+ 	struct mbuf *tmp_opts1;
+ 	struct mbuf *tmp_opts2;
  
  	/*
  	 * Ok, create the full blown connection, and set things up
***************
*** 629,636 ****
  		struct in_addr laddr;
  		struct sockaddr_in *sin;
  
! 		inp->inp_options = ip_srcroute();
! 		if (inp->inp_options == NULL) {
  			inp->inp_options = sc->sc_ipopts;
  			sc->sc_ipopts = NULL;
  		}
--- 631,663 ----
  		struct in_addr laddr;
  		struct sockaddr_in *sin;
  
! #if defined(MAC_MLS)
! 
! 		/* MACXXX: hack IP options */
! 
! 		/* XXX: implemented algorithm is too stupid
! 		 * need to remake it!
! 		 */
! 		tmp_opts1 = ip_srcroute();
! 		if(tmp_opts1) {
! 			if(inp->inp_options) {
! 				/* cut 0 routing address off */
! 				tmp_opts2 = m_split(inp->inp_options,4,M_DONTWAIT);
! 				/* free mbuf */
! 				m_free(inp->inp_options);
! 				/* concatinate options */
! 				m_cat(tmp_opts1,tmp_opts2);
! 				/* free mbuf */
! 				m_free(tmp_opts2);
! 			}
! 			/* set packet options */
! 			inp->inp_options = tmp_opts1;
! 		} else {
! #else
! 		/* This is original code */
! 		inp->inp_options = ip_srcroute(); 
! 		if (inp->inp_options == NULL) { 
! #endif
  			inp->inp_options = sc->sc_ipopts;
  			sc->sc_ipopts = NULL;
  		}
Index: sys/netinet/udp_usrreq.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet/udp_usrreq.c,v
retrieving revision 1.4
diff -c -r1.4 udp_usrreq.c
*** sys/netinet/udp_usrreq.c	4 Jan 2002 16:53:25 -0000	1.4
--- sys/netinet/udp_usrreq.c	6 Mar 2002 13:48:26 -0000
***************
*** 162,167 ****
--- 162,168 ----
  	struct mbuf *opts = 0;
  	int len;
  	struct ip save_ip;
+ 	struct socket *so;
  	struct sockaddr *append_sa;
  #ifdef MAC
  	int error;
***************
*** 296,301 ****
--- 297,321 ----
  					continue;
  			}
  
+ 			/* XXX: MAC */
+ 			/* labels should be equal or equal to 'equal'
+ 			 */
+ 			if(m->m_flags & M_PKTHDR) {
+ 			  so = inp->inp_socket;
+ 			  if( (so->so_label.m_mls.mm_single.mme_type == 
+ 				MAC_MLS_TYPE_EQUAL) ||
+ 			     (m->m_pkthdr.label.m_mls.mm_single.mme_type ==
+ 				MAC_MLS_TYPE_EQUAL)) {
+ 			  } else if(!mac_equal( &inp->inp_socket->so_label,
+ 						&m->m_pkthdr.label)) {
+ 			  	/*LOG_MAC_NETWORK("UDP:search PCB",
+ 			  			   inp->inp_socket,m);*/
+ 				/* I don't know if this should be registered
+ 				printf("MAC:UDP:search PCB error\n"); */
+ 			  	continue;
+ 			  	}
+ 			}
+ 
  			if (last != NULL) {
  				struct mbuf *n;
  				int policyfail;
***************
*** 383,388 ****
--- 403,428 ----
  		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
  		return;
  	}
+ 
+ 	/* XXX: UDP MAC */
+ 	/* labels should be equal or equal to 'equal' */
+ 	if(m->m_flags & M_PKTHDR) {
+ 		so = inp->inp_socket;
+ 		if( (so->so_label.m_mls.mm_single.mme_type == MAC_MLS_TYPE_EQUAL) ||
+ 		    (m->m_pkthdr.label.m_mls.mm_single.mme_type == MAC_MLS_TYPE_EQUAL)) {
+ 			/*so->maclabel.level = m->m_pkthdr.maclabel.level;
+ 			so->maclabel.compartment = m->m_pkthdr.maclabel.compartment;
+ 			m_free(inp->inp_options);
+ 			inp->inp_options = makeCIPSO(&so->maclabel);*/
+ 		} else if(!mac_equal( &inp->inp_socket->so_label,
+ 						&m->m_pkthdr.label)) {
+ 			/*LOG_MAC_NETWORK("UDP", inp->inp_socket,m);*/
+ 			printf("MAC:UDP error!\n");
+ 			goto bad;
+ 		}
+ 			
+ 	}
+ 
  #ifdef IPSEC
  	if (ipsec4_in_reject_so(m, inp->inp_socket)) {
  		ipsecstat.in_polvio++;
Index: sys/netinet6/ah_core.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ah_core.c,v
retrieving revision 1.2
diff -c -r1.2 ah_core.c
*** sys/netinet6/ah_core.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ah_core.c	28 Feb 2002 12:51:07 -0000
***************
*** 39,44 ****
--- 39,45 ----
  #include "opt_inet.h"
  #include "opt_inet6.h"
  #include "opt_ipsec.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
Index: sys/netinet6/ah_input.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ah_input.c,v
retrieving revision 1.2
diff -c -r1.2 ah_input.c
*** sys/netinet6/ah_input.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ah_input.c	28 Feb 2002 13:00:00 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
***************
*** 49,54 ****
--- 50,57 ----
  #include <sys/time.h>
  #include <sys/syslog.h>
  
+ #include <sys/mac.h>
+ 
  #include <net/if.h>
  #include <net/route.h>
  #include <net/netisr.h>
***************
*** 114,119 ****
--- 117,123 ----
  	size_t hlen;
  	int proto;
  	size_t stripsiz = 0;
+ 	struct mac maclabel;
  
  #ifndef PULLDOWN_TEST
  	if (m->m_len < off + sizeof(struct newah)) {
***************
*** 536,541 ****
--- 540,561 ----
  			goto fail;
  		}
  
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	mac_init_object(&maclabel);
+ 	mac_copy_label(&m->m_pkthdr.label, &maclabel);
+ 	/* SADB entry has only single level label */
+ 	maclabel.m_biba.mb_flags = MAC_BIBA_FLAG_SINGLE;
+ 	maclabel.m_biba.mb_single.mbe_type = MAC_BIBA_TYPE_GRADE;
+ 	maclabel.m_biba.mb_single.mbe_grade = sav->sah->saidx.sls.integ_level;
+ 	maclabel.m_mls.mm_flags = MAC_MLS_FLAG_SINGLE;
+ 	maclabel.m_mls.mm_single.mme_type = MAC_MLS_TYPE_LEVEL;
+ 	maclabel.m_mls.mm_single.mme_level = sav->sah->saidx.sls.sens_level;
+ 
+ 	/* compartment code here! */
+ 
+ 	mac_copy_label(&maclabel, &m->m_pkthdr.label);
+ /**********/
+ #endif /* MAC */
  		if (nxt != IPPROTO_DONE) {
  			if ((inetsw[ip_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
  			    ipsec4_in_reject(m, NULL)) {
Index: sys/netinet6/ah_output.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ah_output.c,v
retrieving revision 1.2
diff -c -r1.2 ah_output.c
*** sys/netinet6/ah_output.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ah_output.c	28 Feb 2002 12:51:29 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
Index: sys/netinet6/esp_core.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/esp_core.c,v
retrieving revision 1.3
diff -c -r1.3 esp_core.c
*** sys/netinet6/esp_core.c	12 Dec 2001 10:44:40 -0000	1.3
--- sys/netinet6/esp_core.c	28 Feb 2002 12:51:45 -0000
***************
*** 32,37 ****
--- 32,38 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
Index: sys/netinet6/esp_input.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/esp_input.c,v
retrieving revision 1.2
diff -c -r1.2 esp_input.c
*** sys/netinet6/esp_input.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/esp_input.c	28 Feb 2002 13:00:14 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
***************
*** 48,53 ****
--- 49,56 ----
  #include <sys/time.h>
  #include <sys/syslog.h>
  
+ #include <sys/mac.h>
+ 
  #include <net/if.h>
  #include <net/route.h>
  #include <net/netisr.h>
***************
*** 117,122 ****
--- 120,126 ----
  	size_t hlen;
  	size_t esplen;
  	int proto;
+ 	struct mac maclabel;
  
  	/* sanity check for alignment. */
  	if (off % 4 != 0 || m->m_pkthdr.len % 4 != 0) {
***************
*** 430,435 ****
--- 434,456 ----
  			goto bad;
  		}
  
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ /* XXXMAC */
+ 	mac_init_object(&maclabel);
+ 	mac_copy_label(&m->m_pkthdr.label, &maclabel);
+ 	/* SADB entry has only single level label */
+ 	maclabel.m_biba.mb_flags = MAC_BIBA_FLAG_SINGLE;
+ 	maclabel.m_biba.mb_single.mbe_type = MAC_BIBA_TYPE_GRADE;
+ 	maclabel.m_biba.mb_single.mbe_grade = sav->sah->saidx.sls.integ_level;
+ 	maclabel.m_mls.mm_flags = MAC_MLS_FLAG_SINGLE;
+ 	maclabel.m_mls.mm_single.mme_type = MAC_MLS_TYPE_LEVEL;
+ 	maclabel.m_mls.mm_single.mme_level = sav->sah->saidx.sls.sens_level;
+ 
+ 	/* compartment code here! */
+ 
+ 	mac_copy_label(&maclabel, &m->m_pkthdr.label);
+ /**********/
+ #endif /* MAC */
  		if (nxt != IPPROTO_DONE) {
  			if ((inetsw[ip_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
  			    ipsec4_in_reject(m, NULL)) {
Index: sys/netinet6/esp_output.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/esp_output.c,v
retrieving revision 1.2
diff -c -r1.2 esp_output.c
*** sys/netinet6/esp_output.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/esp_output.c	28 Feb 2002 12:52:07 -0000
***************
*** 32,37 ****
--- 32,38 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  /*
   * RFC1827/2406 Encapsulated Security Payload.
Index: sys/netinet6/in6.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/in6.c,v
retrieving revision 1.1
diff -c -r1.1 in6.c
*** sys/netinet6/in6.c	12 Dec 2001 09:34:55 -0000	1.1
--- sys/netinet6/in6.c	4 Mar 2002 09:59:01 -0000
***************
*** 71,76 ****
--- 71,77 ----
  #include <sys/param.h>
  #include <sys/errno.h>
  #include <sys/malloc.h>
+ #include <sys/mac.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/sockio.h>
Index: sys/netinet6/in6_prefix.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/in6_prefix.c,v
retrieving revision 1.1
diff -c -r1.1 in6_prefix.c
*** sys/netinet6/in6_prefix.c	12 Dec 2001 09:34:55 -0000	1.1
--- sys/netinet6/in6_prefix.c	4 Mar 2002 09:59:01 -0000
***************
*** 67,72 ****
--- 67,73 ----
  
  #include <sys/param.h>
  #include <sys/malloc.h>
+ #include <sys/mac.h>
  #include <sys/kernel.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
Index: sys/netinet6/in6_proto.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/in6_proto.c,v
retrieving revision 1.2
diff -c -r1.2 in6_proto.c
*** sys/netinet6/in6_proto.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/in6_proto.c	4 Mar 2002 09:59:01 -0000
***************
*** 70,81 ****
  #include "opt_ipsec.h"
  
  #include <sys/param.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/protosw.h>
  #include <sys/kernel.h>
  #include <sys/domain.h>
- #include <sys/mac.h>
  #include <sys/mbuf.h>
  #include <sys/systm.h>
  #include <sys/sysctl.h>
--- 70,81 ----
  #include "opt_ipsec.h"
  
  #include <sys/param.h>
+ #include <sys/mac.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/protosw.h>
  #include <sys/kernel.h>
  #include <sys/domain.h>
  #include <sys/mbuf.h>
  #include <sys/systm.h>
  #include <sys/sysctl.h>
Index: sys/netinet6/in6_rmx.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/in6_rmx.c,v
retrieving revision 1.2
diff -c -r1.2 in6_rmx.c
*** sys/netinet6/in6_rmx.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/in6_rmx.c	4 Mar 2002 09:59:01 -0000
***************
*** 75,86 ****
  
  #include <sys/param.h>
  #include <sys/systm.h>
  #include <sys/kernel.h>
  #include <sys/sysctl.h>
  #include <sys/queue.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
- #include <sys/mac.h>
  #include <sys/mbuf.h>
  #include <sys/syslog.h>
  
--- 75,86 ----
  
  #include <sys/param.h>
  #include <sys/systm.h>
+ #include <sys/mac.h>
  #include <sys/kernel.h>
  #include <sys/sysctl.h>
  #include <sys/queue.h>
  #include <sys/socket.h>
  #include <sys/socketvar.h>
  #include <sys/mbuf.h>
  #include <sys/syslog.h>
  
Index: sys/netinet6/ipcomp_input.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ipcomp_input.c,v
retrieving revision 1.2
diff -c -r1.2 ipcomp_input.c
*** sys/netinet6/ipcomp_input.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ipcomp_input.c	28 Feb 2002 12:52:31 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
Index: sys/netinet6/ipcomp_output.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ipcomp_output.c,v
retrieving revision 1.2
diff -c -r1.2 ipcomp_output.c
*** sys/netinet6/ipcomp_output.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ipcomp_output.c	28 Feb 2002 12:52:45 -0000
***************
*** 36,41 ****
--- 36,42 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
Index: sys/netinet6/ipsec.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netinet6/ipsec.c,v
retrieving revision 1.2
diff -c -r1.2 ipsec.c
*** sys/netinet6/ipsec.c	12 Dec 2001 09:48:10 -0000	1.2
--- sys/netinet6/ipsec.c	28 Feb 2002 13:05:41 -0000
***************
*** 37,42 ****
--- 37,43 ----
  #include "opt_inet.h"
  #include "opt_inet6.h"
  #include "opt_ipsec.h"
+ #include "opt_mac.h"
  
  #include <sys/param.h>
  #include <sys/systm.h>
***************
*** 2486,2491 ****
--- 2487,2495 ----
  	int error;
  	struct sockaddr_in *dst4;
  	struct sockaddr_in *sin;
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 	struct sens_lvl_spec *sls;
+ #endif
  
  	if (!state)
  		panic("state == NULL in ipsec4_output");
***************
*** 2534,2539 ****
--- 2538,2552 ----
  			bcopy(&ip->ip_dst, &sin->sin_addr,
  			    sizeof(sin->sin_addr));
  		}
+ 
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 		/* fill in sls field of saidx from mbuf(state->m) label */
+ 		sls = key_parse_mbuf_label(state->m);
+ 		if(sls) {
+ 			key_setsecasidx_sls(&saidx, sls);
+ 			key_free_sls(sls);
+ 		}
+ #endif
  
  		if ((error = key_checkrequest(isr, &saidx)) != 0) {
  			/*
Index: sys/netkey/key.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/key.c,v
retrieving revision 1.2
diff -c -r1.2 key.c
*** sys/netkey/key.c	12 Dec 2001 18:54:21 -0000	1.2
--- sys/netkey/key.c	1 Mar 2002 13:13:19 -0000
***************
*** 37,42 ****
--- 37,43 ----
  #include "opt_inet.h"
  #include "opt_inet6.h"
  #include "opt_ipsec.h"
+ #include "opt_mac.h"
  
  #include <sys/types.h>
  #include <sys/param.h>
***************
*** 341,347 ****
--- 342,362 ----
  /*
   * set parameters into secasindex buffer.
   * Must allocate secasindex buffer before calling this function.
+  * struct sens_lvl_spec *sls;
   */
+ 
+ #if defined(MAC_MLS) || defined(MAC_BIBA)				     
+ #define KEY_SETSECASIDX(p, m, r, s, d, sls, idx) \
+ do { \
+ 	bzero((idx), sizeof(struct secasindex));                             \
+ 	(idx)->proto = (p);                                                  \
+ 	(idx)->mode = (m);                                                   \
+ 	(idx)->reqid = (r);                                                  \
+ 	bcopy((s), &(idx)->src, ((struct sockaddr *)(s))->sa_len);           \
+ 	bcopy((d), &(idx)->dst, ((struct sockaddr *)(d))->sa_len);           \
+ 	key_setsecasidx_sls(idx,sls);					     \
+ } while (0)
+ #else /* NOT (MAC_MLS || MAC_BIBA) */					     
  #define KEY_SETSECASIDX(p, m, r, s, d, idx) \
  do { \
  	bzero((idx), sizeof(struct secasindex));                             \
***************
*** 351,356 ****
--- 366,372 ----
  	bcopy((s), &(idx)->src, ((struct sockaddr *)(s))->sa_len);           \
  	bcopy((d), &(idx)->dst, ((struct sockaddr *)(d))->sa_len);           \
  } while (0)
+ #endif /* (MAC_MLS || MAC_BIBA) */					     
  
  /* key statistics */
  struct _keystat {
***************
*** 408,413 ****
--- 424,436 ----
  static struct mbuf *key_setsadbsa __P((struct secasvar *));
  static struct mbuf *key_setsadbaddr __P((u_int16_t,
  	struct sockaddr *, u_int8_t, u_int16_t));
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ static struct mbuf *key_setsadbsens __P((u_int16_t, struct sens_lvl_spec *));
+ struct sens_lvl_spec * key_parse_sens_label __P((struct sadb_sens *));
+ struct sens_lvl_spec * key_parse_mbuf_label __P((struct mbuf *));
+ int key_setsecasidx_sls __P(( struct secasindex *, struct sens_lvl_spec *));
+ void key_free_sls __P((struct sens_lvl_spec *));
+ #endif
  #if 0
  static struct mbuf *key_setsadbident __P((u_int16_t, u_int16_t, caddr_t,
  	int, u_int64_t));
***************
*** 739,751 ****
  	LIST_FOREACH(sah, &sahtree, chain) {
  		if (sah->state == SADB_SASTATE_DEAD)
  			continue;
! 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID))
  			goto found;
  	}
  
  	return NULL;
  
      found:
  
  	/* search valid state */
  	for (stateidx = 0;
--- 762,777 ----
  	LIST_FOREACH(sah, &sahtree, chain) {
  		if (sah->state == SADB_SASTATE_DEAD)
  			continue;
! 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_MODE_REQID)) {
  			goto found;
+ 		}
  	}
  
+ printf("key_allocsa_policy() not found\n");
  	return NULL;
  
      found:
+ printf("key_allocsa_policy() found\n");
  
  	/* search valid state */
  	for (stateidx = 0;
***************
*** 2654,2659 ****
--- 2680,2697 ----
  	if (__LIST_CHAINED(sah))
  		LIST_REMOVE(sah, chain);
  
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 	if (sah->saidx.sls.sens_bitmap) {
+ 		KFREE(sah->saidx.sls.sens_bitmap);
+ /* sens_bitmap and integ_bitmap are allocated as a continious region to
+  * sens_bitmap. Maybe it is a bug!
+ 		KFREE(sav->sls->integ_bitmap);
+  */
+ 		sah->saidx.sls.integ_bitmap = NULL;
+ 		sah->saidx.sls.sens_bitmap = NULL;
+ 	}
+ #endif /* MAC_MLS || MAC_BIBA */
+ 
  	KFREE(sah);
  
  	splx(s);
***************
*** 2828,2837 ****
  	LIST_FOREACH(sah, &sahtree, chain) {
  		if (sah->state == SADB_SASTATE_DEAD)
  			continue;
! 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_REQID))
  			return sah;
  	}
  
  	return NULL;
  }
  
--- 2866,2878 ----
  	LIST_FOREACH(sah, &sahtree, chain) {
  		if (sah->state == SADB_SASTATE_DEAD)
  			continue;
! 		if (key_cmpsaidx(&sah->saidx, saidx, CMP_REQID)) {
! 			printf("key_getsah() found\n");
  			return sah;
+ 		}
  	}
  
+ printf("key_getsah() not found\n");
  	return NULL;
  }
  
***************
*** 3455,3461 ****
--- 3496,3515 ----
  		case SADB_EXT_IDENTITY_SRC:
  		case SADB_EXT_IDENTITY_DST:
  			/* XXX: should we brought from SPD ? */
+ 			continue;
  		case SADB_EXT_SENSITIVITY:
+ 			/* XXXMAC */
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 			if(sav->sah->saidx.sls.dpd != 0) {
+ 				m = key_setsadbsens(SADB_EXT_SENSITIVITY,
+ 				  (struct sens_lvl_spec *)&sav->sah->saidx.sls);
+ 				if (!m)
+ 					goto fail; 
+ 				break;
+ 			}
+ #endif
+ 			continue;
+ 
  		default:
  			continue;
  		}
***************
*** 3910,3915 ****
--- 3964,4015 ----
  		}
  	}
  
+ /* MACXXX */
+ /* Now i've set a direct rule comparison */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 
+ 	printf("key_cmpsaidx():\n");
+ 	printf("saidx0 dpd=%x\t| saidx1 dpd=%x\n",
+ 		saidx0->sls.dpd, saidx1->sls.dpd);
+ 	printf("saidx0 sens_level=%d\t| saidx1 sens_level=%d\n",
+ 		saidx0->sls.sens_level, saidx1->sls.sens_level);
+ 	printf("saidx0 sens_len=%d\t| saidx1 sens_len=%d\n",
+ 		saidx0->sls.sens_len, saidx1->sls.sens_len);
+ 	printf("saidx0 integ_level=%d\t| saidx1 integ_level=%d\n",
+ 		saidx0->sls.integ_level, saidx1->sls.integ_level);
+ 	printf("saidx0 integ_len=%d\t| saidx1 integ_len=%d\n",
+ 		saidx0->sls.integ_len, saidx1->sls.integ_len);
+ /*	printf("saidx0 sens_bitmap: ");
+ 	ipsec_hexdump((caddr_t)saidx0->sls.sens_bitmap,
+ 			saidx0->sls.sens_len + saidx0->sls.integ_len);
+ 	printf("\nsaidx1 sens_bitmap: ");
+ 	ipsec_hexdump((caddr_t)saidx1->sls.sens_bitmap,
+ 			saidx1->sls.sens_len + saidx1->sls.integ_len);
+ 	printf("\n");*/
+ 
+ 	if(saidx0->sls.dpd != 0 && saidx1->sls.dpd != 0) {
+ 		if(saidx0->sls.dpd != saidx1->sls.dpd)
+ 			return 0;
+ 		if(saidx0->sls.sens_level != saidx1->sls.sens_level)
+ 			return 0;
+ 		if(saidx0->sls.integ_level != saidx1->sls.integ_level)
+ 			return 0;
+ 		/*if(saidx0->sls.sens_len != saidx1->sls.sens_len)
+ 			return 0;
+ 		if(saidx0->sls.integ_len != saidx1->sls.integ_len)
+ 			return 0;
+ 		if(bcmp(saidx0->sls.sens_bitmap, saidx1->sls.sens_bitmap,
+ 			saidx1->sls.sens_len) != 0 ||
+ 		   bcmp(saidx0->sls.integ_bitmap, saidx1->sls.integ_bitmap,
+ 			saidx1->sls.integ_len) != 0 )
+ 			return 0;*/
+ 	} else if(saidx0->sls.dpd == saidx1->sls.dpd == 0) {
+ 		/* saidx do not use sensitivity - dpd = 0 ! */
+ 	} else
+ 		return 0;
+ #endif
+ /* ****** */
+ 
  	return 1;
  }
  
***************
*** 4600,4606 ****
--- 4700,4711 ----
  	}
  
  	/* XXX boundary check against sa_len */
+ 	/* MACXXX: should i pass NULL or some value ? */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, NULL, &saidx);
+ #else
  	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* SPI allocation */
  	spi = key_do_getnewspi((struct sadb_spirange *)mhp->ext[SADB_EXT_SPIRANGE],
***************
*** 4806,4811 ****
--- 4911,4919 ----
  	struct secasindex saidx;
  	struct secashead *sah;
  	struct secasvar *sav;
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+  	struct sens_lvl_spec *sls = NULL;
+ #endif
  	u_int16_t proto;
  	u_int8_t mode;
  	u_int32_t reqid;
***************
*** 4854,4861 ****
--- 4962,4977 ----
  	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
  	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
  
+ 	/* MACXXX ??? */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	if(mhp->ext[SADB_EXT_SENSITIVITY])
+ 		sls = key_parse_sens_label((struct sadb_sens *)mhp->ext[SADB_EXT_SENSITIVITY]);
+ 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, sls, &saidx);
+ 	key_free_sls(sls);
+ #else
  	/* XXX boundary check against sa_len */
  	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* get a SA header */
  	if ((sah = key_getsah(&saidx)) == NULL) {
***************
*** 5001,5006 ****
--- 5117,5125 ----
  	struct secasindex saidx;
  	struct secashead *newsah;
  	struct secasvar *newsav;
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	struct sens_lvl_spec *sls = NULL;
+ #endif
  	u_int16_t proto;
  	u_int8_t mode;
  	u_int32_t reqid;
***************
*** 5049,5056 ****
--- 5168,5183 ----
  	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
  	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
  
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	/* MACXXX ??? */
+ 	if(mhp->ext[SADB_EXT_SENSITIVITY])
+ 		sls = key_parse_sens_label((struct sabd_sens *)mhp->ext[SADB_EXT_SENSITIVITY]);
+ 	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, sls, &saidx);
+ 	key_free_sls(sls);
+ #else
  	/* XXX boundary check against sa_len */
  	KEY_SETSECASIDX(proto, mode, reqid, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* get a SA header */
  	if ((newsah = key_getsah(&saidx)) == NULL) {
***************
*** 5276,5283 ****
--- 5403,5416 ----
  	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
  	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
  
+ 	/* MACXXX ??? */
+ 
  	/* XXX boundary check against sa_len */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, NULL, &saidx);
+ #else
  	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* get a SA header */
  	LIST_FOREACH(sah, &sahtree, chain) {
***************
*** 5343,5350 ****
--- 5476,5489 ----
  	src0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_SRC]);
  	dst0 = (struct sadb_address *)(mhp->ext[SADB_EXT_ADDRESS_DST]);
  
+ 	/* MACXXX ??? */
+ 
  	/* XXX boundary check against sa_len */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, NULL, &saidx);
+ #else
  	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	LIST_FOREACH(sah, &sahtree, chain) {
  		if (sah->state == SADB_SASTATE_DEAD)
***************
*** 5452,5459 ****
--- 5591,5603 ----
  	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
  	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
  
+ 	/* MACXXX ??? */
  	/* XXX boundary check against sa_len */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, NULL, &saidx);
+ #else
  	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* get a SA header */
  	LIST_FOREACH(sah, &sahtree, chain) {
***************
*** 5896,5901 ****
--- 6040,6053 ----
  
  	/* XXX sensitivity (optional) */
  
+ 	/*m = key_setsadbsens(SADB_EXT_ADDRESS_DST,
+ 	    NULL);
+ 	if (!m) {
+ 		error = ENOBUFS;
+ 		goto fail;
+ 	}
+ 	m_cat(result, m);*/
+ 
  	/* create proposal/combination extension */
  	m = key_getprop(saidx);
  #if 0
***************
*** 6061,6066 ****
--- 6213,6221 ----
  	const struct sadb_address *src0, *dst0;
  	struct secasindex saidx;
  	struct secashead *sah;
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	struct sens_lvl_spec *sls = NULL;
+ #endif
  	u_int16_t proto;
  	int error;
  
***************
*** 6132,6139 ****
--- 6287,6302 ----
  	src0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_SRC];
  	dst0 = (struct sadb_address *)mhp->ext[SADB_EXT_ADDRESS_DST];
  
+ 	/* MACXXX ??? */
+ #if defined(MAC_BIBA) || defined(MAC_MLS)
+ 	if(mhp->ext[SADB_EXT_SENSITIVITY])
+ 		sls = key_parse_sens_label((struct sadb_sens *)mhp->ext[SADB_EXT_SENSITIVITY]);
+ 	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, sls, &saidx);
+ 	key_free_sls(sls);
+ #else
  	/* XXX boundary check against sa_len */
  	KEY_SETSECASIDX(proto, IPSEC_MODE_ANY, 0, src0 + 1, dst0 + 1, &saidx);
+ #endif
  
  	/* get a SA index */
  	LIST_FOREACH(sah, &sahtree, chain) {
***************
*** 6770,6776 ****
  	if (m == NULL || so == NULL)
  		panic("key_parse: NULL pointer is passed.\n");
  
! #if 0	/*kdebug_sadb assumes msg in linear buffer*/
  	KEYDEBUG(KEYDEBUG_KEY_DUMP,
  		ipseclog((LOG_DEBUG, "key_parse: passed sadb_msg\n"));
  		kdebug_sadb(msg));
--- 6933,6939 ----
  	if (m == NULL || so == NULL)
  		panic("key_parse: NULL pointer is passed.\n");
  
! #if 1	/*kdebug_sadb assumes msg in linear buffer*/
  	KEYDEBUG(KEYDEBUG_KEY_DUMP,
  		ipseclog((LOG_DEBUG, "key_parse: passed sadb_msg\n"));
  		kdebug_sadb(msg));
***************
*** 7460,7462 ****
--- 7623,7792 ----
  
  	return m;
  }
+ 
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 
+ /*
+  * set data into sadb_sens.
+  * key_setsadbsens(SADB_EXT_SENSITIVITY, (struct sens_lvl_spec *)sav->sls);
+  */
+ static struct mbuf *
+ key_setsadbsens(exttype, sls)
+ 	u_int16_t exttype;
+  	struct sens_lvl_spec *sls;
+ {
+ 	struct mbuf *m;
+ 	struct sadb_sens *p;
+ 	size_t len;
+ 
+ 	len = PFKEY_ALIGN8(sizeof(struct sadb_sens)) +
+ 	      PFKEY_ALIGN8(sls->sens_len + sls->integ_len);
+ 	m = key_alloc_mbuf(len);
+ 	if (!m || m->m_next) {	/*XXX*/
+ 		if (m)
+ 			m_freem(m);
+ 		return NULL;
+ 	}
+ 
+ 	p = mtod(m, struct sadb_sens *);
+ 
+ 	bzero(p, len);
+ /**** XXX ****/
+ 
+ 	p->sadb_sens_len = PFKEY_UNIT64(len);
+ 	p->sadb_sens_exttype = exttype;
+ 	p->sadb_sens_dpd = sls->dpd;
+ 	p->sadb_sens_sens_level = sls->sens_level;
+ 	p->sadb_sens_sens_len = sls->sens_len;
+ 	p->sadb_sens_integ_level = sls->integ_level;
+ 	p->sadb_sens_integ_len = sls->integ_len;
+ 	p->sadb_sens_reserved = 0;
+ 
+ /********** XXX *****************/
+ /*
+  *	sens_bitmap and integ_bitmap are allocated in continious region
+  *	so i just copy data from sens_bitmap pointer with the length of
+  *	sens_bitmap and integ_bitmap. Maybe it is wrong!
+  */
+ /*	Should be bcopy, but there is no compartments right now
+ 	bcopy((caddr_t)sls->sens_bitmap,
+ 	    mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_sens)),
+ 	    sls->sens_len + sls->integ_len);
+ */
+ 	bzero( mtod(m, caddr_t) + PFKEY_ALIGN8(sizeof(struct sadb_sens)),
+ 	       sls->sens_len + sls->integ_len);
+ 
+ 	return m;
+ }
+ 
+ 
+ /* This function parse sadb_sens message into sens_lvl_spec struct */
+ struct sens_lvl_spec * key_parse_mbuf_label(m)
+ 	struct mbuf *m;
+ {
+ 	struct sens_lvl_spec *sls;
+ 
+ 	KMALLOC(sls, struct sens_lvl_spec *, sizeof(struct sens_lvl_spec));
+ 	if(sls == NULL) 
+ 		return NULL;
+ 	sls->dpd = 0xFFFFFFFF; /* MACXXX FreeBSD default */
+ 	/* MAC label should be SINGLE. I don't know how to handle ranges, 
+ 	 * because IPSec doesn't have such primitive
+ 	 */
+ 	if(m->m_pkthdr.label.m_mls.mm_single.mme_type == MAC_MLS_TYPE_LEVEL)
+ 		sls->sens_level = m->m_pkthdr.label.m_mls.mm_single.mme_level;
+ 	else
+ 		sls->sens_level = 0;
+ 	if(m->m_pkthdr.label.m_biba.mb_single.mbe_type == MAC_BIBA_TYPE_GRADE)
+ 		sls->integ_level = m->m_pkthdr.label.m_biba.mb_single.mbe_grade;
+ 	else
+ 		sls->integ_level = 0;
+ 	sls->sens_len = sls->integ_len = 4; /* MACXXX: DIRTY HACK !!! */
+ 	sls->integ_bitmap = sls->sens_bitmap = NULL;
+ 
+ 	KMALLOC(sls->sens_bitmap , caddr_t, sls->sens_len + sls->integ_len);
+ 	if(sls->sens_bitmap == NULL) {
+ 		key_free_sls(sls);
+ 		return NULL;
+ 	}
+ 
+ 	/* Should be compartments processing here */
+ 	bzero((caddr_t)sls->sens_bitmap, sls->sens_len + sls->integ_len);
+ 	sls->integ_bitmap = sls->sens_bitmap + sls->sens_len;
+ 
+ 	return (sls);
+ 
+ }
+ 
+ struct sens_lvl_spec * key_parse_sens_label(sens)
+ 	struct sadb_sens *sens;
+ {
+ 	struct sens_lvl_spec *sls;
+ 
+ 	KMALLOC(sls, struct sens_lvl_spec *, sizeof(struct sens_lvl_spec));
+ 	if(sls == NULL) 
+ 		return NULL;
+ 	sls->dpd = sens->sadb_sens_dpd;
+ 	sls->sens_level = sens->sadb_sens_sens_level;
+ 	sls->sens_len = sens->sadb_sens_sens_len;
+ 	sls->integ_level = sens->sadb_sens_integ_level;
+ 	sls->integ_len = sens->sadb_sens_integ_len;
+ 	sls->integ_bitmap = sls->sens_bitmap = NULL;
+ 
+ 	KMALLOC(sls->sens_bitmap , caddr_t, sls->sens_len + sls->integ_len);
+ 	if(sls->sens_bitmap == NULL) {
+ 		key_free_sls(sls);
+ 		return NULL;
+ 	}
+ 
+ /*	Should be bcopy, but there is no compartments right now
+ 	bcopy((caddr_t)sens + sizeof(struct sadb_sens),
+ 		(caddr_t)sls->sens_bitmap, sls->sens_len + sls->integ_len);
+ */
+ 	bzero((caddr_t)sls->sens_bitmap, sls->sens_len + sls->integ_len);
+ 	sls->integ_bitmap = sls->sens_bitmap + sls->sens_len;
+ 
+ 	return (sls);
+ 
+ }
+ 
+ int key_setsecasidx_sls(idx, sls)
+ 	struct secasindex *idx;
+ 	struct sens_lvl_spec *sls;
+ {
+ 	if(sls) { /* sls is not NULL */
+ 		idx->sls.dpd = sls->dpd;
+ 		idx->sls.sens_level = sls->sens_level;
+ 		idx->sls.sens_len = sls->sens_len;
+ 		idx->sls.integ_level = sls->integ_level;
+ 		idx->sls.integ_len = sls->integ_len;
+ 		KMALLOC(idx->sls.sens_bitmap , caddr_t, sls->sens_len +
+ 			 sls->integ_len);
+ 
+ 		if(idx->sls.sens_bitmap == NULL) {
+ 			ipseclog((LOG_DEBUG,
+ 				 "key_setsecasidx: No more memory.\n"));
+ 			panic("key_setsecasidx()");
+ 		}
+ /*	Should be bcopy, but there is no compartments right now
+ 		bcopy((caddr_t)sls->sens_bitmap, (caddr_t)idx->sls.sens_bitmap,
+ 	      		idx->sls.sens_len + idx->sls.integ_len);
+ */
+ 		bzero( (caddr_t)idx->sls.sens_bitmap,
+ 	      	       idx->sls.sens_len + idx->sls.integ_len);
+ 		idx->sls.integ_bitmap = idx->sls.sens_bitmap +
+ 			idx->sls.sens_len;
+ 	} else /* if sls is NULL */
+ 		idx->sls.dpd = 0;
+ 	return 0;
+ }
+ 
+ void key_free_sls(sls)
+ 	struct sens_lvl_spec *sls;
+ {
+ 	if(sls) {
+ 		KFREE(sls->sens_bitmap);
+ 		KFREE(sls);
+ 	}
+ }
+ #endif
Index: sys/netkey/key_debug.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/key_debug.c,v
retrieving revision 1.1
diff -c -r1.1 key_debug.c
*** sys/netkey/key_debug.c	12 Dec 2001 09:34:58 -0000	1.1
--- sys/netkey/key_debug.c	28 Feb 2002 12:53:44 -0000
***************
*** 34,39 ****
--- 34,40 ----
  #include "opt_inet.h"
  #include "opt_inet6.h"
  #include "opt_ipsec.h"
+ #include "opt_mac.h"
  #endif
  
  #include <sys/types.h>
***************
*** 136,141 ****
--- 137,143 ----
  			kdebug_sadb_identity(ext);
  			break;
  		case SADB_EXT_SENSITIVITY:
+ 			kdebug_sadb_sens(ext);
  			break;
  		case SADB_EXT_PROPOSAL:
  			kdebug_sadb_prop(ext);
***************
*** 745,747 ****
--- 747,767 ----
  
  	return;
  }
+ 
+ void
+ kdebug_sadb_sens(ext)
+ 	struct sadb_ext *ext;
+ {
+ 	struct sadb_sens *sens = (struct sadb_sens *)ext;
+ 
+ 	/* sanity check */
+ 	if (ext == NULL)
+ 		panic("kdebug_sadb_sens: NULL pointer was passed.\n");
+ 
+ 	printf("IPSec sensitivity bitmaps { ");
+ 	ipsec_hexdump((caddr_t)sens + sizeof(struct sadb_sens),
+ 	              sens->sadb_sens_sens_len + sens->sadb_sens_integ_len);
+ 	printf(" }\n");
+ 	return;
+ }
+ 
Index: sys/netkey/key_debug.h
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/key_debug.h,v
retrieving revision 1.1
diff -c -r1.1 key_debug.h
*** sys/netkey/key_debug.h	12 Dec 2001 09:34:58 -0000	1.1
--- sys/netkey/key_debug.h	27 Feb 2002 13:48:50 -0000
***************
*** 63,68 ****
--- 63,69 ----
  struct sadb_ext;
  extern void kdebug_sadb __P((struct sadb_msg *));
  extern void kdebug_sadb_x_policy __P((struct sadb_ext *));
+ extern void kdebug_sadb_sens __P((struct sadb_ext *));
  
  #ifdef _KERNEL
  struct secpolicy;
Index: sys/netkey/keydb.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/keydb.c,v
retrieving revision 1.1
diff -c -r1.1 keydb.c
*** sys/netkey/keydb.c	12 Dec 2001 09:34:58 -0000	1.1
--- sys/netkey/keydb.c	28 Feb 2002 12:53:56 -0000
***************
*** 32,37 ****
--- 32,38 ----
  
  #include "opt_inet.h"
  #include "opt_inet6.h"
+ #include "opt_mac.h"
  
  #include <sys/types.h>
  #include <sys/socket.h>
Index: sys/netkey/keydb.h
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/keydb.h,v
retrieving revision 1.1
diff -c -r1.1 keydb.h
*** sys/netkey/keydb.h	12 Dec 2001 09:34:58 -0000	1.1
--- sys/netkey/keydb.h	28 Feb 2002 12:54:30 -0000
***************
*** 37,42 ****
--- 37,56 ----
  
  #include <netkey/key_var.h>
  
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ /* Sensitivity Level Specification */
+ /* If dpd = 0, sensitivity is not used */
+ struct sens_lvl_spec {
+ 	u_int32_t dpd;		
+ 	u_int8_t sens_level;
+ 	u_int8_t sens_len;
+ 	caddr_t  sens_bitmap;
+ 	u_int8_t integ_level;
+ 	u_int8_t integ_len;
+ 	caddr_t  integ_bitmap;
+ };
+ #endif /* MAC_MLS || MAC_BIBA */
+ 
  /* Security Assocciation Index */
  /* NOTE: Ensure to be same address family */
  struct secasindex {
***************
*** 46,51 ****
--- 60,68 ----
  	u_int8_t mode;			/* mode of protocol, see ipsec.h */
  	u_int32_t reqid;		/* reqid id who owned this SA */
  					/* see IPSEC_MANUAL_REQID_MAX. */
+ #if defined(MAC_MLS) || defined(MAC_BIBA)
+ 	struct sens_lvl_spec sls;	/* Sensivity level specification */
+ #endif
  };
  
  /* Security Association Data Base */
***************
*** 128,134 ****
  };
  #endif
  
- /* Sensitivity Level Specification */
  /* nothing */
  
  #define SADB_KILL_INTERVAL	600	/* six seconds */
--- 145,150 ----
Index: sys/netkey/keysock.c
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/netkey/keysock.c,v
retrieving revision 1.1
diff -c -r1.1 keysock.c
*** sys/netkey/keysock.c	12 Dec 2001 09:34:58 -0000	1.1
--- sys/netkey/keysock.c	27 Feb 2002 13:48:50 -0000
***************
*** 31,36 ****
--- 31,37 ----
   */
  
  #include "opt_ipsec.h"
+ #include "opt_mac.h"
  
  /* This code has derived from sys/net/rtsock.c on FreeBSD2.2.5 */
  
Index: sys/sys/mac.h
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/sys/sys/mac.h,v
retrieving revision 1.80
diff -c -r1.80 mac.h
*** sys/sys/mac.h	19 Feb 2002 21:15:33 -0000	1.80
--- sys/sys/mac.h	4 Mar 2002 09:59:02 -0000
***************
*** 51,56 ****
--- 51,57 ----
  
  #define	FREEBSD_MAC_EXTATTR_NAME	"freebsd.mac"
  #define	FREEBSD_MAC_EXTATTR_NAMESPACE	EXTATTR_NAMESPACE_SYSTEM
+ #define FREEBSD_MAC_SECURITY_TAG_SET_NAME	0xffffffff
  
  /*
   * Structures and constants associated with a Biba Integrity policy.
Index: usr.sbin/setkey/parse.y
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/usr.sbin/setkey/parse.y,v
retrieving revision 1.1
diff -c -r1.1 parse.y
*** usr.sbin/setkey/parse.y	12 Dec 2001 09:44:54 -0000	1.1
--- usr.sbin/setkey/parse.y	1 Mar 2002 09:01:26 -0000
***************
*** 33,38 ****
--- 33,39 ----
  %{
  #include <sys/types.h>
  #include <sys/param.h>
+ #include <sys/mac.h>
  #include <sys/socket.h>
  
  #include <net/route.h>
***************
*** 65,70 ****
--- 66,74 ----
  u_int p_key_enc_len, p_key_auth_len;
  caddr_t p_key_enc, p_key_auth;
  time_t p_lt_hard, p_lt_soft;
+ caddr_t p_sens_label_text;
+ mac_t	p_sens_label;
+ u_int	p_sens_label_len;
  
  u_int p_policy_len;
  char *p_policy;
***************
*** 107,112 ****
--- 111,117 ----
  %token F_EXT EXTENSION NOCYCLICSEQ
  %token ALG_AUTH ALG_ENC ALG_ENC_DESDERIV ALG_ENC_DES32IV ALG_COMP
  %token F_LIFETIME_HARD F_LIFETIME_SOFT
+ %token F_SENS
  %token DECSTRING QUOTEDSTRING HEXSTRING STRING ANY
  	/* SPD management */
  %token SPDADD SPDDELETE SPDDUMP SPDFLUSH
***************
*** 407,412 ****
--- 412,425 ----
  		}
  	|	F_LIFETIME_HARD DECSTRING { p_lt_hard = $2; }
  	|	F_LIFETIME_SOFT DECSTRING { p_lt_soft = $2; }
+ 	|	F_SENS label_string
+ 	;
+ 
+ label_string
+ 	:	QUOTEDSTRING
+ 		{
+ 			p_sens_label_text = $1.buf;
+ 		}
  	;
  
  	/* definition about command for SPD management */
***************
*** 683,688 ****
--- 696,758 ----
  			memcpy(m_buf + m_len, &m_lt, len);
  			m_len += len;
  		}
+ 	
+ /* If we've got correct sensivity label, then we will set it! 
+  * sensc - sensitivity compartments, should be in mac_t
+  * integc - integrity compartments, should be in mac_t
+  * slen - length of sensitivity compartments field. bogus
+  * ilen - length of integrity compartments field. bogus
+  * All this values should be changed, when we'll got the real compartment mode
+  * support in all labels. Should also check correctness of label, but do not do
+  * so right now - BUG XXX !!!
+  */
+ 		if (p_sens_label_text != NULL) {
+ 			struct sadb_sens m_sens;
+ 			u_char buf[64];
+ 			u_int32_t sensc, integc;
+ 			u_int len, slen, ilen, i;
+ 
+ 			p_sens_label = mac_from_text(p_sens_label_text);
+ 			if(p_sens_label == NULL)
+ 				perror("can't decode sensivity label");
+ 			else {
+ 			  sensc = htonl(0x01234567);
+ 			  integc = htonl(0x89ABCDEF);
+ 			  slen = sizeof(sensc);
+ 			  ilen = sizeof(integc);
+ 			  len = sizeof(m_sens) + PFKEY_ALIGN8(slen) +
+ 			        PFKEY_ALIGN8(ilen);
+ 
+ 		  	  memcpy(buf, &sensc, slen);
+ 			  memcpy(buf + PFKEY_ALIGN8(slen), &integc, ilen);
+ 
+ 				bzero(buf,sizeof(buf)); /* XXX !!! */
+ 
+ 			  m_sens.sadb_sens_len = PFKEY_UNIT64(len);
+ 			  m_sens.sadb_sens_exttype = SADB_EXT_SENSITIVITY;
+ 			  m_sens.sadb_sens_dpd = 0xFFFFFFFF;
+ 			  if(p_sens_label->m_mls.mm_single.mme_type == 
+ 				MAC_MLS_TYPE_LEVEL)
+ 				m_sens.sadb_sens_sens_level = 
+ 				    p_sens_label->m_mls.mm_single.mme_level;
+ 			  else
+ 				m_sens.sadb_sens_sens_level = 0;
+ 			  m_sens.sadb_sens_sens_len = PFKEY_ALIGN8(slen);
+ 			  if(p_sens_label->m_biba.mb_single.mbe_type ==
+ 				MAC_BIBA_TYPE_GRADE)
+ 				m_sens.sadb_sens_integ_level = 
+ 				   p_sens_label->m_biba.mb_single.mbe_grade;
+ 			  else
+ 				m_sens.sadb_sens_integ_level = 0;
+ 			  m_sens.sadb_sens_integ_len = PFKEY_ALIGN8(ilen);
+ 			  m_sens.sadb_sens_reserved = 0;
+ 
+ 			  setvarbuf(&m_len,
+ 				(struct sadb_ext *)&m_sens, sizeof(m_sens),
+ 				(caddr_t)buf,
+ 				PFKEY_ALIGN8(slen) + PFKEY_ALIGN8(ilen));
+ 			}
+ 		}
  		/* FALLTHROUGH */
  
  	case SADB_DELETE:
***************
*** 915,920 ****
--- 985,993 ----
  	p_policy_len = 0;
  	p_policy = NULL;
  
+ 	p_sens_label_text = NULL;
+ 	p_sens_label = NULL;
+ 
  	memset(cmdarg, 0, sizeof(cmdarg));
  
  	return;
***************
*** 927,932 ****
--- 1000,1007 ----
  	if (p_dst) free(p_dst);
  	if (p_key_enc) free(p_key_enc);
  	if (p_key_auth) free(p_key_auth);
+ 	if (p_sens_label) mac_free(p_sens_label);
+ 	if (p_sens_label_text) mac_free(p_sens_label_text);
  
  	return;
  }
Index: usr.sbin/setkey/setkey.8
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/usr.sbin/setkey/setkey.8,v
retrieving revision 1.1
diff -c -r1.1 setkey.8
*** usr.sbin/setkey/setkey.8	12 Dec 2001 09:44:54 -0000	1.1
--- usr.sbin/setkey/setkey.8	27 Feb 2002 13:48:50 -0000
***************
*** 275,280 ****
--- 275,283 ----
  .It Fl lh Ar time
  .It Fl ls Ar time
  Specify hard/soft life time duration of the SA.
+ .\"
+ .It Fl s Ar maclabel
+ Specify maclabel for this SA.
  .El
  .\"
  .Pp
***************
*** 617,622 ****
--- 620,626 ----
  .\"
  .Sh SEE ALSO
  .Xr ipsec_set_policy 3 ,
+ .Xr mac_text 3 ,
  .Xr racoon 8 ,
  .Xr sysctl 8
  .\"
Index: usr.sbin/setkey/token.l
===================================================================
RCS file: /mnt/cvs/TrustedBSD/projects/trustedbsd/mac/usr.sbin/setkey/token.l,v
retrieving revision 1.1
diff -c -r1.1 token.l
*** usr.sbin/setkey/token.l	12 Dec 2001 09:44:54 -0000	1.1
--- usr.sbin/setkey/token.l	27 Feb 2002 13:48:50 -0000
***************
*** 203,208 ****
--- 203,209 ----
  {hyphen}r	{ PREPROC; return(F_REPLAY); }
  {hyphen}lh	{ PREPROC; return(F_LIFETIME_HARD); }
  {hyphen}ls	{ PREPROC; return(F_LIFETIME_SOFT); }
+ {hyphen}s	{ PREPROC; return(F_SENS); }
  
  	/* ... */
  any		{ PREPROC; return(ANY); }
