Re: [PATCH 11/13 RFC net-next] net: cipso: guard IPv4 packet manipulation functions

Paul Moore <[email protected]> Sun, 12 Jul 2026 12:22:04 -0400

Newsgroups	org.kernel.vger.linux-security-module,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID	<CAHC9VhTA8Y+BLOcLcv6X9u3nRU=X7NQz-u4kZuVNL-Yz1mWKxw@mail.gmail.com>

On Sat, Jul 11, 2026 at 9:41 PM Fernando Fernandez Mancera
<[email protected]> wrote:
>
> To enable compiling the network stack without IPv4, the CIPSO functions
> that manipulate IPv4 options and generate ICMP errors must be bypassed.
>
> Ideally, CIPSO should not be compiled when IPv4 is disabled but
> currently it is too integrated within netlabel, so let's just bypassed
> the relevant functions.
>
> Signed-off-by: Fernando Fernandez Mancera <[email protected]>
> ---
>  net/ipv4/cipso_ipv4.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)

I think I would prefer to make CONFIG_NETLABEL dependent on
CONFIG_IPV4 at this point in time.  This will keep the code cleaner
and allow time to do the proper work of wrapping the CIPSO code with
CONFIG_CIPSO (or similar) and making that dependent on CONFIG_IPV4.

-- 
paul-moore.com