Re: [PATCH 11/13 RFC net-next] net: cipso: guard IPv4 packet manipulation functions

Fernando Fernandez Mancera <[email protected]> Mon, 13 Jul 2026 16:03:59 +0200

Newsgroups	org.kernel.vger.linux-security-module,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID	<[email protected]>

On 7/12/26 6:22 PM, Paul Moore wrote:
> On Sat, Jul 11, 2026 at 9:41 PM Fernando Fernandez Mancera
> <[email protected]> wrote:
>>
>> To enable compiling the network stack without IPv4, the CIPSO functions
>> that manipulate IPv4 options and generate ICMP errors must be bypassed.
>>
>> Ideally, CIPSO should not be compiled when IPv4 is disabled but
>> currently it is too integrated within netlabel, so let's just bypassed
>> the relevant functions.
>>
>> Signed-off-by: Fernando Fernandez Mancera <[email protected]>
>> ---
>>   net/ipv4/cipso_ipv4.c | 10 ++++++++++
>>   1 file changed, 10 insertions(+)
> 
> I think I would prefer to make CONFIG_NETLABEL dependent on
> CONFIG_IPV4 at this point in time.  This will keep the code cleaner
> and allow time to do the proper work of wrapping the CIPSO code with
> CONFIG_CIPSO (or similar) and making that dependent on CONFIG_IPV4.
> 

Fair, that works for me too. I am gonna drop this on the v1.

Thank you!
Fernando.