Re: [PATCH] SMACK netfilter smacklabel socket match

Paul Moore
2009-02-18T15:06:17Z

On Wednesday 18 February 2009 02:23:24 am etienne wrote:
> ... anyway, I think the cleanest way would be to, well, sort smk_netlbladdr
> by mask on insertion (perf doesn't matter here) and this way
> smack_host_label can stop the loop on first match. Plus, it would give a
> nicer /smack/netlabel ouptut :)

Agreed.

> so, how should we handle it? apply the patches (with whitespaces damages
> corrected ;) ) now (as it corrects a bug) an elaborate the cleaner way
> later?

Well, since you have some time and willingness to do things "the right way" I
would recommend dropping these patches (which are really just band-aids) and
working on the right solution to stored the addresses/masks in a sorted list
with the mask already applied.

FWIW, the NetLabel code (net/netlabel) has to do very similar things with
sorted address lists so I built an address list construct which builds on the
list.h ideas and operates in a similar way. You may find it helpful.

> I think this should go to stable too?

I would worry about getting the patches developed, tested and in an acceptable
form first, then we can worry about where they should be applied ;)

--
paul moore
linux @ hp