Re: [PATCH] cipso: handle CIPSO options correctly when NetLabel is disabled

[David Miller <davem@davemloft.net>]

From: Paul Moore <pmoore@redhat.com>
Date: Thu, 31 May 2012 16:09:23 -0400

> When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system
> receives a CIPSO tagged packet it is dropped (cipso_v4_validate()
> returns non-zero).  In most cases this is the correct and desired
> behavior, however, in the case where we are simply forwarding the
> traffic, e.g. acting as a network bridge, this becomes a problem.
> 
> This patch fixes the forwarding problem by providing the basic CIPSO
> validation code directly in ip_options_compile() without the need for
> the NetLabel or CIPSO code.  The new validation code can not perform
> any of the CIPSO option label/value verification that
> cipso_v4_validate() does, but it can verify the basic CIPSO option
> format.
> 
> The behavior when NetLabel is enabled is unchanged.
> 
> Signed-off-by: Paul Moore <pmoore@redhat.com>

I don't like this at all.

The only conclusion I can come to is that cipso_v4_validate() is doing
the wrong thing when NETLABEL is disabled.

There is never a good reason to crap all over a function with ifdefs.
This is especially true when it's being done to paper over a function
with poor semantics.

The whole idea is to abstract and put all of this kind of logic into
cipso_v4_validate().