Re: [PATCH net-next] netlabel: Remove unused cfg_calipso funcs

On 2/20/2025 8:48 AM, Dr. David Alan Gilbert wrote:

* Casey Schaufler (casey@schaufler-ca.com) wrote:

quoted

On 2/20/2025 6:08 AM, linux@treblig.org wrote:

quoted

From: "Dr. David Alan Gilbert" <redacted>

netlbl_cfg_calipso_map_add(), netlbl_cfg_calipso_add() and
netlbl_cfg_calipso_del() were added in 2016 as part of
commit 3f09354ac84c ("netlabel: Implement CALIPSO config functions for
SMACK.")

Remove them.

Please don't. The Smack CALIPSO implementation has been delayed
for a number of reasons, some better than others, but is still on
the roadmap.

Hmm OK.
If it makes it to 10 years next year then perhaps it should hold
a birthday party!

The difference between network and security developers is that a
network developer thinks 10 microseconds is a long time, while a
security developer thinks 10 years is no time at all.

Dave

quoted

quoted

(I see a few other changes in that original commit, whether they
are reachable I'm not sure).

Signed-off-by: Dr. David Alan Gilbert <redacted>
---
 include/net/netlabel.h       |  26 -------
 net/netlabel/netlabel_kapi.c | 133 -----------------------------------
 2 files changed, 159 deletions(-)

diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index 02914b1df38b..37c9bcfd5345 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h

@@ -435,14 +435,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 			       const struct in_addr *addr,
 			       const struct in_addr *mask,
 			       struct netlbl_audit *audit_info);
-int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
-			   struct netlbl_audit *audit_info);
-void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
-int netlbl_cfg_calipso_map_add(u32 doi,
-			       const char *domain,
-			       const struct in6_addr *addr,
-			       const struct in6_addr *mask,
-			       struct netlbl_audit *audit_info);
 /*
  * LSM security attribute operations
  */

@@ -561,24 +553,6 @@ static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
 {
 	return -ENOSYS;
 }
-static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
-					 struct netlbl_audit *audit_info)
-{
-	return -ENOSYS;
-}
-static inline void netlbl_cfg_calipso_del(u32 doi,
-					  struct netlbl_audit *audit_info)
-{
-	return;
-}
-static inline int netlbl_cfg_calipso_map_add(u32 doi,
-					     const char *domain,
-					     const struct in6_addr *addr,
-					     const struct in6_addr *mask,
-					     struct netlbl_audit *audit_info)
-{
-	return -ENOSYS;
-}
 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
 				     u32 offset)
 {

diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index cd9160bbc919..13b4bc1c30ec 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c

@@ -394,139 +394,6 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 	return ret_val;
 }
 
-/**
- * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
- * @doi_def: CALIPSO DOI definition
- * @audit_info: NetLabel audit information
- *
- * Description:
- * Add a new CALIPSO DOI definition as defined by @doi_def.  Returns zero on
- * success and negative values on failure.
- *
- */
-int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
-			   struct netlbl_audit *audit_info)
-{
-#if IS_ENABLED(CONFIG_IPV6)
-	return calipso_doi_add(doi_def, audit_info);
-#else /* IPv6 */
-	return -ENOSYS;
-#endif /* IPv6 */
-}
-
-/**
- * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
- * @doi: CALIPSO DOI
- * @audit_info: NetLabel audit information
- *
- * Description:
- * Remove an existing CALIPSO DOI definition matching @doi.  Returns zero on
- * success and negative values on failure.
- *
- */
-void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
-{
-#if IS_ENABLED(CONFIG_IPV6)
-	calipso_doi_remove(doi, audit_info);
-#endif /* IPv6 */
-}
-
-/**
- * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
- * @doi: the CALIPSO DOI
- * @domain: the domain mapping to add
- * @addr: IP address
- * @mask: IP address mask
- * @audit_info: NetLabel audit information
- *
- * Description:
- * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
- * NetLabel subsystem.  A @domain value of NULL adds a new default domain
- * mapping.  Returns zero on success, negative values on failure.
- *
- */
-int netlbl_cfg_calipso_map_add(u32 doi,
-			       const char *domain,
-			       const struct in6_addr *addr,
-			       const struct in6_addr *mask,
-			       struct netlbl_audit *audit_info)
-{
-#if IS_ENABLED(CONFIG_IPV6)
-	int ret_val = -ENOMEM;
-	struct calipso_doi *doi_def;
-	struct netlbl_dom_map *entry;
-	struct netlbl_domaddr_map *addrmap = NULL;
-	struct netlbl_domaddr6_map *addrinfo = NULL;
-
-	doi_def = calipso_doi_getdef(doi);
-	if (doi_def == NULL)
-		return -ENOENT;
-
-	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-	if (entry == NULL)
-		goto out_entry;
-	entry->family = AF_INET6;
-	if (domain != NULL) {
-		entry->domain = kstrdup(domain, GFP_ATOMIC);
-		if (entry->domain == NULL)
-			goto out_domain;
-	}
-
-	if (addr == NULL && mask == NULL) {
-		entry->def.calipso = doi_def;
-		entry->def.type = NETLBL_NLTYPE_CALIPSO;
-	} else if (addr != NULL && mask != NULL) {
-		addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
-		if (addrmap == NULL)
-			goto out_addrmap;
-		INIT_LIST_HEAD(&addrmap->list4);
-		INIT_LIST_HEAD(&addrmap->list6);
-
-		addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
-		if (addrinfo == NULL)
-			goto out_addrinfo;
-		addrinfo->def.calipso = doi_def;
-		addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
-		addrinfo->list.addr = *addr;
-		addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
-		addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
-		addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
-		addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
-		addrinfo->list.mask = *mask;
-		addrinfo->list.valid = 1;
-		ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
-		if (ret_val != 0)
-			goto cfg_calipso_map_add_failure;
-
-		entry->def.addrsel = addrmap;
-		entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
-	} else {
-		ret_val = -EINVAL;
-		goto out_addrmap;
-	}
-
-	ret_val = netlbl_domhsh_add(entry, audit_info);
-	if (ret_val != 0)
-		goto cfg_calipso_map_add_failure;
-
-	return 0;
-
-cfg_calipso_map_add_failure:
-	kfree(addrinfo);
-out_addrinfo:
-	kfree(addrmap);
-out_addrmap:
-	kfree(entry->domain);
-out_domain:
-	kfree(entry);
-out_entry:
-	calipso_doi_putdef(doi_def);
-	return ret_val;
-#else /* IPv6 */
-	return -ENOSYS;
-#endif /* IPv6 */
-}
-
 /*
  * Security Attribute Functions
  */