Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH smack] smack: remove duplicated hook function
To:     Florian Westphal <fw@strlen.de>,
        linux-security-module@vger.kernel.org
Cc:     jmorris@namei.org, serge@hallyn.com, linux-kernel@vger.kernel.org,
        Casey Schaufler <casey@schaufler-ca.com>
References: <20211011143309.17203-1-fw@strlen.de>
From:   Casey Schaufler <casey@schaufler-ca.com>
Message-ID: <700b26f3-a8ef-969b-dd3c-4ad849d8c4ab@schaufler-ca.com>
Date:   Tue, 12 Oct 2021 07:38:14 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <20211011143309.17203-1-fw@strlen.de>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Content-Length: 1977
Precedence: bulk

On 10/11/2021 7:33 AM, Florian Westphal wrote:
> ipv4 and ipv6 hook functions are identical, remove one.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>

Looks fine, with the one change I've noted below. If you're
OK with that change I can take it for smack-next.

> ---
>  patch targets next branch of
>  git://github.com/cschaufler/smack-next.
>
>  security/smack/smack_netfilter.c | 26 +++-----------------------
>  1 file changed, 3 insertions(+), 23 deletions(-)
>
> diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c
> index fc7399b45373..a7ef2e2abc8a 100644
> --- a/security/smack/smack_netfilter.c
> +++ b/security/smack/smack_netfilter.c
> @@ -18,27 +18,7 @@
>  #include <net/net_namespace.h>
>  #include "smack.h"
>  
> -#if IS_ENABLED(CONFIG_IPV6)
> -
> -static unsigned int smack_ipv6_output(void *priv,
> -					struct sk_buff *skb,
> -					const struct nf_hook_state *state)
> -{
> -	struct sock *sk = skb_to_full_sk(skb);
> -	struct socket_smack *ssp;
> -	struct smack_known *skp;
> -
> -	if (sk && sk->sk_security) {
> -		ssp = sk->sk_security;
> -		skp = ssp->smk_out;
> -		skb->secmark = skp->smk_secid;
> -	}
> -
> -	return NF_ACCEPT;
> -}
> -#endif	/* IPV6 */
> -
> -static unsigned int smack_ipv4_output(void *priv,
> +static unsigned int smack_hook_output(void *priv,

I would prefer smack_ip_output() to smack_hook_output().

>  					struct sk_buff *skb,
>  					const struct nf_hook_state *state)
>  {
> @@ -57,14 +37,14 @@ static unsigned int smack_ipv4_output(void *priv,
>  
>  static const struct nf_hook_ops smack_nf_ops[] = {
>  	{
> -		.hook =		smack_ipv4_output,
> +		.hook =		smack_hook_output,
>  		.pf =		NFPROTO_IPV4,
>  		.hooknum =	NF_INET_LOCAL_OUT,
>  		.priority =	NF_IP_PRI_SELINUX_FIRST,
>  	},
>  #if IS_ENABLED(CONFIG_IPV6)
>  	{
> -		.hook =		smack_ipv6_output,
> +		.hook =		smack_hook_output,
>  		.pf =		NFPROTO_IPV6,
>  		.hooknum =	NF_INET_LOCAL_OUT,
>  		.priority =	NF_IP6_PRI_SELINUX_FIRST,