Fernando Fernandez Mancera <[email protected]> wrote:
> This is a prerequisite for the new infrastructure module NF_SYNPROXY. The new
> module is needed to avoid duplicated code for the SYNPROXY nftables support.
>
> Signed-off-by: Fernando Fernandez Mancera <[email protected]>
> ---
> include/linux/netfilter_ipv6.h | 3 +++
> net/ipv6/netfilter.c | 1 +
> 2 files changed, 4 insertions(+)
>
> diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
> index 12113e502656..f440aaade612 100644
> --- a/include/linux/netfilter_ipv6.h
> +++ b/include/linux/netfilter_ipv6.h
> @@ -8,6 +8,7 @@
> #define __LINUX_IP6_NETFILTER_H
>
> #include <uapi/linux/netfilter_ipv6.h>
> +#include <net/tcp.h>
>
> /* Extra routing may needed on local out, as the QUEUE target never returns
> * control to the table.
> @@ -35,6 +36,8 @@ struct nf_ipv6_ops {
> int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
> bool strict);
> #endif
> + u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
> + const struct tcphdr *th, u16 *mssp);
Could you place this above, in the #endif block?
You will need to create a helper as well:
static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
const struct tcphdr *th,
u16 *mssp)
{
#if IS_MODULE(CONFIG_IPV6)
const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
if (v6_ops)
return v6_ops->cookie_init_sequence(iph, th, mssp);
#else
return __cookie_v6_init_sequence(iph, th, mssp);
#endif
}
This way, when ipv6 is built-in, then we don't have the indirection
if netfilter uses the nf_ipv6_cookie_init_sequence() helper.
Also, can you check that if using CONFIG_IPV6=m then
"modinfo nf_synproxy" won't list ipv6 as a a module depencency?
If it does, there is another symbol that pulls in ipv6 (depmod will
say which one).
Thanks!
