Hi Florian,
On 5/19/19 11:12 PM, Florian Westphal wrote:
> Fernando Fernandez Mancera <ffmanc...@riseup.net> wrote:
>> This is a prerequisite for the new infrastructure module NF_SYNPROXY. The new
>> module is needed to avoid duplicated code for the SYNPROXY nftables support.
>>
>> Signed-off-by: Fernando Fernandez Mancera <ffmanc...@riseup.net>
>> ---
>> include/linux/netfilter_ipv6.h | 3 +++
>> net/ipv6/netfilter.c | 1 +
>> 2 files changed, 4 insertions(+)
>>
>> diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
>> index 12113e502656..f440aaade612 100644
>> --- a/include/linux/netfilter_ipv6.h
>> +++ b/include/linux/netfilter_ipv6.h
>> @@ -8,6 +8,7 @@
>> #define __LINUX_IP6_NETFILTER_H
>>
>> #include <uapi/linux/netfilter_ipv6.h>
>> +#include <net/tcp.h>
>>
>> /* Extra routing may needed on local out, as the QUEUE target never returns
>> * control to the table.
>> @@ -35,6 +36,8 @@ struct nf_ipv6_ops {
>> int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
>> bool strict);
>> #endif
>> + u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
>> + const struct tcphdr *th, u16 *mssp);
>
> Could you place this above, in the #endif block?
>
> You will need to create a helper as well:
> static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
> const struct tcphdr *th,
> u16 *mssp)
> {
> #if IS_MODULE(CONFIG_IPV6)
> const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
>
> if (v6_ops)
> return v6_ops->cookie_init_sequence(iph, th, mssp);
> #else
> return __cookie_v6_init_sequence(iph, th, mssp);
> #endif
> }
>
Sure, I am going to do it.
> This way, when ipv6 is built-in, then we don't have the indirection
> if netfilter uses the nf_ipv6_cookie_init_sequence() helper.
>
> Also, can you check that if using CONFIG_IPV6=m then
> "modinfo nf_synproxy" won't list ipv6 as a a module depencency?
>
Yes, I will check it. Also, I have some questions about the kbuild robot
reports. Why are it reporting the following errors?
> ERROR: "ipv4_synproxy_hook" [net/ipv6/netfilter/ip6t_SYNPROXY.ko] undefined!
> ERROR: "synproxy_send_client_synack_ipv6"
> [net/ipv6/netfilter/ip6t_SYNPROXY.ko] undefined!
> ERROR: "synproxy_recv_client_ack_ipv6"
> [net/ipv6/netfilter/ip6t_SYNPROXY.ko] undefined!
> ERROR: "nf_synproxy_ipv6_init" [net/ipv6/netfilter/ip6t_SYNPROXY.ko]
> undefined!
> ERROR: "nf_synproxy_ipv6_fini" [net/ipv6/netfilter/ip6t_SYNPROXY.ko]
> undefined!
> ERROR: "ipv4_synproxy_hook" [net/ipv4/netfilter/ipt_SYNPROXY.ko] undefined!
> ERROR: "synproxy_send_client_synack" [net/ipv4/netfilter/ipt_SYNPROXY.ko]
> undefined!
> ERROR: "synproxy_recv_client_ack" [net/ipv4/netfilter/ipt_SYNPROXY.ko]
> undefined!
> ERROR: "nf_synproxy_ipv4_init" [net/ipv4/netfilter/ipt_SYNPROXY.ko]
> undefined!
> ERROR: "nf_synproxy_ipv4_fini" [net/ipv4/netfilter/ipt_SYNPROXY.ko]
> undefined!
Why undefined? I have exported them with EXPORT_SYMBOL_GPL(). What am I
missing? Thanks!
> If it does, there is another symbol that pulls in ipv6 (depmod will
> say which one).
>
> Thanks!
>
