Re: [PATCH nf-next v2 2/4] netfilter: synproxy: remove module dependency on IPv6 SYNPROXY

[Florian Westphal <fw@xxxxxxxxx>]

Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx> wrote:
> This is a prerequisite for the new infrastructure module NF_SYNPROXY. The new
> module is needed to avoid duplicated code for the SYNPROXY nftables support.
> 
> Signed-off-by: Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx>
> ---
>  include/linux/netfilter_ipv6.h | 3 +++
>  net/ipv6/netfilter.c           | 1 +
>  2 files changed, 4 insertions(+)
> 
> diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
> index 12113e502656..f440aaade612 100644
> --- a/include/linux/netfilter_ipv6.h
> +++ b/include/linux/netfilter_ipv6.h
> @@ -8,6 +8,7 @@
>  #define __LINUX_IP6_NETFILTER_H
>  
>  #include <uapi/linux/netfilter_ipv6.h>
> +#include <net/tcp.h>
>  
>  /* Extra routing may needed on local out, as the QUEUE target never returns
>   * control to the table.
> @@ -35,6 +36,8 @@ struct nf_ipv6_ops {
>  	int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
>  		     bool strict);
>  #endif
> +	u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
> +				    const struct tcphdr *th, u16 *mssp);

Could you place this above, in the #endif block?

You will need to create a helper as well:
static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
					       const struct tcphdr *th,
					       u16 *mssp)
{
#if IS_MODULE(CONFIG_IPV6)
	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();

	if (v6_ops)
		return v6_ops->cookie_init_sequence(iph, th, mssp);
#else
	return __cookie_v6_init_sequence(iph, th, mssp);
#endif
}

This way, when ipv6 is built-in, then we don't have the indirection
if netfilter uses the nf_ipv6_cookie_init_sequence() helper.

Also, can you check that if using CONFIG_IPV6=m then
"modinfo nf_synproxy" won't list ipv6 as a a module depencency?

If it does, there is another symbol that pulls in ipv6 (depmod will
say which one).

Thanks!