Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx> wrote:
> This is a prerequisite for the new infrastructure module NF_SYNPROXY. The new
> module is needed to avoid duplicated code for the SYNPROXY nftables support.
> Signed-off-by: Fernando Fernandez Mancera <ffmancera@xxxxxxxxxx>
> ---
> include/linux/netfilter_ipv6.h | 17 +++++++++++++++++
> net/ipv6/netfilter.c | 1 +
> 2 files changed, 18 insertions(+)
>
> diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
> index 12113e502656..549a5df39cf9 100644
> --- a/include/linux/netfilter_ipv6.h
> +++ b/include/linux/netfilter_ipv6.h
> @@ -8,6 +8,7 @@
> #define __LINUX_IP6_NETFILTER_H
>
> #include <uapi/linux/netfilter_ipv6.h>
> +#include <net/tcp.h>
>
> /* Extra routing may needed on local out, as the QUEUE target never returns
> * control to the table.
> @@ -34,6 +35,8 @@ struct nf_ipv6_ops {
> struct in6_addr *saddr);
> int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
> bool strict);
> + u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
> + const struct tcphdr *th, u16 *mssp);
This is good, but not enough:
/tmp/foo/./lib/modules/5.2.0-rc1+/kernel/net/netfilter/nf_synproxy.ko needs "__cookie_v6_check": /tmp/foo/./lib/modules/5.2.0-rc1+/kernel/net/ipv6/ipv6.ko
IOW, you need to also add the same trick for __cookie_v6_check.
Otherwise, an ipv4 only rule involving synproxy will pull in ipv6.ko
module.
> +static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
> + const struct tcphdr *th,
> + u16 *mssp)
> +{
> +#if IS_MODULE(CONFIG_IPV6)
> + const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
> +
> + if (v6_ops)
> + return v6_ops->cookie_init_sequence(iph, th, mssp);
This triggers a compiler warning for me, because return value is
undefined in !v6ops case.
I think you can just return 0 here for the !v6ops case.
