On Wed, Nov 30, 2022 at 06:30:42PM +0100, Pablo Neira Ayuso wrote:
> On Wed, Nov 23, 2022 at 01:16:39PM +0100, Florian Westphal wrote:
> > icmp conntrack will set icmp redirects as RELATED, but icmpv6 will not
> > do this.
> >
> > For icmpv6, only icmp errors (code <= 128) are examined for RELATED state.
> > ICMPV6 Redirects are part of neighbour discovery mechanism, those are
> > handled by marking a selected subset (e.g. neighbour solicitations) as
> > UNTRACKED, but not REDIRECT -- they will thus be flagged as INVALID.
> >
> > Add minimal support for REDIRECTs. No parsing of neighbour options is
> > added for simplicity, so this will only check that we have the embeeded
> > original header (ND_OPT_REDIRECT_HDR), and then attempt to do a flow
> > lookup for this tuple.
> >
> > Also extend the existing test case to cover redirects.
>
> Applied to nf-next, thanks.
Florian, I am hitting this here:
net/netfilter/nf_conntrack_proto_icmpv6.c: In function ‘nf_conntrack_icmpv6_redirect’:
net/netfilter/nf_conntrack_proto_icmpv6.c:179:56: error: incompatible type for argument 6 of ‘nf_conntrack_inet_error’
179 | IPPROTO_ICMPV6, outer_daddr);
| ^~~~~~~~~~~
| |
| union nf_inet_addr
In file included from net/netfilter/nf_conntrack_proto_icmpv6.c:21:
./include/net/netfilter/nf_conntrack_l4proto.h:83:49: note: expected ‘union nf_inet_addr *’ but argument is of type ‘union nf_inet_addr’
83 | union nf_inet_addr *outer_daddr);
| ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
net/netfilter/nf_conntrack_proto_icmpv6.c:180:1: error: control reaches end of non-void function [-Werror=return-type]
180 | }
| ^
