Re: [PATCH nf-next v3 2/4] netfilter: synproxy: remove module dependency on IPv6 SYNPROXY

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <ffmancera@riseup.net> wrote:
> This is a prerequisite for the new infrastructure module NF_SYNPROXY. The new
> module is needed to avoid duplicated code for the SYNPROXY nftables support.
> Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
> ---
>  include/linux/netfilter_ipv6.h | 17 +++++++++++++++++
>  net/ipv6/netfilter.c           |  1 +
>  2 files changed, 18 insertions(+)
> 
> diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
> index 12113e502656..549a5df39cf9 100644
> --- a/include/linux/netfilter_ipv6.h
> +++ b/include/linux/netfilter_ipv6.h
> @@ -8,6 +8,7 @@
>  #define __LINUX_IP6_NETFILTER_H
>  
>  #include <uapi/linux/netfilter_ipv6.h>
> +#include <net/tcp.h>
>  
>  /* Extra routing may needed on local out, as the QUEUE target never returns
>   * control to the table.
> @@ -34,6 +35,8 @@ struct nf_ipv6_ops {
>  		       struct in6_addr *saddr);
>  	int (*route)(struct net *net, struct dst_entry **dst, struct flowi *fl,
>  		     bool strict);
> +	u32 (*cookie_init_sequence)(const struct ipv6hdr *iph,
> +				    const struct tcphdr *th, u16 *mssp);

This is good, but not enough:

/tmp/foo/./lib/modules/5.2.0-rc1+/kernel/net/netfilter/nf_synproxy.ko needs "__cookie_v6_check": /tmp/foo/./lib/modules/5.2.0-rc1+/kernel/net/ipv6/ipv6.ko

IOW, you need to also add the same trick for __cookie_v6_check.

Otherwise, an ipv4 only rule involving synproxy will pull in ipv6.ko
module.

> +static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
> +					       const struct tcphdr *th,
> +					       u16 *mssp)
> +{
> +#if IS_MODULE(CONFIG_IPV6)
> +	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
> +
> +	if (v6_ops)
> +		return v6_ops->cookie_init_sequence(iph, th, mssp);

This triggers a compiler warning for me, because return value is
undefined in !v6ops case.

I think you can just return 0 here for the !v6ops case.