LinuxLists.cc - [PATCH] netfilter: synproxy: fix building syncookie calls

2019-06-19 12:56:14

Subject: [PATCH] netfilter: synproxy: fix building syncookie calls

When either CONFIG_IPV6 or CONFIG_SYN_COOKIES are disabled, the kernel
fails to build:

include/linux/netfilter_ipv6.h:180:9: error: implicit declaration of function '__cookie_v6_init_sequence'
[-Werror,-Wimplicit-function-declaration]
return __cookie_v6_init_sequence(iph, th, mssp);
include/linux/netfilter_ipv6.h:194:9: error: implicit declaration of function '__cookie_v6_check'
[-Werror,-Wimplicit-function-declaration]
return __cookie_v6_check(iph, th, cookie);
net/ipv6/netfilter.c:237:26: error: use of undeclared identifier '__cookie_v6_init_sequence'; did you mean 'cookie_init_sequence'?
net/ipv6/netfilter.c:238:21: error: use of undeclared identifier '__cookie_v6_check'; did you mean '__cookie_v4_check'?

Fix the IS_ENABLED() checks to match the function declaration
and definitions for these.

Fixes: 3006a5224f15 ("netfilter: synproxy: remove module dependency on IPv6 SYNPROXY")
Signed-off-by: Arnd Bergmann <[email protected]>
---
include/linux/netfilter_ipv6.h | 14 ++++++++------
net/ipv6/netfilter.c | 2 ++
2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 1aa3a23744df..7beb681e1ce5 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -171,31 +171,33 @@ static inline u32 nf_ipv6_cookie_init_sequence(const struct ipv6hdr *iph,
const struct tcphdr *th,
u16 *mssp)
{
+#if IS_ENABLED(CONFIG_SYN_COOKIES)
#if IS_MODULE(CONFIG_IPV6)
const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();

if (v6_ops)
return v6_ops->cookie_init_sequence(iph, th, mssp);
-
- return 0;
-#else
+#elif IS_BUILTIN(CONFIG_IPV6)
return __cookie_v6_init_sequence(iph, th, mssp);
#endif
+#endif
+ return 0;
}

static inline int nf_cookie_v6_check(const struct ipv6hdr *iph,
const struct tcphdr *th, __u32 cookie)
{
+#if IS_ENABLED(CONFIG_SYN_COOKIES)
#if IS_MODULE(CONFIG_IPV6)
const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();

if (v6_ops)
return v6_ops->cookie_v6_check(iph, th, cookie);
-
- return 0;
-#else
+#elif IS_BUILTIN(CONFIG_IPV6)
return __cookie_v6_check(iph, th, cookie);
#endif
+#endif
+ return 0;
}

__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index dffb10fdc3e8..61819ed858b1 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -234,8 +234,10 @@ static const struct nf_ipv6_ops ipv6ops = {
.route_me_harder = ip6_route_me_harder,
.dev_get_saddr = ipv6_dev_get_saddr,
.route = __nf_ip6_route,
+#if IS_ENABLED(CONFIG_SYN_COOKIES)
.cookie_init_sequence = __cookie_v6_init_sequence,
.cookie_v6_check = __cookie_v6_check,
+#endif
#endif
.route_input = ip6_route_input,
.fragment = ip6_fragment,
--
2.20.0

2019-06-19 17:47:15

by Pablo Neira Ayuso

[permalink] [raw]

Subject: Re: [PATCH] netfilter: synproxy: fix building syncookie calls

On Wed, Jun 19, 2019 at 02:54:36PM +0200, Arnd Bergmann wrote:
> When either CONFIG_IPV6 or CONFIG_SYN_COOKIES are disabled, the kernel
> fails to build:
>
> include/linux/netfilter_ipv6.h:180:9: error: implicit declaration of function '__cookie_v6_init_sequence'
> [-Werror,-Wimplicit-function-declaration]
> return __cookie_v6_init_sequence(iph, th, mssp);
> include/linux/netfilter_ipv6.h:194:9: error: implicit declaration of function '__cookie_v6_check'
> [-Werror,-Wimplicit-function-declaration]
> return __cookie_v6_check(iph, th, cookie);
> net/ipv6/netfilter.c:237:26: error: use of undeclared identifier '__cookie_v6_init_sequence'; did you mean 'cookie_init_sequence'?
> net/ipv6/netfilter.c:238:21: error: use of undeclared identifier '__cookie_v6_check'; did you mean '__cookie_v4_check'?
>
> Fix the IS_ENABLED() checks to match the function declaration
> and definitions for these.

I made this:

https://patchwork.ozlabs.org/patch/1117735/

Basically it does:

+#endif
+#if IS_MODULE(CONFIG_IPV6) && defined(CONFIG_SYN_COOKIES)
.cookie_init_sequence = __cookie_v6_init_sequence,
.cookie_v6_check = __cookie_v6_check,
#endif

If CONFIG_IPV6=n, then net/ipv6/netfilter.c is never compiled.

Unless I'm missing anything, I'd prefer my patch because it's a bit
less of ifdefs 8-)

Thanks!

2019-06-19 19:59:15

by Arnd Bergmann

[permalink] [raw]

Subject: Re: [PATCH] netfilter: synproxy: fix building syncookie calls

On Wed, Jun 19, 2019 at 7:46 PM Pablo Neira Ayuso <[email protected]> wrote:
>
> On Wed, Jun 19, 2019 at 02:54:36PM +0200, Arnd Bergmann wrote:
> > When either CONFIG_IPV6 or CONFIG_SYN_COOKIES are disabled, the kernel
> > fails to build:
> >
> > include/linux/netfilter_ipv6.h:180:9: error: implicit declaration of function '__cookie_v6_init_sequence'
> > [-Werror,-Wimplicit-function-declaration]
> > return __cookie_v6_init_sequence(iph, th, mssp);
> > include/linux/netfilter_ipv6.h:194:9: error: implicit declaration of function '__cookie_v6_check'
> > [-Werror,-Wimplicit-function-declaration]
> > return __cookie_v6_check(iph, th, cookie);
> > net/ipv6/netfilter.c:237:26: error: use of undeclared identifier '__cookie_v6_init_sequence'; did you mean 'cookie_init_sequence'?
> > net/ipv6/netfilter.c:238:21: error: use of undeclared identifier '__cookie_v6_check'; did you mean '__cookie_v4_check'?
> >
> > Fix the IS_ENABLED() checks to match the function declaration
> > and definitions for these.
>
> I made this:
>
> https://patchwork.ozlabs.org/patch/1117735/
>
> Basically it does:
>
> +#endif
> +#if IS_MODULE(CONFIG_IPV6) && defined(CONFIG_SYN_COOKIES)
> .cookie_init_sequence = __cookie_v6_init_sequence,
> .cookie_v6_check = __cookie_v6_check,
> #endif
>
> If CONFIG_IPV6=n, then net/ipv6/netfilter.c is never compiled.
>
> Unless I'm missing anything, I'd prefer my patch because it's a bit
> less of ifdefs 8-)

That takes care of the link error, but not the "implicit declaration"
when netfilter_ipv6.h is included without SYN_COOKIES.

My patch addresses both issues together since they are strongly
related.

Arnd

2019-06-20 10:20:54

by Pablo Neira Ayuso

[permalink] [raw]