lkml.org 
[lkml]   [2020]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.7 22/54] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 2404b73c3f1a5f15726c6ecd226b56f6f992767f ]

    nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.

    The current use of the netfilter ipv6 stub indirections causes a module
    dependency between ipv6 and nf_defrag_ipv6.

    This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
    be unloaded.

    Remove the indirection and always use a direct call. This creates a
    depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:

    modinfo nf_conntrack
    depends: nf_conntrack,nf_defrag_ipv6,bridge

    .. and nf_conntrack already depends on nf_defrag_ipv6 anyway.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/netfilter_ipv6.h | 18 ------------------
    net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++++++--
    net/ipv6/netfilter.c | 3 ---
    3 files changed, 6 insertions(+), 23 deletions(-)

    diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
    index aac42c28fe62d..9b67394471e1c 100644
    --- a/include/linux/netfilter_ipv6.h
    +++ b/include/linux/netfilter_ipv6.h
    @@ -58,7 +58,6 @@ struct nf_ipv6_ops {
    int (*output)(struct net *, struct sock *, struct sk_buff *));
    int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
    #if IS_MODULE(CONFIG_IPV6)
    - int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user);
    int (*br_fragment)(struct net *net, struct sock *sk,
    struct sk_buff *skb,
    struct nf_bridge_frag_data *data,
    @@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,

    #include <net/netfilter/ipv6/nf_defrag_ipv6.h>

    -static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb,
    - u32 user)
    -{
    -#if IS_MODULE(CONFIG_IPV6)
    - const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
    -
    - if (!v6_ops)
    - return 1;
    -
    - return v6_ops->br_defrag(net, skb, user);
    -#elif IS_BUILTIN(CONFIG_IPV6)
    - return nf_ct_frag6_gather(net, skb, user);
    -#else
    - return 1;
    -#endif
    -}
    -
    int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
    struct nf_bridge_frag_data *data,
    int (*output)(struct net *, struct sock *sk,
    diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
    index 8096732223828..8d033a75a766e 100644
    --- a/net/bridge/netfilter/nf_conntrack_bridge.c
    +++ b/net/bridge/netfilter/nf_conntrack_bridge.c
    @@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb,
    static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,
    const struct nf_hook_state *state)
    {
    +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
    u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
    enum ip_conntrack_info ctinfo;
    struct br_input_skb_cb cb;
    @@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,

    br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm));

    - err = nf_ipv6_br_defrag(state->net, skb,
    - IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
    + err = nf_ct_frag6_gather(state->net, skb,
    + IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
    /* queued */
    if (err == -EINPROGRESS)
    return NF_STOLEN;

    br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size);
    return err == 0 ? NF_ACCEPT : NF_DROP;
    +#else
    + return NF_ACCEPT;
    +#endif
    }

    static int nf_ct_br_ip_check(const struct sk_buff *skb)
    diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
    index 409e79b84a830..6d0e942d082d4 100644
    --- a/net/ipv6/netfilter.c
    +++ b/net/ipv6/netfilter.c
    @@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = {
    .route_input = ip6_route_input,
    .fragment = ip6_fragment,
    .reroute = nf_ip6_reroute,
    -#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
    - .br_defrag = nf_ct_frag6_gather,
    -#endif
    #if IS_MODULE(CONFIG_IPV6)
    .br_fragment = br_ip6_fragment,
    #endif
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-08-24 19:13    [W:4.285 / U:0.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site