Re: [PATCH] netfilter: fix dependency issues between IPv6 defragmentation and ip6tables

[liusdu]

On 2015å05æ04æ 04:09, Florian Westphal wrote:
> liusdu <liusdu@xxxxxxx> wrote:
> > On 2015å05æ03æ 19:07, Florian Westphal wrote:
> > > Liu Hua <sdu.liu@xxxxxxxxxx> wrote:
> > > > commit f6318e558806c925029dc101f14874be9f9fa78f fix some related issue
> > > > when ip6tables is enabled. But when IP6_NF_IPTABLES is disabled and
> > > > NETFILTER_XT_TARGET_TPROXY is enabled. We will meet build failure with
> > > > "net/built-in.o: In function `tproxy_tg_init':
> > > > net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'
> > > > "
> > > > So this patch change the Kconfig as ipv4 does.
> > > > --- a/net/netfilter/Kconfig
> > > > +++ b/net/netfilter/Kconfig
> > > > @@ -865,7 +865,7 @@ config NETFILTER_XT_TARGET_TPROXY
> > > >   	depends on (IPV6 || IPV6=n)
> > > >   	depends on IP_NF_MANGLE
> > > >   	select NF_DEFRAG_IPV4
> > > > -	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> > > > +	select NF_DEFRAG_IPV6
> > > IP6_NF_IPTABLES
> > > If IP6_NF_IPTABLES is not set, why would we have to pick
> > > up IPV6 defragmentation?
> > >
> > > Without ip6tables, TPROXY cannot be used for ipv6; in fact;
> > > xt_TPROXY should be built without ipv6 support in this case.
> > >
> > > My guess is that you have TPROXY=y but DEFRAG_IPV6=m, but that
> > > might warrant a better fix (xt_socket seems to have same issue).
> > Hi Florian,
> >
> > Yes, It was exactly what I did.  Actually there is a macro to
> > determine whether we compile nf_defrag_ipv6_enable or not,
> > called XT_TPROXY_HAVE_IPV6, which will be set to 1 while
> > IP6_NF_IPTABLES=y or m.  With the patch below  we can
> > make the compiling pass. But I am not sure it is good enough
> > or not.
> > diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
> > index cca96ce..abbda64 100644
> > --- a/net/netfilter/xt_TPROXY.c
> > +++ b/net/netfilter/xt_TPROXY.c
> > @@ -24,7 +24,7 @@
> >
> >   #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
> >
> > -#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
> > +#if IS_BUILTIN(CONFIG_IP6_NF_IPTABLES)
> This means you need to set IP6_NF_IPTABLES=y, else TPROXY doesn't work
> with ipv6.  I suggest to try and get Kconfig to force the needed
> dependency (DEFRAG=y if TPROXY=y && DEFRAG=m if TPROXY=m).
>
> Maybe this is enough (untested)
>
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
>          depends on NETFILTER_XTABLES
>          depends on NETFILTER_ADVANCED
>          depends on (IPV6 || IPV6=n)
> +       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
>          depends on IP_NF_MANGLE
>          select NF_DEFRAG_IPV4
>          select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> @@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
>          depends on NETFILTER_ADVANCED
>          depends on !NF_CONNTRACK || NF_CONNTRACK
>          depends on (IPV6 || IPV6=n)
> +       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
>          select NF_DEFRAG_IPV4
>          select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
>          help
It works for me. With it DEFRAG, TPROXY and IP6_NF_IPTABLES are always  
compiled as
the same type. A better way to solve such dependency problem.

Since I only report this, and you solve it. So could you give a formal 
patch for this. I am a
beginner of linux network system and very glad to do the test for you.



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/