linux-kernel - Re: [PATCH] netfilter: synproxy: fix building syncookie calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190619174642.hvjvmfaptfdkmbpk@salvia>
Date:   Wed, 19 Jun 2019 19:46:42 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Fernando Fernandez Mancera <ffmancera@...eup.net>,
        wenxu <wenxu@...oud.cn>, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH] netfilter: synproxy: fix building syncookie calls

On Wed, Jun 19, 2019 at 02:54:36PM +0200, Arnd Bergmann wrote:
> When either CONFIG_IPV6 or CONFIG_SYN_COOKIES are disabled, the kernel
> fails to build:
> 
> include/linux/netfilter_ipv6.h:180:9: error: implicit declaration of function '__cookie_v6_init_sequence'
>       [-Werror,-Wimplicit-function-declaration]
>         return __cookie_v6_init_sequence(iph, th, mssp);
> include/linux/netfilter_ipv6.h:194:9: error: implicit declaration of function '__cookie_v6_check'
>       [-Werror,-Wimplicit-function-declaration]
>         return __cookie_v6_check(iph, th, cookie);
> net/ipv6/netfilter.c:237:26: error: use of undeclared identifier '__cookie_v6_init_sequence'; did you mean 'cookie_init_sequence'?
> net/ipv6/netfilter.c:238:21: error: use of undeclared identifier '__cookie_v6_check'; did you mean '__cookie_v4_check'?
> 
> Fix the IS_ENABLED() checks to match the function declaration
> and definitions for these.

I made this:

https://patchwork.ozlabs.org/patch/1117735/

Basically it does:

+#endif
+#if IS_MODULE(CONFIG_IPV6) && defined(CONFIG_SYN_COOKIES)
        .cookie_init_sequence   = __cookie_v6_init_sequence,
        .cookie_v6_check        = __cookie_v6_check,
 #endif

If CONFIG_IPV6=n, then net/ipv6/netfilter.c is never compiled.

Unless I'm missing anything, I'd prefer my patch because it's a bit
less of ifdefs 8-)

Thanks!