netdev - Re: [PATCH] ipvs: skip ipvs snat processing when packet dst is not vip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202505201507.zvDoaADX-lkp@intel.com>
Date: Tue, 20 May 2025 15:14:32 +0800
From: kernel test robot <lkp@...el.com>
To: Duan Jiong <djduanjiong@...il.com>, ja@....bg, pablo@...filter.org
Cc: oe-kbuild-all@...ts.linux.dev, netdev@...r.kernel.org,
	Duan Jiong <djduanjiong@...il.com>
Subject: Re: [PATCH] ipvs: skip ipvs snat processing when packet dst is not
 vip

Hi Duan,

kernel test robot noticed the following build errors:

[auto build test ERROR on netfilter-nf/main]
[also build test ERROR on horms-ipvs/master linus/master v6.15-rc7 next-20250516]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Duan-Jiong/ipvs-skip-ipvs-snat-processing-when-packet-dst-is-not-vip/20250519-183312
base:   https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link:    https://lore.kernel.org/r/20250519103203.17255-1-djduanjiong%40gmail.com
patch subject: [PATCH] ipvs: skip ipvs snat processing when packet dst is not vip
config: i386-randconfig-014-20250520 (https://download.01.org/0day-ci/archive/20250520/202505201507.zvDoaADX-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250520/202505201507.zvDoaADX-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202505201507.zvDoaADX-lkp@intel.com/

All error/warnings (new ones prefixed by >>):

   net/netfilter/ipvs/ip_vs_core.c: In function 'handle_response':
>> net/netfilter/ipvs/ip_vs_core.c:1263:32: error: storage size of 'ctinfo' isn't known
    1263 |         enum ip_conntrack_info ctinfo;
         |                                ^~~~~~
>> net/netfilter/ipvs/ip_vs_core.c:1264:30: error: implicit declaration of function 'nf_ct_get' [-Werror=implicit-function-declaration]
    1264 |         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         |                              ^~~~~~~~~
>> net/netfilter/ipvs/ip_vs_core.c:1278:24: error: invalid use of undefined type 'struct nf_conn'
    1278 |                     &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
         |                        ^~
>> net/netfilter/ipvs/ip_vs_core.c:1278:36: error: 'IP_CT_DIR_ORIGINAL' undeclared (first use in this function)
    1278 |                     &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
         |                                    ^~~~~~~~~~~~~~~~~~
   net/netfilter/ipvs/ip_vs_core.c:1278:36: note: each undeclared identifier is reported only once for each function it appears in
>> net/netfilter/ipvs/ip_vs_core.c:1263:32: warning: unused variable 'ctinfo' [-Wunused-variable]
    1263 |         enum ip_conntrack_info ctinfo;
         |                                ^~~~~~
   net/netfilter/ipvs/ip_vs_core.c: In function 'ip_vs_in_icmp':
   net/netfilter/ipvs/ip_vs_core.c:1602:15: warning: variable 'outer_proto' set but not used [-Wunused-but-set-variable]
    1602 |         char *outer_proto = "IPIP";
         |               ^~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +1263 net/netfilter/ipvs/ip_vs_core.c

  1254	
  1255	/* Handle response packets: rewrite addresses and send away...
  1256	 */
  1257	static unsigned int
  1258	handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
  1259			struct ip_vs_conn *cp, struct ip_vs_iphdr *iph,
  1260			unsigned int hooknum)
  1261	{
  1262		struct ip_vs_protocol *pp = pd->pp;
> 1263		enum ip_conntrack_info ctinfo;
> 1264		struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
  1265	
  1266		if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
  1267			goto after_nat;
  1268	
  1269		IP_VS_DBG_PKT(11, af, pp, skb, iph->off, "Outgoing packet");
  1270	
  1271		if (skb_ensure_writable(skb, iph->len))
  1272			goto drop;
  1273	
  1274		/* mangle the packet */
  1275		if (ct != NULL &&
  1276		    hooknum == NF_INET_FORWARD &&
  1277		    !ip_vs_addr_equal(af,
> 1278			    &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
  1279			    &cp->vaddr))
  1280			return NF_ACCEPT;
  1281		if (pp->snat_handler &&
  1282		    !SNAT_CALL(pp->snat_handler, skb, pp, cp, iph))
  1283			goto drop;
  1284	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki