From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752737AbbECOTK (ORCPT ); Sun, 3 May 2015 10:19:10 -0400 Received: from m50-111.126.com ([123.125.50.111]:34625 "EHLO m50-111.126.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751060AbbECOTD (ORCPT ); Sun, 3 May 2015 10:19:03 -0400 Message-ID: <55462E32.2060806@126.com> Date: Sun, 03 May 2015 22:18:26 +0800 From: liusdu User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.2 MIME-Version: 1.0 To: Florian Westphal , Liu Hua CC: davem@davemloft.net, kadlec@blackhole.kfki.hu, kaber@trash.net, pablo@netfilter.org, netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] netfilter: fix dependency issues between IPv6 defragmentation and ip6tables References: <1430646618-7625-1-git-send-email-sdu.liu@huawei.com> <20150503110715.GE22481@breakpoint.cc> In-Reply-To: <20150503110715.GE22481@breakpoint.cc> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-CM-TRANSID: jtKowAAnDpczLkZV6BdnAQ--.1165S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7tw47ZF13uF4xZrykKF18uFg_yoW8Kw4xpa s8t34Sy398JF1DtwnrArs2yFZ8Jr48Cr17u3s5C3y5XFyDWws5Ja9agrWUZayUZwsYqr47 XFn7G345Ca98Aw7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jnKsUUUUUU= X-Originating-IP: [222.131.153.63] X-CM-SenderInfo: polx2vbx6rjloofrz/1tbi4hTuNFUwyDqimAAAsB Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2015年05月03日 19:07, Florian Westphal wrote: > Liu Hua wrote: >> commit f6318e558806c925029dc101f14874be9f9fa78f fix some related issue >> when ip6tables is enabled. But when IP6_NF_IPTABLES is disabled and >> NETFILTER_XT_TARGET_TPROXY is enabled. We will meet build failure with >> "net/built-in.o: In function `tproxy_tg_init': >> net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable' >> " >> So this patch change the Kconfig as ipv4 does. >> --- a/net/netfilter/Kconfig >> +++ b/net/netfilter/Kconfig >> @@ -865,7 +865,7 @@ config NETFILTER_XT_TARGET_TPROXY >> depends on (IPV6 || IPV6=n) >> depends on IP_NF_MANGLE >> select NF_DEFRAG_IPV4 >> - select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES >> + select NF_DEFRAG_IPV6 > IP6_NF_IPTABLES > If IP6_NF_IPTABLES is not set, why would we have to pick > up IPV6 defragmentation? > > Without ip6tables, TPROXY cannot be used for ipv6; in fact; > xt_TPROXY should be built without ipv6 support in this case. > > My guess is that you have TPROXY=y but DEFRAG_IPV6=m, but that > might warrant a better fix (xt_socket seems to have same issue). Hi Florian, Yes, It was exactly what I did. Actually there is a macro to determine whether we compile nf_defrag_ipv6_enable or not, called XT_TPROXY_HAVE_IPV6, which will be set to 1 while IP6_NF_IPTABLES=y or m. With the patch below we can make the compiling pass. But I am not sure it is good enough or not. diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index cca96ce..abbda64 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -24,7 +24,7 @@ #include -#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) +#if IS_BUILTIN(CONFIG_IP6_NF_IPTABLES) #define XT_TPROXY_HAVE_IPV6 1 #include #include diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index e092cb0..239fccf 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -21,7 +21,7 @@ #include #include -#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) +#if IS_BUILTIN(CONFIG_IP6_NF_IPTABLES) #define XT_SOCKET_HAVE_IPV6 1 #include #include