[PATCH nf] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency

[PATCH nf] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency

[Florian Westphal]

nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.

The current use of the netfilter ipv6 stub indirections  causes a module
dependency between ipv6 and nf_defrag_ipv6.

This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
be unloaded.

Remove the indirection and always use a direct call.  This creates a
depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:

modinfo nf_conntrack
depends:        nf_conntrack,nf_defrag_ipv6,bridge

.. and nf_conntrack already depends on nf_defrag_ipv6 anyway.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 I can also re-send it when nf-next reopens later, whatever you prefer.

 include/linux/netfilter_ipv6.h             | 18 ------------------
 net/bridge/netfilter/nf_conntrack_bridge.c |  8 ++++++--
 net/ipv6/netfilter.c                       |  3 ---
 3 files changed, 6 insertions(+), 23 deletions(-)

diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index aac42c28fe62..9b67394471e1 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -58,7 +58,6 @@ struct nf_ipv6_ops {
 			int (*output)(struct net *, struct sock *, struct sk_buff *));
 	int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
 #if IS_MODULE(CONFIG_IPV6)
-	int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user);
 	int (*br_fragment)(struct net *net, struct sock *sk,
 			   struct sk_buff *skb,
 			   struct nf_bridge_frag_data *data,
@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,
 
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 
-static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb,
-				    u32 user)
-{
-#if IS_MODULE(CONFIG_IPV6)
-	const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
-
-	if (!v6_ops)
-		return 1;
-
-	return v6_ops->br_defrag(net, skb, user);
-#elif IS_BUILTIN(CONFIG_IPV6)
-	return nf_ct_frag6_gather(net, skb, user);
-#else
-	return 1;
-#endif
-}
-
 int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		    struct nf_bridge_frag_data *data,
 		    int (*output)(struct net *, struct sock *sk,
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 809673222382..8d033a75a766 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb,
 static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,
 				     const struct nf_hook_state *state)
 {
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 	enum ip_conntrack_info ctinfo;
 	struct br_input_skb_cb cb;
@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,
 
 	br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm));
 
-	err = nf_ipv6_br_defrag(state->net, skb,
-				IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
+	err = nf_ct_frag6_gather(state->net, skb,
+				 IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
 	/* queued */
 	if (err == -EINPROGRESS)
 		return NF_STOLEN;
 
 	br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size);
 	return err == 0 ? NF_ACCEPT : NF_DROP;
+#else
+	return NF_ACCEPT;
+#endif
 }
 
 static int nf_ct_br_ip_check(const struct sk_buff *skb)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 409e79b84a83..6d0e942d082d 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = {
 	.route_input		= ip6_route_input,
 	.fragment		= ip6_fragment,
 	.reroute		= nf_ip6_reroute,
-#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
-	.br_defrag		= nf_ct_frag6_gather,
-#endif
 #if IS_MODULE(CONFIG_IPV6)
 	.br_fragment		= br_ip6_fragment,
 #endif
-- 
2.26.2

Re: [PATCH nf] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency

[Pablo Neira Ayuso]

On Mon, Aug 10, 2020 at 01:52:15PM +0200, Florian Westphal wrote:
> nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.
> 
> The current use of the netfilter ipv6 stub indirections  causes a module
> dependency between ipv6 and nf_defrag_ipv6.
> 
> This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
> be unloaded.
> 
> Remove the indirection and always use a direct call.  This creates a
> depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:
> 
> modinfo nf_conntrack
> depends:        nf_conntrack,nf_defrag_ipv6,bridge
> 
> .. and nf_conntrack already depends on nf_defrag_ipv6 anyway.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  I can also re-send it when nf-next reopens later, whatever you prefer.

No problem, it can just sit here until net-next reopens.

Re: [PATCH nf] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency

[Pablo Neira Ayuso]

On Tue, Aug 11, 2020 at 09:30:26AM +0200, Pablo Neira Ayuso wrote:
> On Mon, Aug 10, 2020 at 01:52:15PM +0200, Florian Westphal wrote:
> > nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.
> > 
> > The current use of the netfilter ipv6 stub indirections  causes a module
> > dependency between ipv6 and nf_defrag_ipv6.
> > 
> > This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
> > be unloaded.
> > 
> > Remove the indirection and always use a direct call.  This creates a
> > depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:
> > 
> > modinfo nf_conntrack
> > depends:        nf_conntrack,nf_defrag_ipv6,bridge
> > 
> > .. and nf_conntrack already depends on nf_defrag_ipv6 anyway.
> > 
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > ---
> >  I can also re-send it when nf-next reopens later, whatever you prefer.
> 
> No problem, it can just sit here until net-next reopens.

Oh, I skipped the [PATCH nf] tag. This can go to nf.git then.

Re: [PATCH nf] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency

[Pablo Neira Ayuso]

On Mon, Aug 10, 2020 at 01:52:15PM +0200, Florian Westphal wrote:
> nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.
> 
> The current use of the netfilter ipv6 stub indirections  causes a module
> dependency between ipv6 and nf_defrag_ipv6.
> 
> This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
> be unloaded.
> 
> Remove the indirection and always use a direct call.  This creates a
> depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:
> 
> modinfo nf_conntrack
> depends:        nf_conntrack,nf_defrag_ipv6,bridge
> 
> .. and nf_conntrack already depends on nf_defrag_ipv6 anyway.

Applied to nf.git, thanks.