Re: [PATCH v2 nf] netfilter: conntrack: set icmpv6 redirects as RELATED

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Nov 30, 2022 at 06:30:42PM +0100, Pablo Neira Ayuso wrote:
> On Wed, Nov 23, 2022 at 01:16:39PM +0100, Florian Westphal wrote:
> > icmp conntrack will set icmp redirects as RELATED, but icmpv6 will not
> > do this.
> > 
> > For icmpv6, only icmp errors (code <= 128) are examined for RELATED state.
> > ICMPV6 Redirects are part of neighbour discovery mechanism, those are
> > handled by marking a selected subset (e.g.  neighbour solicitations) as
> > UNTRACKED, but not REDIRECT -- they will thus be flagged as INVALID.
> > 
> > Add minimal support for REDIRECTs.  No parsing of neighbour options is
> > added for simplicity, so this will only check that we have the embeeded
> > original header (ND_OPT_REDIRECT_HDR), and then attempt to do a flow
> > lookup for this tuple.
> > 
> > Also extend the existing test case to cover redirects.
> 
> Applied to nf-next, thanks.

Florian, I am hitting this here:

net/netfilter/nf_conntrack_proto_icmpv6.c: In function ‘nf_conntrack_icmpv6_redirect’:
net/netfilter/nf_conntrack_proto_icmpv6.c:179:56: error: incompatible type for argument 6 of ‘nf_conntrack_inet_error’
  179 |                                        IPPROTO_ICMPV6, outer_daddr);
      |                                                        ^~~~~~~~~~~
      |                                                        |
      |                                                        union nf_inet_addr
In file included from net/netfilter/nf_conntrack_proto_icmpv6.c:21:
./include/net/netfilter/nf_conntrack_l4proto.h:83:49: note: expected ‘union nf_inet_addr *’ but argument is of type ‘union nf_inet_addr’
   83 |                             union nf_inet_addr *outer_daddr);
      |                             ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
net/netfilter/nf_conntrack_proto_icmpv6.c:180:1: error: control reaches end of non-void function [-Werror=return-type]
  180 | }
      | ^