diff options
| author |   Arnd Bergmann <arnd@arndb.de> | 2019-06-17 15:15:04 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-21 17:21:11 +0200 |
| commit | 43a38c3f318082839d7e613352d4dae7bbdfcdec (patch) | |
| tree | 7d5e9f6fe2e357bc404554923c265b2a2721a3d3 /include/linux/netfilter_ipv6.h | |
| parent | netfilter: bridge: prevent UAF in brnf_exit_net() (diff) | |
| download | wireguard-linux-43a38c3f318082839d7e613352d4dae7bbdfcdec.tar.xz wireguard-linux-43a38c3f318082839d7e613352d4dae7bbdfcdec.zip | |
netfilter: fix nf_conntrack_bridge/ipv6 link error
When CONFIG_IPV6 is disabled, the bridge netfilter code
produces a link error:
ERROR: "br_ip6_fragment" [net/bridge/netfilter/nf_conntrack_bridge.ko] undefined!
ERROR: "nf_ct_frag6_gather" [net/bridge/netfilter/nf_conntrack_bridge.ko] undefined!
The problem is that it assumes that whenever IPV6 is not a loadable
module, we can call the functions direction. This is clearly
not true when IPV6 is disabled.
There are two other functions defined like this in linux/netfilter_ipv6.h,
so change them all the same way.
Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/linux/netfilter_ipv6.h')
| -rw-r--r-- | include/linux/netfilter_ipv6.h | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h index 22e6398bc482..7beb681e1ce5 100644 --- a/include/linux/netfilter_ipv6.h +++ b/include/linux/netfilter_ipv6.h @@ -75,8 +75,10 @@ static inline int nf_ipv6_chk_addr(struct net *net, const struct in6_addr *addr, return 1; return v6_ops->chk_addr(net, addr, dev, strict); -#else +#elif IS_BUILTIN(CONFIG_IPV6) return ipv6_chk_addr(net, addr, dev, strict); +#else + return 1; #endif } @@ -113,8 +115,10 @@ static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb, return 1; return v6_ops->br_defrag(net, skb, user); -#else +#elif IS_BUILTIN(CONFIG_IPV6) return nf_ct_frag6_gather(net, skb, user); +#else + return 1; #endif } @@ -138,8 +142,10 @@ static inline int nf_br_ip6_fragment(struct net *net, struct sock *sk, return 1; return v6_ops->br_fragment(net, sk, skb, data, output); -#else +#elif IS_BUILTIN(CONFIG_IPV6) return br_ip6_fragment(net, sk, skb, data, output); +#else + return 1; #endif } @@ -154,8 +160,10 @@ static inline int nf_ip6_route_me_harder(struct net *net, struct sk_buff *skb) return -EHOSTUNREACH; return v6_ops->route_me_harder(net, skb); -#else +#elif IS_BUILTIN(CONFIG_IPV6) return ip6_route_me_harder(net, skb); +#else + return -EHOSTUNREACH; #endif } |