Changes in Kconfig

6c959fd5 - netfilter: Make legacy configs user selectable

Mon, 30 Sep 2024 09:58:54 +0000

netfilter: Make legacy configs user selectableThis option makes legacy Netfilter Kconfig user selectable, giving usersthe option to configure iptables without enabling any other config.Make the following KConfig entries user selectable: * BRIDGE_NF_EBTABLES_LEGACY * IP_NF_ARPTABLES * IP_NF_IPTABLES_LEGACY * IP6_NF_IPTABLES_LEGACYSigned-off-by: Breno Leitao Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

7ad26978 - netfilter: ebtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:12 +0000

netfilter: ebtables: allow xtables-nft only buildsSame patch as previous one, but for ebtables.To build a kernel that only supports ebtables-nft, the builtin tablesneed to be disabled, i.e.:CONFIG_BRIDGE_EBT_BROUTE=nCONFIG_BRIDGE_EBT_T_FILTER=nCONFIG_BRIDGE_EBT_T_NAT=nThe ebtables specific extensions can then be used nftables'NFT_COMPAT interface.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/bridge/netfilter/Kconfig

77ccee96 - netfilter: nf_log_bridge: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:09 +0000

netfilter: nf_log_bridge: merge with nf_log_syslogProvide bridge log support from nf_log_syslog.After the merge there is no need to load the "real packet loggers",all of them now reside in the same module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

fd2d6bc4 - netfilter: nft_reject_bridge: fix build errors due to code movement

Mon, 16 Nov 2020 03:42:03 +0000

netfilter: nft_reject_bridge: fix build errors due to code movementFix build errors in net/bridge/netfilter/nft_reject_bridge.koby selecting NF_REJECT_IPV4, which provides the missing symbols.ERROR: modpost: "nf_reject_skb_v4_tcp_reset" [net/bridge/netfilter/nft_reject_bridge.ko] undefined!ERROR: modpost: "nf_reject_skb_v4_unreach" [net/bridge/netfilter/nft_reject_bridge.ko] undefined!Fixes: fa538f7cf05a ("netfilter: nf_reject: add reject skbuff creation helpers")Reported-by: kernel test robot Signed-off-by: Randy Dunlap Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

fa538f7c - netfilter: nf_reject: add reject skbuff creation helpers

Thu, 22 Oct 2020 19:43:51 +0000

netfilter: nf_reject: add reject skbuff creation helpersAdds reject skbuff creation helper functions to ipv4/6 nf_rejectinfrastructure. Use these functions for reject verdict in bridgefamily.Can be reused by all different families that support reject andwill not inject the reject packet through ip local out.Signed-off-by: Jose M. Guisado Gomez Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

dfee0e99 - netfilter: bridge: make NF_TABLES_BRIDGE tristate

Wed, 10 Jul 2019 08:08:20 +0000

netfilter: bridge: make NF_TABLES_BRIDGE tristateThe new nft_meta_bridge code fails to link as built-in when NF_TABLESis a loadable module.net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_eval':nft_meta_bridge.c:(.text+0x1e8): undefined reference to `nft_meta_get_eval'net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_get_init':nft_meta_bridge.c:(.text+0x468): undefined reference to `nft_meta_get_init'nft_meta_bridge.c:(.text+0x49c): undefined reference to `nft_parse_register'nft_meta_bridge.c:(.text+0x4cc): undefined reference to `nft_validate_register_store'net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_exit':nft_meta_bridge.c:(.exit.text+0x14): undefined reference to `nft_unregister_expr'net/bridge/netfilter/nft_meta_bridge.o: In function `nft_meta_bridge_module_init':nft_meta_bridge.c:(.init.text+0x14): undefined reference to `nft_register_expr'net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x60): undefined reference to `nft_meta_get_dump'net/bridge/netfilter/nft_meta_bridge.o:(.rodata+0x88): undefined reference to `nft_meta_set_eval'This can happen because the NF_TABLES_BRIDGE dependency itself is just a'bool'. Make the symbol a 'tristate' instead so Kconfig can propagate thedependencies correctly.Fixes: 30e103fe24de ("netfilter: nft_meta: move bridge meta keys into nft_meta_bridge")Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

fc2f14f8 - netfilter: bridge: NF_CONNTRACK_BRIDGE does not depend on NF_TABLES_BRIDGE

Thu, 18 Jul 2019 18:20:00 +0000

netfilter: bridge: NF_CONNTRACK_BRIDGE does not depend on NF_TABLES_BRIDGEPlace NF_CONNTRACK_BRIDGE away from the NF_TABLES_BRIDGE dependency.Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

30e103fe - netfilter: nft_meta: move bridge meta keys into nft_meta_bridge

Fri, 05 Jul 2019 13:16:32 +0000

netfilter: nft_meta: move bridge meta keys into nft_meta_bridgeSeparate bridge meta key from nft_meta to meta_bridge to avoid adependency between the bridge module and nft_meta when using the bridgeAPI available through include/linux/if_bridge.hSigned-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

cd238eff - docs: kbuild: convert docs to ReST and rename to *.rst

Wed, 12 Jun 2019 17:52:48 +0000

docs: kbuild: convert docs to ReST and rename to *.rstThe kbuild documentation clearly shows that the documentsthere are written at different times: some use markdown,some use their own peculiar logic to split sections.Convert everything to ReST without affecting too muchthe author's style and avoiding adding uneeded markups.The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups.At its new index.rst, let's add a :orphan: while this is not linked tothe main index.rst file, in order to avoid build warnings.Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet List of files: /linux-6.15/net/bridge/netfilter/Kconfig

3c171f49 - netfilter: bridge: add connection tracking system

Wed, 29 May 2019 11:25:37 +0000

netfilter: bridge: add connection tracking systemThis patch adds basic connection tracking support for the bridge,including initial IPv4 support.This patch register two hooks to deal with the bridge forwarding path,one from the bridge prerouting hook to call nf_conntrack_in(); andanother from the bridge postrouting hook to confirm the entry.The conntrack bridge prerouting hook defragments packets before passingthem to nf_conntrack_in() to look up for an existing entry, otherwise anew entry is allocated and it is attached to the skbuff. The conntrackbridge postrouting hook confirms new conntrack entries, ie. if this isthe first packet seen, then it adds the entry to the hashtable and (ifneeded) it refragments the skbuff into the original fragments, leavingthe geometry as is if possible. Exceptions are linearized skbuffs, eg.skbuffs that are passed up to nfqueue and conntrack helpers, as well ascloned skbuff for the local delivery (eg. tcpdump), also in case ofbridge port flooding (cloned skbuff too).The packet defragmentation is done through the ip_defrag() call. Thisforces us to save the bridge control buffer, reset the IP control bufferarea and then restore it after call. This function also bumps the IPfragmentation statistics, it would be probably desiderable to haveindependent statistics for the bridge defragmentation/refragmentation.The maximum fragment length is stored in the control buffer and it isused to refragment the skbuff from the postrouting path.The new fraglist splitter and fragment transformer APIs are used toimplement the bridge refragmentation code. The br_ip_fragment() functiondrops the packet in case the maximum fragment size seen is larger thanthe output port MTU.This patchset follows the principle that conntrack should not droppackets, so users can do it through policy via invalid state matching.Like br_netfilter, there is no refragmentation for packets that arepassed up for local delivery, ie. prerouting -> input path. There arecalls to nf_reset() already in several spots in the stack since time agoalready, eg. af_packet, that show that skbuff fraglist handling from thenetif_rx path is supported already.The helpers are called from the postrouting hook, before confirmation,from there we may see packet floods to bridge ports. Then, althoughunlikely, this may result in exercising the helpers many times for eachclone. It would be good to explore how to pass all the packets in a listto the conntrack hook to do this handle only once for this case.Thanks to Florian Westphal for handing me over an initial patchsetversion to add support for conntrack bridge.Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/bridge/netfilter/Kconfig

bd2bbdb4 - netfilter: merge meta_bridge into nft_meta

Mon, 16 Apr 2018 17:15:53 +0000

netfilter: merge meta_bridge into nft_metaIt overcomplicates things for no reason.nft_meta_bridge only offers retrieval of bridge port interface name.Because of this being its own module, we had to export all nft_metafunctions, which we can then make static again (which even reducesthe size of nft_meta -- including bridge port retrieval...):before: text data bss dec hex filename 1838 832 0 2670 a6e net/bridge/netfilter/nft_meta_bridge.ko 6147 936 1 7084 1bac net/netfilter/nft_meta.koafter: 5826 936 1 6763 1a6b net/netfilter/nft_meta.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

02c7b25e - netfilter: nf_tables: build-in filter chain type

Tue, 27 Mar 2018 09:53:07 +0000

netfilter: nf_tables: build-in filter chain typeOne module per supported filter chain family type takes too much memoryfor very little code - too much modularization - place all chain filterdefinitions in one single file.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

2a95183a - netfilter: don't allocate space for arp/bridge hooks unless needed

Thu, 07 Dec 2017 15:28:26 +0000

netfilter: don't allocate space for arp/bridge hooks unless neededno need to define hook points if the family isn't supported.Because we need these hooks for either nftables, arp/ebtablesor the 'call-iptables' hack we have in the bridge layer add twonew dependencies, NETFILTER_FAMILY_{ARP,BRIDGE}, and have theusers select them.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

1fddf4ba - netfilter: nf_log: add packet logging for netdev family

Thu, 27 Oct 2016 18:49:42 +0000

netfilter: nf_log: add packet logging for netdev familyMove layer 2 packet logging into nf_log_l2packet() that resides innf_log_common.c, so this can be shared by both bridge and netdevfamilies.This patch adds the boiler plate code to register the netdev loggingfamily.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

85f5b308 - netfilter: bridge: add reject support

Fri, 27 Jun 2014 11:36:11 +0000

netfilter: bridge: add reject supportSo you can reject IPv4 and IPv6 packets from bridge tables. If the etherproto is now known, default on dropping the packet instead.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

960649d1 - netfilter: bridge: add generic packet logger

Sun, 22 Jun 2014 22:28:18 +0000

netfilter: bridge: add generic packet loggerThis adds the generic plain text packet loggger for bridged packets.It routes the logging message to the real protocol packet logger.I decided not to refactor the ebt_log code for two reasons:1) The ebt_log output is not consistent with the IPv4 and IPv6 Netfilter packet loggers. The output is different for no good reason and it adds redundant code to handle packet logging.2) To avoid breaking backward compatibility for applications outthere that are parsing the specific ebt_log output, the ebt_log output has been left as is. So only nftables will use the new consistent logging format for logged bridged packets.More decisions coming in this patch:1) This also removes ebt_log as default logger for bridged packets. Thus, nf_log_packet() routes packet to this new packet logger instead. This doesn't break backward compatibility since nf_log_packet() is not used to log packets in plain text format from anywhere in the ebtables/netfilter bridge code.2) The new bridge packet logger also performs a lazy request to register the real IPv4, ARP and IPv6 netfilter packet loggers. If the real protocol logger is no available (not compiled or the module is not available in the system, not packet logging happens.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

7200135b - netfilter: kill ulog targets

Mon, 16 Jun 2014 11:01:52 +0000

netfilter: kill ulog targetsThis has been marked as deprecated for quite some time and the NFLOGtarget replacement has been also available since 2006.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig

1708803e - netfilter: bridge: fix Kconfig unmet dependencies

Sun, 25 May 2014 12:48:33 +0000

netfilter: bridge: fix Kconfig unmet dependenciesBefore f5efc69 ("netfilter: nf_tables: Add meta expression key forbridge interface name"), the entire net/bridge/netfilter/ directorydepended on BRIDGE_NF_EBTABLES, ie. on ebtables. However, thatdirectory already contained the nf_tables bridge extension thatwe should allow to compile separately. In f5efc69, we tried togeneralize this by using CONFIG_BRIDGE_NETFILTER which was not a goodidea since this option already existed and it is dedicated to enablethe Netfilter bridge IP/ARP filtering.Let's try to fix this mess by:1) making net/bridge/netfilter/ dependent on the toplevel CONFIG_NETFILTER option, just like we do with the net/netfilter and net/ipv{4,6}/netfilter/ directories.2) Changing 'selects' to 'depends on' NETFILTER_XTABLES for BRIDGE_NF_EBTABLES. I believe this problem was already before f5efc69:warning: (BRIDGE_NF_EBTABLES) selects NETFILTER_XTABLES which hasunmet direct dependencies (NET && INET && NETFILTER)3) Fix ebtables/nf_tables bridge dependencies by making NF_TABLES_BRIDGE and BRIDGE_NF_EBTABLES dependent on BRIDGE and NETFILTER:warning: (NF_TABLES_BRIDGE && BRIDGE_NF_EBTABLES) selectsBRIDGE_NETFILTER which has unmet direct dependencies (NET && BRIDGE &&NETFILTER && INET && NETFILTER_ADVANCED)net/built-in.o: In function `br_parse_ip_options':br_netfilter.c:(.text+0x4a5ba): undefined reference to `ip_options_compile'br_netfilter.c:(.text+0x4a5ed): undefined reference to `ip_options_rcv_srr'net/built-in.o: In function `br_nf_pre_routing_finish':br_netfilter.c:(.text+0x4a8a4): undefined reference to `ip_route_input_noref'br_netfilter.c:(.text+0x4a987): undefined reference to `ip_route_output_flow'make: *** [vmlinux] Error 1Reported-by: Jim Davis Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Kconfig

f5efc696 - netfilter: nf_tables: Add meta expression key for bridge interface name

Mon, 14 Apr 2014 12:41:28 +0000

netfilter: nf_tables: Add meta expression key for bridge interface nameNFT_META_BRI_IIFNAME to get packet input bridge interface nameNFT_META_BRI_OIFNAME to get packet output bridge interface nameSuch meta key are accessible only through NFPROTO_BRIDGE family, on adedicated nft meta module: nft_meta_bridge.Suggested-by: Pablo Neira Ayuso Signed-off-by: Tomasz Bursztyka Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Kconfig