Changes in Makefile

7ad26978 - netfilter: ebtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:12 +0000

netfilter: ebtables: allow xtables-nft only buildsSame patch as previous one, but for ebtables.To build a kernel that only supports ebtables-nft, the builtin tablesneed to be disabled, i.e.:CONFIG_BRIDGE_EBT_BROUTE=nCONFIG_BRIDGE_EBT_T_FILTER=nCONFIG_BRIDGE_EBT_T_NAT=nThe ebtables specific extensions can then be used nftables'NFT_COMPAT interface.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/bridge/netfilter/Makefile

77ccee96 - netfilter: nf_log_bridge: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:09 +0000

netfilter: nf_log_bridge: merge with nf_log_syslogProvide bridge log support from nf_log_syslog.After the merge there is no need to load the "real packet loggers",all of them now reside in the same module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

30e103fe - netfilter: nft_meta: move bridge meta keys into nft_meta_bridge

Fri, 05 Jul 2019 13:16:32 +0000

netfilter: nft_meta: move bridge meta keys into nft_meta_bridgeSeparate bridge meta key from nft_meta to meta_bridge to avoid adependency between the bridge module and nft_meta when using the bridgeAPI available through include/linux/if_bridge.hSigned-off-by: wenxu Reviewed-by: Nikolay Aleksandrov Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

3c171f49 - netfilter: bridge: add connection tracking system

Wed, 29 May 2019 11:25:37 +0000

netfilter: bridge: add connection tracking systemThis patch adds basic connection tracking support for the bridge,including initial IPv4 support.This patch register two hooks to deal with the bridge forwarding path,one from the bridge prerouting hook to call nf_conntrack_in(); andanother from the bridge postrouting hook to confirm the entry.The conntrack bridge prerouting hook defragments packets before passingthem to nf_conntrack_in() to look up for an existing entry, otherwise anew entry is allocated and it is attached to the skbuff. The conntrackbridge postrouting hook confirms new conntrack entries, ie. if this isthe first packet seen, then it adds the entry to the hashtable and (ifneeded) it refragments the skbuff into the original fragments, leavingthe geometry as is if possible. Exceptions are linearized skbuffs, eg.skbuffs that are passed up to nfqueue and conntrack helpers, as well ascloned skbuff for the local delivery (eg. tcpdump), also in case ofbridge port flooding (cloned skbuff too).The packet defragmentation is done through the ip_defrag() call. Thisforces us to save the bridge control buffer, reset the IP control bufferarea and then restore it after call. This function also bumps the IPfragmentation statistics, it would be probably desiderable to haveindependent statistics for the bridge defragmentation/refragmentation.The maximum fragment length is stored in the control buffer and it isused to refragment the skbuff from the postrouting path.The new fraglist splitter and fragment transformer APIs are used toimplement the bridge refragmentation code. The br_ip_fragment() functiondrops the packet in case the maximum fragment size seen is larger thanthe output port MTU.This patchset follows the principle that conntrack should not droppackets, so users can do it through policy via invalid state matching.Like br_netfilter, there is no refragmentation for packets that arepassed up for local delivery, ie. prerouting -> input path. There arecalls to nf_reset() already in several spots in the stack since time agoalready, eg. af_packet, that show that skbuff fraglist handling from thenetif_rx path is supported already.The helpers are called from the postrouting hook, before confirmation,from there we may see packet floods to bridge ports. Then, althoughunlikely, this may result in exercising the helpers many times for eachclone. It would be good to explore how to pass all the packets in a listto the conntrack hook to do this handle only once for this case.Thanks to Florian Westphal for handing me over an initial patchsetversion to add support for conntrack bridge.Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Makefile

bd2bbdb4 - netfilter: merge meta_bridge into nft_meta

Mon, 16 Apr 2018 17:15:53 +0000

netfilter: merge meta_bridge into nft_metaIt overcomplicates things for no reason.nft_meta_bridge only offers retrieval of bridge port interface name.Because of this being its own module, we had to export all nft_metafunctions, which we can then make static again (which even reducesthe size of nft_meta -- including bridge port retrieval...):before: text data bss dec hex filename 1838 832 0 2670 a6e net/bridge/netfilter/nft_meta_bridge.ko 6147 936 1 7084 1bac net/netfilter/nft_meta.koafter: 5826 936 1 6763 1a6b net/netfilter/nft_meta.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

02c7b25e - netfilter: nf_tables: build-in filter chain type

Tue, 27 Mar 2018 09:53:07 +0000

netfilter: nf_tables: build-in filter chain typeOne module per supported filter chain family type takes too much memoryfor very little code - too much modularization - place all chain filterdefinitions in one single file.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

b2441318 - License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Wed, 01 Nov 2017 14:07:57 +0000

License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseMany source files in the tree are missing licensing information, whichmakes it harder for compliance tools to determine the correct license.By default all files without license information are under the defaultlicense of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'SPDX license identifier. The SPDX identifier is a legally bindingshorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart andPhilippe Ombredanne.How this work was done:Patches were generated and checked against linux-4.14-rc6 for a subset ofthe use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up caseswhere non-standard license headers were used, and references to licensehad to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied toa file was done in a spreadsheet of side by side results from of theoutput of two independent scanners (ScanCode & Windriver) producing SPDXtag:value files created by Philippe Ombredanne. Philippe prepared thebase worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 filesassessed. Kate Stewart did a file by file comparison of the scannerresults in the spreadsheet to determine which SPDX license identifier(s)to be applied to the file. She confirmed any determination that was notimmediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines).All documentation files were explicitly excluded.The following heuristics were used to determine which SPDX licenseidentifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time.In total, over 70 hours of logged manual review was done on thespreadsheet to determine the SPDX license identifiers to apply to thesource files by Kate, Philippe, Thomas and, in some cases, confirmationby lawyers working with the Linux Foundation.Kate also obtained a third independent scan of the 4.13 code base fromFOSSology, and compared selected files where the other two scannersdisagreed against that SPDX file, to see if there was new insights. TheWindriver scanner is based on an older version of FOSSology in part, sothey are related.Thomas did random spot checks in about 500 files from the spreadsheetsfor the uapi headers and agreed with SPDX license identifier in thefiles he inspected. For the non-uapi files Thomas did random spot checksin about 15000 files.In initial set of patches against 4.14-rc6, 3 files were found to havecopy/paste license identifier errors, and have been fixed to reflect thecorrect identifier.Additionally Philippe spent 10 hours this week doing a detailed manualinspection and review of the 12,461 patched files from the initial patchversion early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correctThis produced a worksheet with 20 files needing minor correction. Thisworksheet was then exported into 3 different .csv files for thedifferent types of files to be modified.These .csv files were then reviewed by Greg. Thomas wrote a script toparse the csv files and add the proper SPDX tag to the file, in theformat that the file expected. This script was further refined by Gregbased on the output to detect more types of files automatically and todistinguish between header and source .c files (which need differentcomment types.) Finally Greg ran the script using the .csv files togenerate the patches.Reviewed-by: Kate Stewart Reviewed-by: Philippe Ombredanne Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/bridge/netfilter/Makefile

d4da843e - netfilter: kill remnants of ulog targets

Fri, 25 Jul 2014 12:25:31 +0000

netfilter: kill remnants of ulog targetsThe ulog targets were recently killed. A few references to the Kconfigmacros CONFIG_IP_NF_TARGET_ULOG and CONFIG_BRIDGE_EBT_ULOG were leftuntouched. Kill these too.Signed-off-by: Paul Bolle Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

85f5b308 - netfilter: bridge: add reject support

Fri, 27 Jun 2014 11:36:11 +0000

netfilter: bridge: add reject supportSo you can reject IPv4 and IPv6 packets from bridge tables. If the etherproto is now known, default on dropping the packet instead.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

960649d1 - netfilter: bridge: add generic packet logger

Sun, 22 Jun 2014 22:28:18 +0000

netfilter: bridge: add generic packet loggerThis adds the generic plain text packet loggger for bridged packets.It routes the logging message to the real protocol packet logger.I decided not to refactor the ebt_log code for two reasons:1) The ebt_log output is not consistent with the IPv4 and IPv6 Netfilter packet loggers. The output is different for no good reason and it adds redundant code to handle packet logging.2) To avoid breaking backward compatibility for applications outthere that are parsing the specific ebt_log output, the ebt_log output has been left as is. So only nftables will use the new consistent logging format for logged bridged packets.More decisions coming in this patch:1) This also removes ebt_log as default logger for bridged packets. Thus, nf_log_packet() routes packet to this new packet logger instead. This doesn't break backward compatibility since nf_log_packet() is not used to log packets in plain text format from anywhere in the ebtables/netfilter bridge code.2) The new bridge packet logger also performs a lazy request to register the real IPv4, ARP and IPv6 netfilter packet loggers. If the real protocol logger is no available (not compiled or the module is not available in the system, not packet logging happens.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

f5efc696 - netfilter: nf_tables: Add meta expression key for bridge interface name

Mon, 14 Apr 2014 12:41:28 +0000

netfilter: nf_tables: Add meta expression key for bridge interface nameNFT_META_BRI_IIFNAME to get packet input bridge interface nameNFT_META_BRI_OIFNAME to get packet output bridge interface nameSuch meta key are accessible only through NFPROTO_BRIDGE family, on adedicated nft meta module: nft_meta_bridge.Suggested-by: Pablo Neira Ayuso Signed-off-by: Tomasz Bursztyka Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

96518518 - netfilter: add nftables

Mon, 14 Oct 2013 09:00:02 +0000

netfilter: add nftablesThis patch adds nftables which is the intended successor of iptables.This packet filtering framework reuses the existing netfilter hooks,the connection tracking system, the NAT subsystem, the transparentproxying engine, the logging infrastructure and the userspace packetqueueing facilities.In a nutshell, nftables provides a pseudo-state machine with 4 generalpurpose registers of 128 bits and 1 specific purpose register to storeverdicts. This pseudo-machine comes with an extensible instruction set,a.k.a. "expressions" in the nftables jargon. The expressions includedin this patch provide the basic functionality, they are:* bitwise: to perform bitwise operations.* byteorder: to change from host/network endianess.* cmp: to compare data with the content of the registers.* counter: to enable counters on rules.* ct: to store conntrack keys into register.* exthdr: to match IPv6 extension headers.* immediate: to load data into registers.* limit: to limit matching based on packet rate.* log: to log packets.* meta: to match metainformation that usually comes with the skbuff.* nat: to perform Network Address Translation.* payload: to fetch data from the packet payload and store it into registers.* reject (IPv4 only): to explicitly close connection, eg. TCP RST.Using this instruction-set, the userspace utility 'nft' can transformthe rules expressed in human-readable text representation (using anew syntax, inspired by tcpdump) to nftables bytecode.nftables also inherits the table, chain and rule objects fromiptables, but in a more configurable way, and it also includes theoriginal datatype-agnostic set infrastructure with mapping support.This set infrastructure is enhanced in the follow up patch (netfilter:nf_tables: add netlink set API).This patch includes the following components:* the netlink API: net/netfilter/nf_tables_api.c and include/uapi/netfilter/nf_tables.h* the packet filter core: net/netfilter/nf_tables_core.c* the expressions (described above): net/netfilter/nft_*.c* the filter tables: arp, IPv4, IPv6 and bridge: net/ipv4/netfilter/nf_tables_ipv4.c net/ipv6/netfilter/nf_tables_ipv6.c net/ipv4/netfilter/nf_tables_arp.c net/bridge/netfilter/nf_tables_bridge.c* the NAT table (IPv4 only): net/ipv4/netfilter/nf_table_nat_ipv4.c* the route table (similar to mangle): net/ipv4/netfilter/nf_table_route_ipv4.c net/ipv6/netfilter/nf_table_route_ipv6.c* internal definitions under: include/net/netfilter/nf_tables.h include/net/netfilter/nf_tables_core.h* It also includes an skeleton expression: net/netfilter/nft_expr_template.c and the preliminary implementation of the meta target net/netfilter/nft_meta_target.cIt also includes a change in struct nf_hook_ops to add a newpointer to store private data to the hook, that is used to storethe rule list per chain.This patch is based on the patch from Patrick McHardy, plus mergedaccumulated cleanups, fixes and small enhancements to the nftablescode that has been done since 2009, which are:From Patrick McHardy:* nf_tables: adjust netlink handler function signatures* nf_tables: only retry table lookup after successful table module load* nf_tables: fix event notification echo and avoid unnecessary messages* nft_ct: add l3proto support* nf_tables: pass expression context to nft_validate_data_load()* nf_tables: remove redundant definition* nft_ct: fix maxattr initialization* nf_tables: fix invalid event type in nf_tables_getrule()* nf_tables: simplify nft_data_init() usage* nf_tables: build in more core modules* nf_tables: fix double lookup expression unregistation* nf_tables: move expression initialization to nf_tables_core.c* nf_tables: build in payload module* nf_tables: use NFPROTO constants* nf_tables: rename pid variables to portid* nf_tables: save 48 bits per rule* nf_tables: introduce chain rename* nf_tables: check for duplicate names on chain rename* nf_tables: remove ability to specify handles for new rules* nf_tables: return error for rule change request* nf_tables: return error for NLM_F_REPLACE without rule handle* nf_tables: include NLM_F_APPEND/NLM_F_REPLACE flags in rule notification* nf_tables: fix NLM_F_MULTI usage in netlink notifications* nf_tables: include NLM_F_APPEND in rule dumpsFrom Pablo Neira Ayuso:* nf_tables: fix stack overflow in nf_tables_newrule* nf_tables: nft_ct: fix compilation warning* nf_tables: nft_ct: fix crash with invalid packets* nft_log: group and qthreshold are 2^16* nf_tables: nft_meta: fix socket uid,gid handling* nft_counter: allow to restore counters* nf_tables: fix module autoload* nf_tables: allow to remove all rules placed in one chain* nf_tables: use 64-bits rule handle instead of 16-bits* nf_tables: fix chain after rule deletion* nf_tables: improve deletion performance* nf_tables: add missing code in route chain type* nf_tables: rise maximum number of expressions from 12 to 128* nf_tables: don't delete table if in use* nf_tables: fix basechain releaseFrom Tomasz Bursztyka:* nf_tables: Add support for changing users chain's name* nf_tables: Change chain's name to be fixed sized* nf_tables: Add support for replacing a rule by another one* nf_tables: Update uapi nftables netlink header documentationFrom Florian Westphal:* nft_log: group is u16, snaplen u32From Phil Oester:* nf_tables: operational limit matchSigned-off-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/bridge/netfilter/Makefile

f586287e - bridge: fix IPV6=n build

Tue, 17 Jun 2008 23:16:13 +0000

bridge: fix IPV6=n buildFix bridge netfilter code so that it uses CONFIG_IPV6 as needed:net/built-in.o: In function `ebt_filter_ip6':ebt_ip6.c:(.text+0x87c37): undefined reference to `ipv6_skip_exthdr'net/built-in.o: In function `ebt_log_packet':ebt_log.c:(.text+0x88dee): undefined reference to `ipv6_skip_exthdr'make[1]: *** [.tmp_vmlinux1] Error 1Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Makefile

93f65158 - netfilter: ebtables: add IPv6 support

Mon, 09 Jun 2008 22:55:45 +0000

netfilter: ebtables: add IPv6 supportIt implements matching functions for IPv6 address & traffic class(merged from the patch sent by Jan Engelhardt [jengelh@computergmbh.de]http://marc.info/?l=netfilter-devel&m=120182168424052&w=2), protocol,and layer-4 port id. Corresponding watcher logging function is alsoadded for IPv6.Signed-off-by: Kuo-lang Tseng Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Makefile

e7bfd0a1 - [NETFILTER]: bridge: add ebt_nflog watcher

Mon, 14 Apr 2008 09:15:54 +0000

[NETFILTER]: bridge: add ebt_nflog watcherThis patch adds the ebtables nflog watcher to the kernel in order toallow ebtables log through the nfnetlink_log backend.Signed-off-by: Peter Warasin Signed-off-by: Patrick McHardy List of files: /linux-6.15/net/bridge/netfilter/Makefile

c1274376 - [NETFILTER]: Fix wrong option spelling in Makefile for CONFIG_BRIDGE_EBT_ULOG

Sun, 12 Mar 2006 02:51:25 +0000

[NETFILTER]: Fix wrong option spelling in Makefile for CONFIG_BRIDGE_EBT_ULOGSigned-off-by: Gregor Maier Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller List of files: /linux-6.15/net/bridge/netfilter/Makefile

1da177e4 - Linux-2.6.12-rc2

Sat, 16 Apr 2005 22:20:36 +0000

Linux-2.6.12-rc2Initial git repository build. I'm not bothering with the full history,even though we have it. We can create a separate "historical" gitarchive of that later if we want to, and in the meantime it's about3.2GB when imported into git - space that would just make the earlygit days unnecessarily complicated, when we don't have a lot of goodinfrastructure for it.Let it rip! List of files: /linux-6.15/net/bridge/netfilter/Makefile