Changes in Kconfig

6c959fd5 - netfilter: Make legacy configs user selectable

Mon, 30 Sep 2024 09:58:54 +0000

netfilter: Make legacy configs user selectableThis option makes legacy Netfilter Kconfig user selectable, giving usersthe option to configure iptables without enabling any other config.Make the following KConfig entries user selectable: * BRIDGE_NF_EBTABLES_LEGACY * IP_NF_ARPTABLES * IP_NF_IPTABLES_LEGACY * IP6_NF_IPTABLES_LEGACYSigned-off-by: Breno Leitao Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

15fba562 - netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c

Tue, 26 Mar 2024 04:15:52 +0000

netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.csyzkaller started to report a warning below [0] after consuming thecommit 4654467dc7e1 ("netfilter: arptables: allow xtables-nft onlybuilds").The change accidentally removed the dependency on NETFILTER_FAMILY_ARPfrom IP_NF_ARPTABLES.If NF_TABLES_ARP is not enabled on Kconfig, NETFILTER_FAMILY_ARP willbe removed and some code necessary for arptables will not be compiled. $ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config CONFIG_NETFILTER_FAMILY_ARP=y # CONFIG_NF_TABLES_ARP is not set CONFIG_IP_NF_ARPTABLES=y $ make olddefconfig $ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config # CONFIG_NF_TABLES_ARP is not set CONFIG_IP_NF_ARPTABLES=ySo, when nf_register_net_hooks() is called for arptables, it willtrigger the splat below.Now IP_NF_ARPTABLES is only enabled by IP_NF_ARPFILTER, so let'srestore the dependency on NETFILTER_FAMILY_ARP in IP_NF_ARPFILTER.[0]:WARNING: CPU: 0 PID: 242 at net/netfilter/core.c:316 nf_hook_entry_head+0x1e1/0x2c0 net/netfilter/core.c:316Modules linked in:CPU: 0 PID: 242 Comm: syz-executor.0 Not tainted 6.8.0-12821-g537c2e91d354 #10Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014RIP: 0010:nf_hook_entry_head+0x1e1/0x2c0 net/netfilter/core.c:316Code: 83 fd 04 0f 87 bc 00 00 00 e8 5b 84 83 fd 4d 8d ac ec a8 0b 00 00 e8 4e 84 83 fd 4c 89 e8 5b 5d 41 5c 41 5d c3 e8 3f 84 83 fd <0f> 0b e8 38 84 83 fd 45 31 ed 5b 5d 4c 89 e8 41 5c 41 5d c3 e8 26RSP: 0018:ffffc90000b8f6e8 EFLAGS: 00010293RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff83c42164RDX: ffff888106851180 RSI: ffffffff83c42321 RDI: 0000000000000005RBP: 0000000000000000 R08: 0000000000000005 R09: 000000000000000aR10: 0000000000000003 R11: ffff8881055c2f00 R12: ffff888112b78000R13: 0000000000000000 R14: ffff8881055c2f00 R15: ffff8881055c2f00FS: 00007f377bd78800(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000000000496068 CR3: 000000011298b003 CR4: 0000000000770ef0PKRU: 55555554Call Trace: __nf_register_net_hook+0xcd/0x7a0 net/netfilter/core.c:428 nf_register_net_hook+0x116/0x170 net/netfilter/core.c:578 nf_register_net_hooks+0x5d/0xc0 net/netfilter/core.c:594 arpt_register_table+0x250/0x420 net/ipv4/netfilter/arp_tables.c:1553 arptable_filter_table_init+0x41/0x60 net/ipv4/netfilter/arptable_filter.c:39 xt_find_table_lock+0x2e9/0x4b0 net/netfilter/x_tables.c:1260 xt_request_find_table_lock+0x2b/0xe0 net/netfilter/x_tables.c:1285 get_info+0x169/0x5c0 net/ipv4/netfilter/arp_tables.c:808 do_arpt_get_ctl+0x3f9/0x830 net/ipv4/netfilter/arp_tables.c:1444 nf_getsockopt+0x76/0xd0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x17d/0x1c0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0x99/0x100 net/ipv4/tcp.c:4373 do_sock_getsockopt+0x279/0x360 net/socket.c:2373 __sys_getsockopt+0x115/0x1e0 net/socket.c:2402 __do_sys_getsockopt net/socket.c:2412 [inline] __se_sys_getsockopt net/socket.c:2409 [inline] __x64_sys_getsockopt+0xbd/0x150 net/socket.c:2409 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4eRIP: 0033:0x7f377beca6feCode: 1f 44 00 00 48 8b 15 01 97 0a 00 f7 d8 64 89 02 b8 ff ff ff ff eb b8 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 c9RSP: 002b:00000000005df728 EFLAGS: 00000246 ORIG_RAX: 0000000000000037RAX: ffffffffffffffda RBX: 00000000004966e0 RCX: 00007f377beca6feRDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000003RBP: 000000000042938a R08: 00000000005df73c R09: 00000000005df800R10: 00000000004966e8 R11: 0000000000000246 R12: 0000000000000003R13: 0000000000496068 R14: 0000000000000003 R15: 00000000004bc9d8 Fixes: 4654467dc7e1 ("netfilter: arptables: allow xtables-nft only builds")Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

749d4ef0 - netfilter: xtables: fix up kconfig dependencies

Tue, 06 Feb 2024 13:55:53 +0000

netfilter: xtables: fix up kconfig dependenciesRandy Dunlap reports arptables build failure:arp_tables.c:(.text+0x20): undefined reference to `xt_find_table'... because recent change removed a 'select' on the xtables core.Add a "depends" clause on arptables to resolve this.Kernel test robot reports another build breakage:iptable_nat.c:(.text+0x8): undefined reference to `ipt_unregister_table_exit'... because of a typo, the nat table selected ip6tables.Reported-by: kernel test robot Reported-by: Randy Dunlap Closes: https://lore.kernel.org/netfilter-devel/d0dfbaef-046a-4c42-9daa-53636664bf6d@infradead.org/Fixes: a9525c7f6219 ("netfilter: xtables: allow xtables-nft only builds")Fixes: 4654467dc7e1 ("netfilter: arptables: allow xtables-nft only builds")Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-testedSigned-off-by: Florian Westphal List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

a9525c7f - netfilter: xtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:11 +0000

netfilter: xtables: allow xtables-nft only buildsAdd hidden IP(6)_NF_IPTABLES_LEGACY symbol.When any of the "old" builtin tables are enabled the "old" iptablesinterface will be supported.To disable the old set/getsockopt interface the existing optionsfor the builtin tables need to be turned off:CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not setSame for CONFIG_IP6_NF_ variants.This allows to build a kernel that only supports ip(6)tables-nft(iptables-over-nftables api).In the future the _LEGACY symbol will become visible and the selectstatements will be turned into 'depends on', but for now be on safe sideso "make oldconfig" won't break things.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

4654467d - netfilter: arptables: allow xtables-nft only builds

Tue, 23 Jan 2024 15:42:48 +0000

netfilter: arptables: allow xtables-nft only buildsAllows to build kernel that supports the arptables mangle targetvia nftables' compat infra but without the arptables get/setsockoptinterface or the old arptables filter interpreter.IOW, setting IP_NF_ARPFILTER=n will break arptables-legacy, butarptables-nft will continue to work as long as nftables compatsupport is enabled.Signed-off-by: Florian Westphal Reviewed-by: Phil Sutter List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

9db5d918 - netfilter: ip_tables: remove clusterip target

Thu, 05 Jan 2023 19:22:02 +0000

netfilter: ip_tables: remove clusterip targetMarked as 'to be removed soon' since kernel 4.1 (2015).Functionality was superseded by the 'cluster' match, added in kernel2.6.30 (2009).clusterip_tg_check still has races that can give proc_dir_entry 'ipt_CLUSTERIP/10.1.1.2' already registeredfollowed by a WARN splat.Remove it instead of trying to fix this up again.clusterip uapi header is left as-is for now.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

7355bfe0 - netfilter: Remove flowtable relics

Sun, 23 Jan 2022 12:57:17 +0000

netfilter: Remove flowtable relicsNF_FLOW_TABLE_IPV4 and NF_FLOW_TABLE_IPV6 are invisble, selected bynothing (so they can no longer be enabled), and their last real usershave been removed (nf_flow_table_ipv6.c is empty).Clean up the leftovers.Fixes: c42ba4290b2147aa ("netfilter: flowtable: remove ipv4/ipv6 modules")Signed-off-by: Geert Uytterhoeven Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

c42ba429 - netfilter: flowtable: remove ipv4/ipv6 modules

Fri, 17 Dec 2021 14:10:55 +0000

netfilter: flowtable: remove ipv4/ipv6 modulesJust place the structs and registration in the inet module.nf_flow_table_ipv6, nf_flow_table_ipv4 and nf_flow_table_inet sharesame module dependencies: nf_flow_table, nf_tables.before: text data bss dec hex filename 2278 1480 0 3758 eae nf_flow_table_inet.ko 1159 1352 0 2511 9cf nf_flow_table_ipv6.ko 1154 1352 0 2506 9ca nf_flow_table_ipv4.koafter: 2369 1672 0 4041 fc9 nf_flow_table_inet.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

f11d61e7 - netfilter: nf_log_arp: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:06 +0000

netfilter: nf_log_arp: merge with nf_log_syslogsimilar to previous change: nf_log_syslog now covers ARP loggingas well, the old nf_log_arp module is removed.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

db3187ae - netfilter: nf_log_ipv4: rename to nf_log_syslog

Thu, 25 Mar 2021 17:25:05 +0000

netfilter: nf_log_ipv4: rename to nf_log_syslogNetfilter has multiple log modules: nf_log_arp nf_log_bridge nf_log_ipv4 nf_log_ipv6 nf_log_netdev nfnetlink_log nf_log_commonWith the exception of nfnetlink_log (packet is sent to userspace fordissection/logging), all of them log to the kernel ringbuffer.This is the first part of a series to merge all modules exceptnfnetlink_log into a single module: nf_log_syslog.This allows to reduce code. After the series, only two log modules remain:nfnetlink_log and nf_log_syslog. The latter provides the samefunctionality as the old per-af log modules.This renames nf_log_ipv4 to nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

a7f7f624 - treewide: replace '---help---' in Kconfig files with 'help'

Sat, 13 Jun 2020 16:50:22 +0000

treewide: replace '---help---' in Kconfig files with 'help'Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over'---help---'"), the number of '---help---' has been graduallydecreasing, but there are still more than 2400 instances.This commit finishes the conversion. While I touched the lines,I also fixed the indentation.There are a variety of indentation styles found. a) 4 spaces + '---help---' b) 7 spaces + '---help---' c) 8 spaces + '---help---' d) 1 space + 1 tab + '---help---' e) 1 tab + '---help---' (correct indentation) f) 1 tab + 1 space + '---help---' g) 1 tab + 2 spaces + '---help---'In order to convert all of them to 1 tab + 'help', I ran thefollowing commend: $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'Signed-off-by: Masahiro Yamada List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

b0edba2a - netfilter: fix coding-style errors.

Fri, 13 Sep 2019 08:13:02 +0000

netfilter: fix coding-style errors.Several header-files, Kconfig files and Makefiles have trailingwhite-space. Remove it.In netfilter/Kconfig, indent the type of CONFIG_NETFILTER_NETLINK_ACCTcorrectly.There are semicolons at the end of two function definitions ininclude/net/netfilter/nf_conntrack_acct.h andinclude/net/netfilter/nf_conntrack_ecache.h. Remove them.Fix indentation in nf_conntrack_l4proto.h.Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

cd238eff - docs: kbuild: convert docs to ReST and rename to *.rst

Wed, 12 Jun 2019 17:52:48 +0000

docs: kbuild: convert docs to ReST and rename to *.rstThe kbuild documentation clearly shows that the documentsthere are written at different times: some use markdown,some use their own peculiar logic to split sections.Convert everything to ReST without affecting too muchthe author's style and avoiding adding uneeded markups.The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups.At its new index.rst, let's add a :orphan: while this is not linked tothe main index.rst file, in order to avoid build warnings.Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

adf82acc - netfilter: x_tables: merge ip and ipv6 masquerade modules

Tue, 09 Apr 2019 08:44:07 +0000

netfilter: x_tables: merge ip and ipv6 masquerade modulesNo need to have separate modules for this.before: text data bss dec filename 2038 1168 0 3206 net/ipv4/netfilter/ipt_MASQUERADE.ko 1526 1024 0 2550 net/ipv6/netfilter/ip6t_MASQUERADE.koafter: text data bss dec filename 2521 1296 0 3817 net/netfilter/xt_MASQUERADE.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

c1deb065 - netfilter: nf_tables: merge route type into core

Wed, 27 Mar 2019 08:22:25 +0000

netfilter: nf_tables: merge route type into corevery little code, so it really doesn't make sense to have extramodules or even a kconfig knob for this.Merge them and make functionality available unconditionally.The merge makes inet family route support trivial, so add itas well here.Before: text data bss dec hex filename 835 832 0 1667 683 nft_chain_route_ipv4.ko 870 832 0 1702 6a6 nft_chain_route_ipv6.ko 111568 2556 529 114653 1bfdd nf_tables.koAfter: text data bss dec hex filename 113133 2556 529 116218 1c5fa nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

db8ab388 - netfilter: nf_tables: merge ipv4 and ipv6 nat chain types

Thu, 28 Feb 2019 11:02:52 +0000

netfilter: nf_tables: merge ipv4 and ipv6 nat chain typesMerge the ipv4 and ipv6 nat chain type. This is the lastmissing piece which allows to provide inet family supportfor nat in a follow patch.The kconfig knobs for ipv4/ipv6 nat chain are removed, thenat chain type will be built unconditionally if NFT_NATexpression is enabled.Before: text data bss dec hex filename 1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko 1697 896 0 2593 a21 nft_chain_nat_ipv6.koAfter: text data bss dec hex filename 1832 896 0 2728 aa8 nft_chain_nat.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

a9ce849e - netfilter: nf_tables: nat: merge nft_masq protocol specific modules

Thu, 28 Feb 2019 11:02:51 +0000

netfilter: nf_tables: nat: merge nft_masq protocol specific modulesThe family specific masq modules are way too small to warrantan extra module, just place all of them in nft_masq.before: text data bss dec hex filename 1001 832 0 1833 729 nft_masq.ko 766 896 0 1662 67e nft_masq_ipv4.ko 764 896 0 1660 67c nft_masq_ipv6.koafter: 2010 960 0 2970 b9a nft_masq.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

c78efc99 - netfilter: nf_tables: nat: merge nft_redir protocol specific modules

Thu, 28 Feb 2019 11:02:50 +0000

netfilter: nf_tables: nat: merge nft_redir protocol specific modulesbefore: text data bss dec hex filename 990 832 0 1822 71e nft_redir.ko 697 896 0 1593 639 nft_redir_ipv4.ko 713 896 0 1609 649 nft_redir_ipv6.koafter: text data bss dec hex filename 1910 960 0 2870 b36 nft_redir.kosize is reduced, all helpers from nft_redir.ko can be made static.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig

3bf195ae - netfilter: nat: merge nf_nat_ipv4,6 into nat core

Tue, 19 Feb 2019 16:38:21 +0000

netfilter: nat: merge nf_nat_ipv4,6 into nat corebefore: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3598 844 0 4442 115a nf_nat_ipv6.ko 3187 844 0 4031 fbf nf_nat_ipv4.koafter: text data bss dec hex filename 22948 1612 4136 28696 7018 nf_nat.ko... with ipv4/v6 nat now provided directly via nf_nat.ko.Also changes: ret = nf_nat_ipv4_fn(priv, skb, state); if (ret != NF_DROP && ret != NF_STOLEN &&into if (ret != NF_ACCEPT) return ret;everywhere.The nat hooks never should return anything other thanACCEPT or DROP (and the latter only in rare error cases).The original code uses multi-line ANDing including assignment-in-if: if (ret != NF_DROP && ret != NF_STOLEN && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && (ct = nf_ct_get(skb, &ctinfo)) != NULL) {I removed this while moving, breaking those in separate conditionalsand moving the assignments into extra lines.checkpatch still generates some warnings: 1. Overly long lines (of moved code). Breaking them is even more ugly. so I kept this as-is. 2. use of extern function declarations in a .c file. This is necessary evil, we must call nf_nat_l3proto_register() from the nat core now. All l3proto related functions are removed later in this series, those prototypes are then removed as well.v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles are removed here.v4: also get rid of the assignments in conditionals.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Kconfig