Changes in Makefile

a9525c7f - netfilter: xtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:11 +0000

netfilter: xtables: allow xtables-nft only buildsAdd hidden IP(6)_NF_IPTABLES_LEGACY symbol.When any of the "old" builtin tables are enabled the "old" iptablesinterface will be supported.To disable the old set/getsockopt interface the existing optionsfor the builtin tables need to be turned off:CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not setSame for CONFIG_IP6_NF_ variants.This allows to build a kernel that only supports ip(6)tables-nft(iptables-over-nftables api).In the future the _LEGACY symbol will become visible and the selectstatements will be turned into 'depends on', but for now be on safe sideso "make oldconfig" won't break things.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv4/netfilter/Makefile

9db5d918 - netfilter: ip_tables: remove clusterip target

Thu, 05 Jan 2023 19:22:02 +0000

netfilter: ip_tables: remove clusterip targetMarked as 'to be removed soon' since kernel 4.1 (2015).Functionality was superseded by the 'cluster' match, added in kernel2.6.30 (2009).clusterip_tg_check still has races that can give proc_dir_entry 'ipt_CLUSTERIP/10.1.1.2' already registeredfollowed by a WARN splat.Remove it instead of trying to fix this up again.clusterip uapi header is left as-is for now.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv4/netfilter/Makefile

c42ba429 - netfilter: flowtable: remove ipv4/ipv6 modules

Fri, 17 Dec 2021 14:10:55 +0000

netfilter: flowtable: remove ipv4/ipv6 modulesJust place the structs and registration in the inet module.nf_flow_table_ipv6, nf_flow_table_ipv4 and nf_flow_table_inet sharesame module dependencies: nf_flow_table, nf_tables.before: text data bss dec hex filename 2278 1480 0 3758 eae nf_flow_table_inet.ko 1159 1352 0 2511 9cf nf_flow_table_ipv6.ko 1154 1352 0 2506 9ca nf_flow_table_ipv4.koafter: 2369 1672 0 4041 fc9 nf_flow_table_inet.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

f11d61e7 - netfilter: nf_log_arp: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:06 +0000

netfilter: nf_log_arp: merge with nf_log_syslogsimilar to previous change: nf_log_syslog now covers ARP loggingas well, the old nf_log_arp module is removed.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

db3187ae - netfilter: nf_log_ipv4: rename to nf_log_syslog

Thu, 25 Mar 2021 17:25:05 +0000

netfilter: nf_log_ipv4: rename to nf_log_syslogNetfilter has multiple log modules: nf_log_arp nf_log_bridge nf_log_ipv4 nf_log_ipv6 nf_log_netdev nfnetlink_log nf_log_commonWith the exception of nfnetlink_log (packet is sent to userspace fordissection/logging), all of them log to the kernel ringbuffer.This is the first part of a series to merge all modules exceptnfnetlink_log into a single module: nf_log_syslog.This allows to reduce code. After the series, only two log modules remain:nfnetlink_log and nf_log_syslog. The latter provides the samefunctionality as the old per-af log modules.This renames nf_log_ipv4 to nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

b0edba2a - netfilter: fix coding-style errors.

Fri, 13 Sep 2019 08:13:02 +0000

netfilter: fix coding-style errors.Several header-files, Kconfig files and Makefiles have trailingwhite-space. Remove it.In netfilter/Kconfig, indent the type of CONFIG_NETFILTER_NETLINK_ACCTcorrectly.There are semicolons at the end of two function definitions ininclude/net/netfilter/nf_conntrack_acct.h andinclude/net/netfilter/nf_conntrack_ecache.h. Remove them.Fix indentation in nf_conntrack_l4proto.h.Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

adf82acc - netfilter: x_tables: merge ip and ipv6 masquerade modules

Tue, 09 Apr 2019 08:44:07 +0000

netfilter: x_tables: merge ip and ipv6 masquerade modulesNo need to have separate modules for this.before: text data bss dec filename 2038 1168 0 3206 net/ipv4/netfilter/ipt_MASQUERADE.ko 1526 1024 0 2550 net/ipv6/netfilter/ip6t_MASQUERADE.koafter: text data bss dec filename 2521 1296 0 3817 net/netfilter/xt_MASQUERADE.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

c1deb065 - netfilter: nf_tables: merge route type into core

Wed, 27 Mar 2019 08:22:25 +0000

netfilter: nf_tables: merge route type into corevery little code, so it really doesn't make sense to have extramodules or even a kconfig knob for this.Merge them and make functionality available unconditionally.The merge makes inet family route support trivial, so add itas well here.Before: text data bss dec hex filename 835 832 0 1667 683 nft_chain_route_ipv4.ko 870 832 0 1702 6a6 nft_chain_route_ipv6.ko 111568 2556 529 114653 1bfdd nf_tables.koAfter: text data bss dec hex filename 113133 2556 529 116218 1c5fa nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

db8ab388 - netfilter: nf_tables: merge ipv4 and ipv6 nat chain types

Thu, 28 Feb 2019 11:02:52 +0000

netfilter: nf_tables: merge ipv4 and ipv6 nat chain typesMerge the ipv4 and ipv6 nat chain type. This is the lastmissing piece which allows to provide inet family supportfor nat in a follow patch.The kconfig knobs for ipv4/ipv6 nat chain are removed, thenat chain type will be built unconditionally if NFT_NATexpression is enabled.Before: text data bss dec hex filename 1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko 1697 896 0 2593 a21 nft_chain_nat_ipv6.koAfter: text data bss dec hex filename 1832 896 0 2728 aa8 nft_chain_nat.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

a9ce849e - netfilter: nf_tables: nat: merge nft_masq protocol specific modules

Thu, 28 Feb 2019 11:02:51 +0000

netfilter: nf_tables: nat: merge nft_masq protocol specific modulesThe family specific masq modules are way too small to warrantan extra module, just place all of them in nft_masq.before: text data bss dec hex filename 1001 832 0 1833 729 nft_masq.ko 766 896 0 1662 67e nft_masq_ipv4.ko 764 896 0 1660 67c nft_masq_ipv6.koafter: 2010 960 0 2970 b9a nft_masq.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

c78efc99 - netfilter: nf_tables: nat: merge nft_redir protocol specific modules

Thu, 28 Feb 2019 11:02:50 +0000

netfilter: nf_tables: nat: merge nft_redir protocol specific modulesbefore: text data bss dec hex filename 990 832 0 1822 71e nft_redir.ko 697 896 0 1593 639 nft_redir_ipv4.ko 713 896 0 1609 649 nft_redir_ipv6.koafter: text data bss dec hex filename 1910 960 0 2870 b36 nft_redir.kosize is reduced, all helpers from nft_redir.ko can be made static.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

3bf195ae - netfilter: nat: merge nf_nat_ipv4,6 into nat core

Tue, 19 Feb 2019 16:38:21 +0000

netfilter: nat: merge nf_nat_ipv4,6 into nat corebefore: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3598 844 0 4442 115a nf_nat_ipv6.ko 3187 844 0 4031 fbf nf_nat_ipv4.koafter: text data bss dec hex filename 22948 1612 4136 28696 7018 nf_nat.ko... with ipv4/v6 nat now provided directly via nf_nat.ko.Also changes: ret = nf_nat_ipv4_fn(priv, skb, state); if (ret != NF_DROP && ret != NF_STOLEN &&into if (ret != NF_ACCEPT) return ret;everywhere.The nat hooks never should return anything other thanACCEPT or DROP (and the latter only in rare error cases).The original code uses multi-line ANDing including assignment-in-if: if (ret != NF_DROP && ret != NF_STOLEN && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && (ct = nf_ct_get(skb, &ctinfo)) != NULL) {I removed this while moving, breaking those in separate conditionalsand moving the assignments into extra lines.checkpatch still generates some warnings: 1. Overly long lines (of moved code). Breaking them is even more ugly. so I kept this as-is. 2. use of extern function declarations in a .c file. This is necessary evil, we must call nf_nat_l3proto_register() from the nat core now. All l3proto related functions are removed later in this series, those prototypes are then removed as well.v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles are removed here.v4: also get rid of the assignments in conditionals.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

d1aca8ab - netfilter: nat: merge ipv4 and ipv6 masquerade functionality

Tue, 19 Feb 2019 16:38:19 +0000

netfilter: nat: merge ipv4 and ipv6 masquerade functionalityBefore: text data bss dec hex filename 13916 1412 4128 19456 4c00 nf_nat.ko 4510 968 4 5482 156a nf_nat_ipv4.ko 5146 944 8 6098 17d2 nf_nat_ipv6.koAfter: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3187 844 0 4031 fbf nf_nat_ipv4.ko 3598 844 0 4442 115a nf_nat_ipv6.ko... so no drastic changes in combined size.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

5cbabeec - netfilter: nat: remove nf_nat_l4proto struct

Thu, 13 Dec 2018 15:01:34 +0000

netfilter: nat: remove nf_nat_l4proto structThis removes the (now empty) nf_nat_l4proto struct, all its instancesand all the no longer needed runtime (un)register functionality.nf_nat_need_gre() can be axed as well: the module that calls it (toload the no-longer-existing nat_gre module) also calls other nat corefunctions. GRE nat is now always available if kernel is built with it.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

a0ae2562 - netfilter: conntrack: remove l3proto abstraction

Fri, 29 Jun 2018 05:46:51 +0000

netfilter: conntrack: remove l3proto abstractionThis unifies ipv4 and ipv6 protocol trackers and removes the l3protoabstraction.This gets rid of all l3proto indirect calls and the need to doa lookup on the function to call for l3 demux.It increases module size by only a small amount (12kbyte), so this reducessize because nf_conntrack.ko is useless without either nf_conntrack_ipv4or nf_conntrack_ipv6 module.before: text data bss dec hex filename 7357 1088 0 8445 20fd nf_conntrack_ipv4.ko 7405 1084 4 8493 212d nf_conntrack_ipv6.ko 72614 13689 236 86539 1520b nf_conntrack.ko 19K nf_conntrack_ipv4.ko 19K nf_conntrack_ipv6.ko179K nf_conntrack.koafter: text data bss dec hex filename 79277 13937 236 93450 16d0a nf_conntrack.ko 191K nf_conntrack.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

45ca4e0c - netfilter: Libify xt_TPROXY

Fri, 01 Jun 2018 18:44:56 +0000

netfilter: Libify xt_TPROXYThe extracted functions will likely be usefull to implement tproxysupport in nf_tables.Extrancted functions: - nf_tproxy_sk_is_transparent - nf_tproxy_laddr4 - nf_tproxy_handle_time_wait4 - nf_tproxy_get_sock_v4 - nf_tproxy_laddr6 - nf_tproxy_handle_time_wait6 - nf_tproxy_get_sock_v6(nf_)tproxy_handle_time_wait6 also needed some refactor as its currentimplementation was xtables-specific.Signed-off-by: Máté Eckl Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

0168e8b3 - netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module

Thu, 24 May 2018 11:17:28 +0000

netfilter: nat: merge ipv4/ipv6 masquerade code into main nat moduleInstead of using extra modules for these, turn the config options intoan implicit dependency that adds masq feature to the protocol specific nf_nat module.before: text data bss dec hex filename 2001 860 4 2865 b31 net/ipv4/netfilter/nf_nat_masquerade_ipv4.ko 5579 780 2 6361 18d9 net/ipv4/netfilter/nf_nat_ipv4.ko 2860 836 8 3704 e78 net/ipv6/netfilter/nf_nat_masquerade_ipv6.ko 6648 780 2 7430 1d06 net/ipv6/netfilter/nf_nat_ipv6.koafter: text data bss dec hex filename 7245 872 8 8125 1fbd net/ipv4/netfilter/nf_nat_ipv4.ko 9165 848 12 10025 2729 net/ipv6/netfilter/nf_nat_ipv6.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile

4fa8bc94 - kbuild: rename -asn1.[ch] to .asn1.[ch]

Fri, 23 Mar 2018 13:04:37 +0000

kbuild: rename *-asn1.[ch] to *.asn1.[ch]Our convention is to distinguish file types by suffixes with a periodas a separator.*-asn1.[ch] is a different pattern from other generated sources suchas *.lex.c, *.tab.[ch], *.dtb.S, etc. More confusing, files with'-asn1.[ch]' are generated files, but '_asn1.[ch]' are checked-infiles: net/netfilter/nf_conntrack_h323_asn1.c include/linux/netfilter/nf_conntrack_h323_asn1.h include/linux/sunrpc/gss_asn1.hRename generated files to *.asn1.[ch] for consistency.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/net/ipv4/netfilter/Makefile

3ca3273e - kbuild: clean up *-asn1.[ch] patterns from top-level Makefile

Fri, 23 Mar 2018 13:04:36 +0000

kbuild: clean up *-asn1.[ch] patterns from top-level MakefileClean up these patterns from the top Makefile to omit 'clean-files'in each Makefile.Signed-off-by: Masahiro Yamada List of files: /linux-6.15/net/ipv4/netfilter/Makefile

02c7b25e - netfilter: nf_tables: build-in filter chain type

Tue, 27 Mar 2018 09:53:07 +0000

netfilter: nf_tables: build-in filter chain typeOne module per supported filter chain family type takes too much memoryfor very little code - too much modularization - place all chain filterdefinitions in one single file.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/Makefile