Changes in Kconfig

6c959fd5 - netfilter: Make legacy configs user selectable

Mon, 30 Sep 2024 09:58:54 +0000

netfilter: Make legacy configs user selectableThis option makes legacy Netfilter Kconfig user selectable, giving usersthe option to configure iptables without enabling any other config.Make the following KConfig entries user selectable: * BRIDGE_NF_EBTABLES_LEGACY * IP_NF_ARPTABLES * IP_NF_IPTABLES_LEGACY * IP6_NF_IPTABLES_LEGACYSigned-off-by: Breno Leitao Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

a9525c7f - netfilter: xtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:11 +0000

netfilter: xtables: allow xtables-nft only buildsAdd hidden IP(6)_NF_IPTABLES_LEGACY symbol.When any of the "old" builtin tables are enabled the "old" iptablesinterface will be supported.To disable the old set/getsockopt interface the existing optionsfor the builtin tables need to be turned off:CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not setSame for CONFIG_IP6_NF_ variants.This allows to build a kernel that only supports ip(6)tables-nft(iptables-over-nftables api).In the future the _LEGACY symbol will become visible and the selectstatements will be turned into 'depends on', but for now be on safe sideso "make oldconfig" won't break things.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

7355bfe0 - netfilter: Remove flowtable relics

Sun, 23 Jan 2022 12:57:17 +0000

netfilter: Remove flowtable relicsNF_FLOW_TABLE_IPV4 and NF_FLOW_TABLE_IPV6 are invisble, selected bynothing (so they can no longer be enabled), and their last real usershave been removed (nf_flow_table_ipv6.c is empty).Clean up the leftovers.Fixes: c42ba4290b2147aa ("netfilter: flowtable: remove ipv4/ipv6 modules")Signed-off-by: Geert Uytterhoeven Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

c42ba429 - netfilter: flowtable: remove ipv4/ipv6 modules

Fri, 17 Dec 2021 14:10:55 +0000

netfilter: flowtable: remove ipv4/ipv6 modulesJust place the structs and registration in the inet module.nf_flow_table_ipv6, nf_flow_table_ipv4 and nf_flow_table_inet sharesame module dependencies: nf_flow_table, nf_tables.before: text data bss dec hex filename 2278 1480 0 3758 eae nf_flow_table_inet.ko 1159 1352 0 2511 9cf nf_flow_table_ipv6.ko 1154 1352 0 2506 9ca nf_flow_table_ipv4.koafter: 2369 1672 0 4041 fc9 nf_flow_table_inet.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

f5466caa - netfilter: nf_log_ipv6: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:07 +0000

netfilter: nf_log_ipv6: merge with nf_log_syslogThis removes the nf_log_ipv6 module, the functionality is nowprovided by nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

a7f7f624 - treewide: replace '---help---' in Kconfig files with 'help'

Sat, 13 Jun 2020 16:50:22 +0000

treewide: replace '---help---' in Kconfig files with 'help'Since commit 84af7a6194e4 ("checkpatch: kconfig: prefer 'help' over'---help---'"), the number of '---help---' has been graduallydecreasing, but there are still more than 2400 instances.This commit finishes the conversion. While I touched the lines,I also fixed the indentation.There are a variety of indentation styles found. a) 4 spaces + '---help---' b) 7 spaces + '---help---' c) 8 spaces + '---help---' d) 1 space + 1 tab + '---help---' e) 1 tab + '---help---' (correct indentation) f) 1 tab + 1 space + '---help---' g) 1 tab + 2 spaces + '---help---'In order to convert all of them to 1 tab + 'help', I ran thefollowing commend: $ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'Signed-off-by: Masahiro Yamada List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

43da1411 - net: Fix Kconfig indentation, continued

Thu, 21 Nov 2019 13:28:35 +0000

net: Fix Kconfig indentation, continuedAdjust indentation from spaces to tab (+optional two spaces) as incoding style. This fixes various indentation mixups (seven spaces,tab+one space, etc).Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

bf69abad - net: Fix Kconfig indentation

Mon, 23 Sep 2019 15:52:42 +0000

net: Fix Kconfig indentationAdjust indentation from spaces to tab (+optional two spaces) as incoding style with command like: $ sed -e 's/^ /\t/' -i */KconfigSigned-off-by: Krzysztof Kozlowski Acked-by: Sven Eckelmann Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

cd238eff - docs: kbuild: convert docs to ReST and rename to *.rst

Wed, 12 Jun 2019 17:52:48 +0000

docs: kbuild: convert docs to ReST and rename to *.rstThe kbuild documentation clearly shows that the documentsthere are written at different times: some use markdown,some use their own peculiar logic to split sections.Convert everything to ReST without affecting too muchthe author's style and avoiding adding uneeded markups.The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups.At its new index.rst, let's add a :orphan: while this is not linked tothe main index.rst file, in order to avoid build warnings.Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

adf82acc - netfilter: x_tables: merge ip and ipv6 masquerade modules

Tue, 09 Apr 2019 08:44:07 +0000

netfilter: x_tables: merge ip and ipv6 masquerade modulesNo need to have separate modules for this.before: text data bss dec filename 2038 1168 0 3206 net/ipv4/netfilter/ipt_MASQUERADE.ko 1526 1024 0 2550 net/ipv6/netfilter/ip6t_MASQUERADE.koafter: text data bss dec filename 2521 1296 0 3817 net/netfilter/xt_MASQUERADE.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

c1deb065 - netfilter: nf_tables: merge route type into core

Wed, 27 Mar 2019 08:22:25 +0000

netfilter: nf_tables: merge route type into corevery little code, so it really doesn't make sense to have extramodules or even a kconfig knob for this.Merge them and make functionality available unconditionally.The merge makes inet family route support trivial, so add itas well here.Before: text data bss dec hex filename 835 832 0 1667 683 nft_chain_route_ipv4.ko 870 832 0 1702 6a6 nft_chain_route_ipv6.ko 111568 2556 529 114653 1bfdd nf_tables.koAfter: text data bss dec hex filename 113133 2556 529 116218 1c5fa nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

db8ab388 - netfilter: nf_tables: merge ipv4 and ipv6 nat chain types

Thu, 28 Feb 2019 11:02:52 +0000

netfilter: nf_tables: merge ipv4 and ipv6 nat chain typesMerge the ipv4 and ipv6 nat chain type. This is the lastmissing piece which allows to provide inet family supportfor nat in a follow patch.The kconfig knobs for ipv4/ipv6 nat chain are removed, thenat chain type will be built unconditionally if NFT_NATexpression is enabled.Before: text data bss dec hex filename 1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko 1697 896 0 2593 a21 nft_chain_nat_ipv6.koAfter: text data bss dec hex filename 1832 896 0 2728 aa8 nft_chain_nat.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

a9ce849e - netfilter: nf_tables: nat: merge nft_masq protocol specific modules

Thu, 28 Feb 2019 11:02:51 +0000

netfilter: nf_tables: nat: merge nft_masq protocol specific modulesThe family specific masq modules are way too small to warrantan extra module, just place all of them in nft_masq.before: text data bss dec hex filename 1001 832 0 1833 729 nft_masq.ko 766 896 0 1662 67e nft_masq_ipv4.ko 764 896 0 1660 67c nft_masq_ipv6.koafter: 2010 960 0 2970 b9a nft_masq.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

c78efc99 - netfilter: nf_tables: nat: merge nft_redir protocol specific modules

Thu, 28 Feb 2019 11:02:50 +0000

netfilter: nf_tables: nat: merge nft_redir protocol specific modulesbefore: text data bss dec hex filename 990 832 0 1822 71e nft_redir.ko 697 896 0 1593 639 nft_redir_ipv4.ko 713 896 0 1609 649 nft_redir_ipv6.koafter: text data bss dec hex filename 1910 960 0 2870 b36 nft_redir.kosize is reduced, all helpers from nft_redir.ko can be made static.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

3bf195ae - netfilter: nat: merge nf_nat_ipv4,6 into nat core

Tue, 19 Feb 2019 16:38:21 +0000

netfilter: nat: merge nf_nat_ipv4,6 into nat corebefore: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3598 844 0 4442 115a nf_nat_ipv6.ko 3187 844 0 4031 fbf nf_nat_ipv4.koafter: text data bss dec hex filename 22948 1612 4136 28696 7018 nf_nat.ko... with ipv4/v6 nat now provided directly via nf_nat.ko.Also changes: ret = nf_nat_ipv4_fn(priv, skb, state); if (ret != NF_DROP && ret != NF_STOLEN &&into if (ret != NF_ACCEPT) return ret;everywhere.The nat hooks never should return anything other thanACCEPT or DROP (and the latter only in rare error cases).The original code uses multi-line ANDing including assignment-in-if: if (ret != NF_DROP && ret != NF_STOLEN && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && (ct = nf_ct_get(skb, &ctinfo)) != NULL) {I removed this while moving, breaking those in separate conditionalsand moving the assignments into extra lines.checkpatch still generates some warnings: 1. Overly long lines (of moved code). Breaking them is even more ugly. so I kept this as-is. 2. use of extern function declarations in a .c file. This is necessary evil, we must call nf_nat_l3proto_register() from the nat core now. All l3proto related functions are removed later in this series, those prototypes are then removed as well.v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles are removed here.v4: also get rid of the assignments in conditionals.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

d1aca8ab - netfilter: nat: merge ipv4 and ipv6 masquerade functionality

Tue, 19 Feb 2019 16:38:19 +0000

netfilter: nat: merge ipv4 and ipv6 masquerade functionalityBefore: text data bss dec hex filename 13916 1412 4128 19456 4c00 nf_nat.ko 4510 968 4 5482 156a nf_nat_ipv4.ko 5146 944 8 6098 17d2 nf_nat_ipv6.koAfter: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3187 844 0 4031 fbf nf_nat_ipv4.ko 3598 844 0 4442 115a nf_nat_ipv6.ko... so no drastic changes in combined size.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

a0ae2562 - netfilter: conntrack: remove l3proto abstraction

Fri, 29 Jun 2018 05:46:51 +0000

netfilter: conntrack: remove l3proto abstractionThis unifies ipv4 and ipv6 protocol trackers and removes the l3protoabstraction.This gets rid of all l3proto indirect calls and the need to doa lookup on the function to call for l3 demux.It increases module size by only a small amount (12kbyte), so this reducessize because nf_conntrack.ko is useless without either nf_conntrack_ipv4or nf_conntrack_ipv6 module.before: text data bss dec hex filename 7357 1088 0 8445 20fd nf_conntrack_ipv4.ko 7405 1084 4 8493 212d nf_conntrack_ipv6.ko 72614 13689 236 86539 1520b nf_conntrack.ko 19K nf_conntrack_ipv4.ko 19K nf_conntrack_ipv6.ko179K nf_conntrack.koafter: text data bss dec hex filename 79277 13937 236 93450 16d0a nf_conntrack.ko 191K nf_conntrack.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

45ca4e0c - netfilter: Libify xt_TPROXY

Fri, 01 Jun 2018 18:44:56 +0000

netfilter: Libify xt_TPROXYThe extracted functions will likely be usefull to implement tproxysupport in nf_tables.Extrancted functions: - nf_tproxy_sk_is_transparent - nf_tproxy_laddr4 - nf_tproxy_handle_time_wait4 - nf_tproxy_get_sock_v4 - nf_tproxy_laddr6 - nf_tproxy_handle_time_wait6 - nf_tproxy_get_sock_v6(nf_)tproxy_handle_time_wait6 also needed some refactor as its currentimplementation was xtables-specific.Signed-off-by: Máté Eckl Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig

0168e8b3 - netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module

Thu, 24 May 2018 11:17:28 +0000

netfilter: nat: merge ipv4/ipv6 masquerade code into main nat moduleInstead of using extra modules for these, turn the config options intoan implicit dependency that adds masq feature to the protocol specific nf_nat module.before: text data bss dec hex filename 2001 860 4 2865 b31 net/ipv4/netfilter/nf_nat_masquerade_ipv4.ko 5579 780 2 6361 18d9 net/ipv4/netfilter/nf_nat_ipv4.ko 2860 836 8 3704 e78 net/ipv6/netfilter/nf_nat_masquerade_ipv6.ko 6648 780 2 7430 1d06 net/ipv6/netfilter/nf_nat_ipv6.koafter: text data bss dec hex filename 7245 872 8 8125 1fbd net/ipv4/netfilter/nf_nat_ipv4.ko 9165 848 12 10025 2729 net/ipv6/netfilter/nf_nat_ipv6.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Kconfig