Changes in Makefile

a9525c7f - netfilter: xtables: allow xtables-nft only builds

Wed, 24 Jan 2024 09:21:11 +0000

netfilter: xtables: allow xtables-nft only buildsAdd hidden IP(6)_NF_IPTABLES_LEGACY symbol.When any of the "old" builtin tables are enabled the "old" iptablesinterface will be supported.To disable the old set/getsockopt interface the existing optionsfor the builtin tables need to be turned off:CONFIG_IP_NF_IPTABLES=mCONFIG_IP_NF_FILTER is not setCONFIG_IP_NF_NAT is not setCONFIG_IP_NF_MANGLE is not setCONFIG_IP_NF_RAW is not setCONFIG_IP_NF_SECURITY is not setSame for CONFIG_IP6_NF_ variants.This allows to build a kernel that only supports ip(6)tables-nft(iptables-over-nftables api).In the future the _LEGACY symbol will become visible and the selectstatements will be turned into 'depends on', but for now be on safe sideso "make oldconfig" won't break things.Signed-off-by: Florian Westphal List of files: /linux-6.15/net/ipv6/netfilter/Makefile

7355bfe0 - netfilter: Remove flowtable relics

Sun, 23 Jan 2022 12:57:17 +0000

netfilter: Remove flowtable relicsNF_FLOW_TABLE_IPV4 and NF_FLOW_TABLE_IPV6 are invisble, selected bynothing (so they can no longer be enabled), and their last real usershave been removed (nf_flow_table_ipv6.c is empty).Clean up the leftovers.Fixes: c42ba4290b2147aa ("netfilter: flowtable: remove ipv4/ipv6 modules")Signed-off-by: Geert Uytterhoeven Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

f5466caa - netfilter: nf_log_ipv6: merge with nf_log_syslog

Thu, 25 Mar 2021 17:25:07 +0000

netfilter: nf_log_ipv6: merge with nf_log_syslogThis removes the nf_log_ipv6 module, the functionality is nowprovided by nf_log_syslog.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

adf82acc - netfilter: x_tables: merge ip and ipv6 masquerade modules

Tue, 09 Apr 2019 08:44:07 +0000

netfilter: x_tables: merge ip and ipv6 masquerade modulesNo need to have separate modules for this.before: text data bss dec filename 2038 1168 0 3206 net/ipv4/netfilter/ipt_MASQUERADE.ko 1526 1024 0 2550 net/ipv6/netfilter/ip6t_MASQUERADE.koafter: text data bss dec filename 2521 1296 0 3817 net/netfilter/xt_MASQUERADE.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

c1deb065 - netfilter: nf_tables: merge route type into core

Wed, 27 Mar 2019 08:22:25 +0000

netfilter: nf_tables: merge route type into corevery little code, so it really doesn't make sense to have extramodules or even a kconfig knob for this.Merge them and make functionality available unconditionally.The merge makes inet family route support trivial, so add itas well here.Before: text data bss dec hex filename 835 832 0 1667 683 nft_chain_route_ipv4.ko 870 832 0 1702 6a6 nft_chain_route_ipv6.ko 111568 2556 529 114653 1bfdd nf_tables.koAfter: text data bss dec hex filename 113133 2556 529 116218 1c5fa nf_tables.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

db8ab388 - netfilter: nf_tables: merge ipv4 and ipv6 nat chain types

Thu, 28 Feb 2019 11:02:52 +0000

netfilter: nf_tables: merge ipv4 and ipv6 nat chain typesMerge the ipv4 and ipv6 nat chain type. This is the lastmissing piece which allows to provide inet family supportfor nat in a follow patch.The kconfig knobs for ipv4/ipv6 nat chain are removed, thenat chain type will be built unconditionally if NFT_NATexpression is enabled.Before: text data bss dec hex filename 1576 896 0 2472 9a8 nft_chain_nat_ipv4.ko 1697 896 0 2593 a21 nft_chain_nat_ipv6.koAfter: text data bss dec hex filename 1832 896 0 2728 aa8 nft_chain_nat.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

a9ce849e - netfilter: nf_tables: nat: merge nft_masq protocol specific modules

Thu, 28 Feb 2019 11:02:51 +0000

netfilter: nf_tables: nat: merge nft_masq protocol specific modulesThe family specific masq modules are way too small to warrantan extra module, just place all of them in nft_masq.before: text data bss dec hex filename 1001 832 0 1833 729 nft_masq.ko 766 896 0 1662 67e nft_masq_ipv4.ko 764 896 0 1660 67c nft_masq_ipv6.koafter: 2010 960 0 2970 b9a nft_masq.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

c78efc99 - netfilter: nf_tables: nat: merge nft_redir protocol specific modules

Thu, 28 Feb 2019 11:02:50 +0000

netfilter: nf_tables: nat: merge nft_redir protocol specific modulesbefore: text data bss dec hex filename 990 832 0 1822 71e nft_redir.ko 697 896 0 1593 639 nft_redir_ipv4.ko 713 896 0 1609 649 nft_redir_ipv6.koafter: text data bss dec hex filename 1910 960 0 2870 b36 nft_redir.kosize is reduced, all helpers from nft_redir.ko can be made static.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

3bf195ae - netfilter: nat: merge nf_nat_ipv4,6 into nat core

Tue, 19 Feb 2019 16:38:21 +0000

netfilter: nat: merge nf_nat_ipv4,6 into nat corebefore: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3598 844 0 4442 115a nf_nat_ipv6.ko 3187 844 0 4031 fbf nf_nat_ipv4.koafter: text data bss dec hex filename 22948 1612 4136 28696 7018 nf_nat.ko... with ipv4/v6 nat now provided directly via nf_nat.ko.Also changes: ret = nf_nat_ipv4_fn(priv, skb, state); if (ret != NF_DROP && ret != NF_STOLEN &&into if (ret != NF_ACCEPT) return ret;everywhere.The nat hooks never should return anything other thanACCEPT or DROP (and the latter only in rare error cases).The original code uses multi-line ANDing including assignment-in-if: if (ret != NF_DROP && ret != NF_STOLEN && !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && (ct = nf_ct_get(skb, &ctinfo)) != NULL) {I removed this while moving, breaking those in separate conditionalsand moving the assignments into extra lines.checkpatch still generates some warnings: 1. Overly long lines (of moved code). Breaking them is even more ugly. so I kept this as-is. 2. use of extern function declarations in a .c file. This is necessary evil, we must call nf_nat_l3proto_register() from the nat core now. All l3proto related functions are removed later in this series, those prototypes are then removed as well.v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles are removed here.v4: also get rid of the assignments in conditionals.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

d1aca8ab - netfilter: nat: merge ipv4 and ipv6 masquerade functionality

Tue, 19 Feb 2019 16:38:19 +0000

netfilter: nat: merge ipv4 and ipv6 masquerade functionalityBefore: text data bss dec hex filename 13916 1412 4128 19456 4c00 nf_nat.ko 4510 968 4 5482 156a nf_nat_ipv4.ko 5146 944 8 6098 17d2 nf_nat_ipv6.koAfter: text data bss dec hex filename 16566 1576 4136 22278 5706 nf_nat.ko 3187 844 0 4031 fbf nf_nat_ipv4.ko 3598 844 0 4442 115a nf_nat_ipv6.ko... so no drastic changes in combined size.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

5cbabeec - netfilter: nat: remove nf_nat_l4proto struct

Thu, 13 Dec 2018 15:01:34 +0000

netfilter: nat: remove nf_nat_l4proto structThis removes the (now empty) nf_nat_l4proto struct, all its instancesand all the no longer needed runtime (un)register functionality.nf_nat_need_gre() can be axed as well: the module that calls it (toload the no-longer-existing nat_gre module) also calls other nat corefunctions. GRE nat is now always available if kernel is built with it.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

a0ae2562 - netfilter: conntrack: remove l3proto abstraction

Fri, 29 Jun 2018 05:46:51 +0000

netfilter: conntrack: remove l3proto abstractionThis unifies ipv4 and ipv6 protocol trackers and removes the l3protoabstraction.This gets rid of all l3proto indirect calls and the need to doa lookup on the function to call for l3 demux.It increases module size by only a small amount (12kbyte), so this reducessize because nf_conntrack.ko is useless without either nf_conntrack_ipv4or nf_conntrack_ipv6 module.before: text data bss dec hex filename 7357 1088 0 8445 20fd nf_conntrack_ipv4.ko 7405 1084 4 8493 212d nf_conntrack_ipv6.ko 72614 13689 236 86539 1520b nf_conntrack.ko 19K nf_conntrack_ipv4.ko 19K nf_conntrack_ipv6.ko179K nf_conntrack.koafter: text data bss dec hex filename 79277 13937 236 93450 16d0a nf_conntrack.ko 191K nf_conntrack.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

45ca4e0c - netfilter: Libify xt_TPROXY

Fri, 01 Jun 2018 18:44:56 +0000

netfilter: Libify xt_TPROXYThe extracted functions will likely be usefull to implement tproxysupport in nf_tables.Extrancted functions: - nf_tproxy_sk_is_transparent - nf_tproxy_laddr4 - nf_tproxy_handle_time_wait4 - nf_tproxy_get_sock_v4 - nf_tproxy_laddr6 - nf_tproxy_handle_time_wait6 - nf_tproxy_get_sock_v6(nf_)tproxy_handle_time_wait6 also needed some refactor as its currentimplementation was xtables-specific.Signed-off-by: Máté Eckl Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

0168e8b3 - netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module

Thu, 24 May 2018 11:17:28 +0000

netfilter: nat: merge ipv4/ipv6 masquerade code into main nat moduleInstead of using extra modules for these, turn the config options intoan implicit dependency that adds masq feature to the protocol specific nf_nat module.before: text data bss dec hex filename 2001 860 4 2865 b31 net/ipv4/netfilter/nf_nat_masquerade_ipv4.ko 5579 780 2 6361 18d9 net/ipv4/netfilter/nf_nat_ipv4.ko 2860 836 8 3704 e78 net/ipv6/netfilter/nf_nat_masquerade_ipv6.ko 6648 780 2 7430 1d06 net/ipv6/netfilter/nf_nat_ipv6.koafter: text data bss dec hex filename 7245 872 8 8125 1fbd net/ipv4/netfilter/nf_nat_ipv4.ko 9165 848 12 10025 2729 net/ipv6/netfilter/nf_nat_ipv6.koSigned-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

02c7b25e - netfilter: nf_tables: build-in filter chain type

Tue, 27 Mar 2018 09:53:07 +0000

netfilter: nf_tables: build-in filter chain typeOne module per supported filter chain family type takes too much memoryfor very little code - too much modularization - place all chain filterdefinitions in one single file.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

202a8ff5 - netfilter: add IPv6 segment routing header 'srh' match

Sun, 07 Jan 2018 18:22:02 +0000

netfilter: add IPv6 segment routing header 'srh' matchIt allows matching packets based on Segment Routing Header(SRH) information.The implementation considers revision 7 of the SRH draft.https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07Currently supported match options include:(1) Next Header(2) Hdr Ext Len(3) Segments Left(4) Last Entry(5) Tag value of SRHSigned-off-by: Ahmed Abdelsalam Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

09952107 - netfilter: flow table support for IPv6

Sun, 07 Jan 2018 00:04:19 +0000

netfilter: flow table support for IPv6This patch adds the IPv6 flow table type, that implements the datapathflow table to forward IPv6 traffic.This patch exports ip6_dst_mtu_forward() that is required to check formtu to pass up packets that need PMTUD handling to the classicforwarding path.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

b2441318 - License cleanup: add SPDX GPL-2.0 license identifier to files with no license

Wed, 01 Nov 2017 14:07:57 +0000

License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseMany source files in the tree are missing licensing information, whichmakes it harder for compliance tools to determine the correct license.By default all files without license information are under the defaultlicense of the kernel, which is GPL version 2.Update the files which contain no license information with the 'GPL-2.0'SPDX license identifier. The SPDX identifier is a legally bindingshorthand, which can be used instead of the full boiler plate text.This patch is based on work done by Thomas Gleixner and Kate Stewart andPhilippe Ombredanne.How this work was done:Patches were generated and checked against linux-4.14-rc6 for a subset ofthe use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information,Further patches will be generated in subsequent months to fix up caseswhere non-standard license headers were used, and references to licensehad to be inferred by heuristics based on keywords.The analysis to determine which SPDX License Identifier to be applied toa file was done in a spreadsheet of side by side results from of theoutput of two independent scanners (ScanCode & Windriver) producing SPDXtag:value files created by Philippe Ombredanne. Philippe prepared thebase worksheet, and did an initial spot review of a few 1000 files.The 4.13 kernel was the starting point of the analysis with 60,537 filesassessed. Kate Stewart did a file by file comparison of the scannerresults in the spreadsheet to determine which SPDX license identifier(s)to be applied to the file. She confirmed any determination that was notimmediately clear with lawyers working with the Linux Foundation.Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines).All documentation files were explicitly excluded.The following heuristics were used to determine which SPDX licenseidentifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time.In total, over 70 hours of logged manual review was done on thespreadsheet to determine the SPDX license identifiers to apply to thesource files by Kate, Philippe, Thomas and, in some cases, confirmationby lawyers working with the Linux Foundation.Kate also obtained a third independent scan of the 4.13 code base fromFOSSology, and compared selected files where the other two scannersdisagreed against that SPDX file, to see if there was new insights. TheWindriver scanner is based on an older version of FOSSology in part, sothey are related.Thomas did random spot checks in about 500 files from the spreadsheetsfor the uapi headers and agreed with SPDX license identifier in thefiles he inspected. For the non-uapi files Thomas did random spot checksin about 15000 files.In initial set of patches against 4.14-rc6, 3 files were found to havecopy/paste license identifier errors, and have been fixed to reflect thecorrect identifier.Additionally Philippe spent 10 hours this week doing a detailed manualinspection and review of the 12,461 patched files from the initial patchversion early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correctThis produced a worksheet with 20 files needing minor correction. Thisworksheet was then exported into 3 different .csv files for thedifferent types of files to be modified.These .csv files were then reviewed by Greg. Thomas wrote a script toparse the csv files and add the proper SPDX tag to the file, in theformat that the file expected. This script was further refined by Gregbased on the output to detect more types of files automatically and todistinguish between header and source .c files (which need differentcomment types.) Finally Greg ran the script using the .csv files togenerate the patches.Reviewed-by: Kate Stewart Reviewed-by: Philippe Ombredanne Reviewed-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/ipv6/netfilter/Makefile

8db4c5be - netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c

Thu, 27 Oct 2016 18:49:48 +0000

netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.cWe need this split to reuse existing codebase for the upcoming nf_tablessocket expression.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile

f6d0cbcf - netfilter: nf_tables: add fib expression

Mon, 24 Oct 2016 14:56:40 +0000

netfilter: nf_tables: add fib expressionAdd FIB expression, supported for ipv4, ipv6 and inet family (the latterjust dispatches to ipv4 or ipv6 one based on nfproto).Currently supports fetching output interface index/name and thertm_type associated with an address.This can be used for adding path filtering. rtm_type is usefulto e.g. enforce a strong-end host model where packetsare only accepted if daddr is configured on the interface thepacket arrived on.The fib expression is a native nftables alternative to thextables addrtype and rp_filter matches.FIB result order for oif/oifname retrieval is as follows: - if packet is local (skb has rtable, RTF_LOCAL set, this will also catch looped-back multicast packets), set oif to the loopback interface. - if fib lookup returns an error, or result points to local, store zero result. This means '--local' option of -m rpfilter is not supported. It is possible to use 'fib type local' or add explicit saddr/daddr matching rules to create exceptions if this is really needed. - store result in the destination register. In case of multiple routes, search set for desired oif in case strict matching is requested.ipv4 and ipv6 behave fib expressions are supposed to behave the same.[ I have collapsed Arnd Bergmann's ("netfilter: nf_tables: fib warnings") http://patchwork.ozlabs.org/patch/688615/ to address fallout from this patch after rebasing nf-next, that was posted to address compilation warnings. --pablo ]Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv6/netfilter/Makefile