diff options
author | KOVACS Krisztian <hidden@balabit.hu> | 2010-10-24 19:38:32 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2010-10-25 16:58:36 -0400 |
commit | f6318e558806c925029dc101f14874be9f9fa78f (patch) | |
tree | 995a09d340c55a01a4d1b6235c3a8efea6b8a14f /net | |
parent | 6f0bcf152582e7403155627a38e07bf3ef7f3cf5 (diff) |
netfilter: fix module dependency issues with IPv6 defragmentation, ip6tables and xt_TPROXY
One of the previous tproxy related patches split IPv6 defragmentation and
connection tracking, but did not correctly add Kconfig stanzas to handle the
new dependencies correctly. This patch fixes that by making the config options
mirror the setup we have for IPv4: a distinct config option for defragmentation
that is automatically selected by both connection tracking and
xt_TPROXY/xt_socket.
The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
and xt_TPROXY: we only compile these in case we have ip6tables support enabled.
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv6/netfilter/Kconfig | 5 | ||||
-rw-r--r-- | net/ipv6/netfilter/Makefile | 5 | ||||
-rw-r--r-- | net/netfilter/Kconfig | 2 | ||||
-rw-r--r-- | net/netfilter/xt_TPROXY.c | 10 | ||||
-rw-r--r-- | net/netfilter/xt_socket.c | 12 |
5 files changed, 25 insertions, 9 deletions
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index 44d2eeac089b..448464844a25 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig | |||
@@ -5,10 +5,15 @@ | |||
5 | menu "IPv6: Netfilter Configuration" | 5 | menu "IPv6: Netfilter Configuration" |
6 | depends on INET && IPV6 && NETFILTER | 6 | depends on INET && IPV6 && NETFILTER |
7 | 7 | ||
8 | config NF_DEFRAG_IPV6 | ||
9 | tristate | ||
10 | default n | ||
11 | |||
8 | config NF_CONNTRACK_IPV6 | 12 | config NF_CONNTRACK_IPV6 |
9 | tristate "IPv6 connection tracking support" | 13 | tristate "IPv6 connection tracking support" |
10 | depends on INET && IPV6 && NF_CONNTRACK | 14 | depends on INET && IPV6 && NF_CONNTRACK |
11 | default m if NETFILTER_ADVANCED=n | 15 | default m if NETFILTER_ADVANCED=n |
16 | select NF_DEFRAG_IPV6 | ||
12 | ---help--- | 17 | ---help--- |
13 | Connection tracking keeps a record of what packets have passed | 18 | Connection tracking keeps a record of what packets have passed |
14 | through your machine, in order to figure out how they are related | 19 | through your machine, in order to figure out how they are related |
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile index 3f8e4a3d83ce..0a432c9b0795 100644 --- a/net/ipv6/netfilter/Makefile +++ b/net/ipv6/netfilter/Makefile | |||
@@ -12,11 +12,14 @@ obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o | |||
12 | 12 | ||
13 | # objects for l3 independent conntrack | 13 | # objects for l3 independent conntrack |
14 | nf_conntrack_ipv6-objs := nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o | 14 | nf_conntrack_ipv6-objs := nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o |
15 | nf_defrag_ipv6-objs := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o | ||
16 | 15 | ||
17 | # l3 independent conntrack | 16 | # l3 independent conntrack |
18 | obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o | 17 | obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o |
19 | 18 | ||
19 | # defrag | ||
20 | nf_defrag_ipv6-objs := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o | ||
21 | obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o | ||
22 | |||
20 | # matches | 23 | # matches |
21 | obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o | 24 | obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o |
22 | obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o | 25 | obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o |
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index 43288259f4a1..1534f2b44caf 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig | |||
@@ -525,6 +525,7 @@ config NETFILTER_XT_TARGET_TPROXY | |||
525 | depends on NETFILTER_XTABLES | 525 | depends on NETFILTER_XTABLES |
526 | depends on NETFILTER_ADVANCED | 526 | depends on NETFILTER_ADVANCED |
527 | select NF_DEFRAG_IPV4 | 527 | select NF_DEFRAG_IPV4 |
528 | select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES | ||
528 | help | 529 | help |
529 | This option adds a `TPROXY' target, which is somewhat similar to | 530 | This option adds a `TPROXY' target, which is somewhat similar to |
530 | REDIRECT. It can only be used in the mangle table and is useful | 531 | REDIRECT. It can only be used in the mangle table and is useful |
@@ -927,6 +928,7 @@ config NETFILTER_XT_MATCH_SOCKET | |||
927 | depends on NETFILTER_ADVANCED | 928 | depends on NETFILTER_ADVANCED |
928 | depends on !NF_CONNTRACK || NF_CONNTRACK | 929 | depends on !NF_CONNTRACK || NF_CONNTRACK |
929 | select NF_DEFRAG_IPV4 | 930 | select NF_DEFRAG_IPV4 |
931 | select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES | ||
930 | help | 932 | help |
931 | This option adds a `socket' match, which can be used to match | 933 | This option adds a `socket' match, which can be used to match |
932 | packets for which a TCP or UDP socket lookup finds a valid socket. | 934 | packets for which a TCP or UDP socket lookup finds a valid socket. |
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 19c482caf30b..640678f47a2a 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c | |||
@@ -21,7 +21,9 @@ | |||
21 | #include <linux/netfilter_ipv4/ip_tables.h> | 21 | #include <linux/netfilter_ipv4/ip_tables.h> |
22 | 22 | ||
23 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> | 23 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> |
24 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 24 | |
25 | #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) | ||
26 | #define XT_TPROXY_HAVE_IPV6 1 | ||
25 | #include <net/if_inet6.h> | 27 | #include <net/if_inet6.h> |
26 | #include <net/addrconf.h> | 28 | #include <net/addrconf.h> |
27 | #include <linux/netfilter_ipv6/ip6_tables.h> | 29 | #include <linux/netfilter_ipv6/ip6_tables.h> |
@@ -172,7 +174,7 @@ tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par) | |||
172 | return tproxy_tg4(skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); | 174 | return tproxy_tg4(skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); |
173 | } | 175 | } |
174 | 176 | ||
175 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 177 | #ifdef XT_TPROXY_HAVE_IPV6 |
176 | 178 | ||
177 | static inline const struct in6_addr * | 179 | static inline const struct in6_addr * |
178 | tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr, | 180 | tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr, |
@@ -372,7 +374,7 @@ static struct xt_target tproxy_tg_reg[] __read_mostly = { | |||
372 | .hooks = 1 << NF_INET_PRE_ROUTING, | 374 | .hooks = 1 << NF_INET_PRE_ROUTING, |
373 | .me = THIS_MODULE, | 375 | .me = THIS_MODULE, |
374 | }, | 376 | }, |
375 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 377 | #ifdef XT_TPROXY_HAVE_IPV6 |
376 | { | 378 | { |
377 | .name = "TPROXY", | 379 | .name = "TPROXY", |
378 | .family = NFPROTO_IPV6, | 380 | .family = NFPROTO_IPV6, |
@@ -391,7 +393,7 @@ static struct xt_target tproxy_tg_reg[] __read_mostly = { | |||
391 | static int __init tproxy_tg_init(void) | 393 | static int __init tproxy_tg_init(void) |
392 | { | 394 | { |
393 | nf_defrag_ipv4_enable(); | 395 | nf_defrag_ipv4_enable(); |
394 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 396 | #ifdef XT_TPROXY_HAVE_IPV6 |
395 | nf_defrag_ipv6_enable(); | 397 | nf_defrag_ipv6_enable(); |
396 | #endif | 398 | #endif |
397 | 399 | ||
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 2dbd4c857735..d94a858dc52a 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c | |||
@@ -14,7 +14,6 @@ | |||
14 | #include <linux/skbuff.h> | 14 | #include <linux/skbuff.h> |
15 | #include <linux/netfilter/x_tables.h> | 15 | #include <linux/netfilter/x_tables.h> |
16 | #include <linux/netfilter_ipv4/ip_tables.h> | 16 | #include <linux/netfilter_ipv4/ip_tables.h> |
17 | #include <linux/netfilter_ipv6/ip6_tables.h> | ||
18 | #include <net/tcp.h> | 17 | #include <net/tcp.h> |
19 | #include <net/udp.h> | 18 | #include <net/udp.h> |
20 | #include <net/icmp.h> | 19 | #include <net/icmp.h> |
@@ -22,7 +21,12 @@ | |||
22 | #include <net/inet_sock.h> | 21 | #include <net/inet_sock.h> |
23 | #include <net/netfilter/nf_tproxy_core.h> | 22 | #include <net/netfilter/nf_tproxy_core.h> |
24 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> | 23 | #include <net/netfilter/ipv4/nf_defrag_ipv4.h> |
24 | |||
25 | #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) | ||
26 | #define XT_SOCKET_HAVE_IPV6 1 | ||
27 | #include <linux/netfilter_ipv6/ip6_tables.h> | ||
25 | #include <net/netfilter/ipv6/nf_defrag_ipv6.h> | 28 | #include <net/netfilter/ipv6/nf_defrag_ipv6.h> |
29 | #endif | ||
26 | 30 | ||
27 | #include <linux/netfilter/xt_socket.h> | 31 | #include <linux/netfilter/xt_socket.h> |
28 | 32 | ||
@@ -186,7 +190,7 @@ socket_mt4_v1(const struct sk_buff *skb, struct xt_action_param *par) | |||
186 | return socket_match(skb, par, par->matchinfo); | 190 | return socket_match(skb, par, par->matchinfo); |
187 | } | 191 | } |
188 | 192 | ||
189 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 193 | #ifdef XT_SOCKET_HAVE_IPV6 |
190 | 194 | ||
191 | static int | 195 | static int |
192 | extract_icmp6_fields(const struct sk_buff *skb, | 196 | extract_icmp6_fields(const struct sk_buff *skb, |
@@ -331,7 +335,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = { | |||
331 | (1 << NF_INET_LOCAL_IN), | 335 | (1 << NF_INET_LOCAL_IN), |
332 | .me = THIS_MODULE, | 336 | .me = THIS_MODULE, |
333 | }, | 337 | }, |
334 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 338 | #ifdef XT_SOCKET_HAVE_IPV6 |
335 | { | 339 | { |
336 | .name = "socket", | 340 | .name = "socket", |
337 | .revision = 1, | 341 | .revision = 1, |
@@ -348,7 +352,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = { | |||
348 | static int __init socket_mt_init(void) | 352 | static int __init socket_mt_init(void) |
349 | { | 353 | { |
350 | nf_defrag_ipv4_enable(); | 354 | nf_defrag_ipv4_enable(); |
351 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 355 | #ifdef XT_SOCKET_HAVE_IPV6 |
352 | nf_defrag_ipv6_enable(); | 356 | nf_defrag_ipv6_enable(); |
353 | #endif | 357 | #endif |
354 | 358 | ||