nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds

Browse source 
Its now possible to build a kernel that has no support for the classic
xtables get/setsockopt interfaces and builtin tables.

In this case, we have CONFIG_IP6_NF_MANGLE=n and
CONFIG_IP_NF_ARPTABLES=n.

For optstript, the ipv6 code is so small that we can enable it if
netfilter ipv6 support exists. For mark, check if either classic
arptables or NFT_ARP_COMPAT is set.

Fixes: a9525c7f62 ("netfilter: xtables: allow xtables-nft only builds")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2025-05-16 16:12:13 +02:00 committed by Pablo Neira Ayuso
parent d31c1cafc4
commit c38eb2973c
2 changed files with 3 additions and 3 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
net/netfilter/xt_TCPOPTSTRIP.c
View file

@ -91,7 +91,7 @@ tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb)); return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb));
} }
#if IS_ENABLED(CONFIG_IP6_NF_MANGLE) #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
static unsigned int static unsigned int
tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par) tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{ {
@ -119,7 +119,7 @@ static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
.targetsize = sizeof(struct xt_tcpoptstrip_target_info), .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
#if IS_ENABLED(CONFIG_IP6_NF_MANGLE) #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
{ {
.name = "TCPOPTSTRIP", .name = "TCPOPTSTRIP",
.family = NFPROTO_IPV6, .family = NFPROTO_IPV6,

2
net/netfilter/xt_mark.c
View file

@ -48,7 +48,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = {
.targetsize = sizeof(struct xt_mark_tginfo2), .targetsize = sizeof(struct xt_mark_tginfo2),
.me = THIS_MODULE, .me = THIS_MODULE,
}, },
#if IS_ENABLED(CONFIG_IP_NF_ARPTABLES) #if IS_ENABLED(CONFIG_IP_NF_ARPTABLES) || IS_ENABLED(CONFIG_NFT_COMPAT_ARP)
{ {
.name = "MARK", .name = "MARK",
.revision = 2, .revision = 2,