netfilter: tee: select NF_DUP_IPV6 unconditionally
The NETFILTER_XT_TARGET_TEE option selects NF_DUP_IPV6 whenever IP6_NF_IPTABLES is enabled, and it ensures that it cannot be builtin itself if NF_CONNTRACK is a loadable module, as that is a dependency for NF_DUP_IPV6. However, NF_DUP_IPV6 can be enabled even if IP6_NF_IPTABLES is turned off, and it only really depends on IPV6. With the current check in tee_tg6, we call nf_dup_ipv6() whenever NF_DUP_IPV6 is enabled. This can however be a loadable module which is unreachable from a built-in xt_TEE: net/built-in.o: In function `tee_tg6': :(.text+0x67728): undefined reference to `nf_dup_ipv6' The bug was originally introduced in the split of the xt_TEE module into separate modules for ipv4 and ipv6, and two patches tried to fix it unsuccessfully afterwards. This is a revert of the the first incorrect attempt to fix it, going back to depending on IPV6 as the dependency, and we adapt the 'select' condition accordingly. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes:bbde9fc182
("netfilter: factor out packet duplication for IPv4/IPv6") Fixes:116984a316
("netfilter: xt_TEE: use IS_ENABLED(CONFIG_NF_DUP_IPV6)") Fixes:74ec4d55c4
("netfilter: fix xt_TEE and xt_TPROXY dependencies") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
c58d6c9368
commit
08a7f5d3f5
|
@ -891,7 +891,7 @@ config NETFILTER_XT_TARGET_TEE
|
||||||
depends on IPV6 || IPV6=n
|
depends on IPV6 || IPV6=n
|
||||||
depends on !NF_CONNTRACK || NF_CONNTRACK
|
depends on !NF_CONNTRACK || NF_CONNTRACK
|
||||||
select NF_DUP_IPV4
|
select NF_DUP_IPV4
|
||||||
select NF_DUP_IPV6 if IP6_NF_IPTABLES != n
|
select NF_DUP_IPV6 if IPV6
|
||||||
---help---
|
---help---
|
||||||
This option adds a "TEE" target with which a packet can be cloned and
|
This option adds a "TEE" target with which a packet can be cloned and
|
||||||
this clone be rerouted to another nexthop.
|
this clone be rerouted to another nexthop.
|
||||||
|
|
|
@ -38,7 +38,7 @@ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
|
||||||
return XT_CONTINUE;
|
return XT_CONTINUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
#if IS_ENABLED(CONFIG_NF_DUP_IPV6)
|
#if IS_ENABLED(CONFIG_IPV6)
|
||||||
static unsigned int
|
static unsigned int
|
||||||
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
|
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
|
||||||
{
|
{
|
||||||
|
@ -131,7 +131,7 @@ static struct xt_target tee_tg_reg[] __read_mostly = {
|
||||||
.destroy = tee_tg_destroy,
|
.destroy = tee_tg_destroy,
|
||||||
.me = THIS_MODULE,
|
.me = THIS_MODULE,
|
||||||
},
|
},
|
||||||
#if IS_ENABLED(CONFIG_NF_DUP_IPV6)
|
#if IS_ENABLED(CONFIG_IPV6)
|
||||||
{
|
{
|
||||||
.name = "TEE",
|
.name = "TEE",
|
||||||
.revision = 1,
|
.revision = 1,
|
||||||
|
|
Loading…
Reference in New Issue