niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

netfilter: xtables: allow xtables-nft only builds

Browse source 
Add hidden IP(6)_NF_IPTABLES_LEGACY symbol.

When any of the "old" builtin tables are enabled the "old" iptables
interface will be supported.

To disable the old set/getsockopt interface the existing options
for the builtin tables need to be turned off:

CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_FILTER is not set
CONFIG_IP_NF_NAT is not set
CONFIG_IP_NF_MANGLE is not set
CONFIG_IP_NF_RAW is not set
CONFIG_IP_NF_SECURITY is not set

Same for CONFIG_IP6_NF_ variants.

This allows to build a kernel that only supports ip(6)tables-nft
(iptables-over-nftables api).

In the future the _LEGACY symbol will become visible and the select
statements will be turned into 'depends on', but for now be on safe side
so "make oldconfig" won't break things.

Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Florian Westphal 2024-01-24 10:21:11 +01:00
parent 4654467dc7
commit a9525c7f62
5 changed files with 34 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
net/ipv4/netfilter/Kconfig
View file

@ -10,6 +10,10 @@ config NF_DEFRAG_IPV4
tristate tristate
default n default n
# old sockopt interface and eval loop
config IP_NF_IPTABLES_LEGACY
tristate
config NF_SOCKET_IPV4 config NF_SOCKET_IPV4
tristate "IPv4 socket lookup support" tristate "IPv4 socket lookup support"
help help
@ -152,7 +156,7 @@ config IP_NF_MATCH_ECN
config IP_NF_MATCH_RPFILTER config IP_NF_MATCH_RPFILTER
tristate '"rpfilter" reverse path filter match support' tristate '"rpfilter" reverse path filter match support'
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
depends on IP_NF_MANGLE || IP_NF_RAW depends on IP_NF_MANGLE || IP_NF_RAW || NFT_COMPAT
help help
This option allows you to match packets whose replies would This option allows you to match packets whose replies would
go out via the interface the packet came in. go out via the interface the packet came in.
@ -173,6 +177,7 @@ config IP_NF_MATCH_TTL
config IP_NF_FILTER config IP_NF_FILTER
tristate "Packet filtering" tristate "Packet filtering"
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
select IP_NF_IPTABLES_LEGACY
help help
Packet filtering defines a table `filter', which has a series of Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and rules for simple packet filtering at local input, forwarding and
@ -182,7 +187,7 @@ config IP_NF_FILTER
config IP_NF_TARGET_REJECT config IP_NF_TARGET_REJECT
tristate "REJECT target support" tristate "REJECT target support"
depends on IP_NF_FILTER depends on IP_NF_FILTER || NFT_COMPAT
select NF_REJECT_IPV4 select NF_REJECT_IPV4
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
help help
@ -212,6 +217,7 @@ config IP_NF_NAT
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
select NF_NAT select NF_NAT
select NETFILTER_XT_NAT select NETFILTER_XT_NAT
select IP6_NF_IPTABLES_LEGACY
help help
This enables the `nat' table in iptables. This allows masquerading, This enables the `nat' table in iptables. This allows masquerading,
port forwarding and other forms of full Network Address Port port forwarding and other forms of full Network Address Port
@ -252,6 +258,7 @@ endif # IP_NF_NAT
config IP_NF_MANGLE config IP_NF_MANGLE
tristate "Packet mangling" tristate "Packet mangling"
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
select IP_NF_IPTABLES_LEGACY
help help
This option adds a `mangle' table to iptables: see the man page for This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations iptables(8). This table is used for various packet alterations
@ -261,7 +268,7 @@ config IP_NF_MANGLE
config IP_NF_TARGET_ECN config IP_NF_TARGET_ECN
tristate "ECN target support" tristate "ECN target support"
depends on IP_NF_MANGLE depends on IP_NF_MANGLE || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This option adds a `ECN' target, which can be used in the iptables mangle This option adds a `ECN' target, which can be used in the iptables mangle
@ -286,6 +293,7 @@ config IP_NF_TARGET_TTL
# raw + specific targets # raw + specific targets
config IP_NF_RAW config IP_NF_RAW
tristate 'raw table support (required for NOTRACK/TRACE)' tristate 'raw table support (required for NOTRACK/TRACE)'
select IP_NF_IPTABLES_LEGACY
help help
This option adds a `raw' table to iptables. This table is the very This option adds a `raw' table to iptables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING first in the netfilter framework and hooks in at the PREROUTING
@ -299,6 +307,7 @@ config IP_NF_SECURITY
tristate "Security table" tristate "Security table"
depends on SECURITY depends on SECURITY
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
select IP_NF_IPTABLES_LEGACY
help help
This option adds a `security' table to iptables, for use This option adds a `security' table to iptables, for use
with Mandatory Access Control (MAC) policy. with Mandatory Access Control (MAC) policy.

2
net/ipv4/netfilter/Makefile
View file

@ -25,7 +25,7 @@ obj-$(CONFIG_NFT_FIB_IPV4) += nft_fib_ipv4.o
obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o obj-$(CONFIG_NFT_DUP_IPV4) += nft_dup_ipv4.o
# generic IP tables # generic IP tables
obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o obj-$(CONFIG_IP_NF_IPTABLES_LEGACY) += ip_tables.o
# the three instances of ip_tables # the three instances of ip_tables
obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o

20
net/ipv6/netfilter/Kconfig
View file

@ -6,6 +6,10 @@
menu "IPv6: Netfilter Configuration" menu "IPv6: Netfilter Configuration"
depends on INET && IPV6 && NETFILTER depends on INET && IPV6 && NETFILTER
# old sockopt interface and eval loop
config IP6_NF_IPTABLES_LEGACY
tristate
config NF_SOCKET_IPV6 config NF_SOCKET_IPV6
tristate "IPv6 socket lookup support" tristate "IPv6 socket lookup support"
help help
@ -147,7 +151,7 @@ config IP6_NF_MATCH_MH
config IP6_NF_MATCH_RPFILTER config IP6_NF_MATCH_RPFILTER
tristate '"rpfilter" reverse path filter match support' tristate '"rpfilter" reverse path filter match support'
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
depends on IP6_NF_MANGLE || IP6_NF_RAW depends on IP6_NF_MANGLE || IP6_NF_RAW || NFT_COMPAT
help help
This option allows you to match packets whose replies would This option allows you to match packets whose replies would
go out via the interface the packet came in. go out via the interface the packet came in.
@ -186,6 +190,8 @@ config IP6_NF_TARGET_HL
config IP6_NF_FILTER config IP6_NF_FILTER
tristate "Packet filtering" tristate "Packet filtering"
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
select IP6_NF_IPTABLES_LEGACY
tristate
help help
Packet filtering defines a table `filter', which has a series of Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and rules for simple packet filtering at local input, forwarding and
@ -195,7 +201,7 @@ config IP6_NF_FILTER
config IP6_NF_TARGET_REJECT config IP6_NF_TARGET_REJECT
tristate "REJECT target support" tristate "REJECT target support"
depends on IP6_NF_FILTER depends on IP6_NF_FILTER || NFT_COMPAT
select NF_REJECT_IPV6 select NF_REJECT_IPV6
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
help help
@ -221,6 +227,7 @@ config IP6_NF_TARGET_SYNPROXY
config IP6_NF_MANGLE config IP6_NF_MANGLE
tristate "Packet mangling" tristate "Packet mangling"
default m if NETFILTER_ADVANCED=n default m if NETFILTER_ADVANCED=n
select IP6_NF_IPTABLES_LEGACY
help help
This option adds a `mangle' table to iptables: see the man page for This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations iptables(8). This table is used for various packet alterations
@ -230,6 +237,7 @@ config IP6_NF_MANGLE
config IP6_NF_RAW config IP6_NF_RAW
tristate 'raw table support (required for TRACE)' tristate 'raw table support (required for TRACE)'
select IP6_NF_IPTABLES_LEGACY
help help
This option adds a `raw' table to ip6tables. This table is the very This option adds a `raw' table to ip6tables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING first in the netfilter framework and hooks in at the PREROUTING
@ -243,6 +251,7 @@ config IP6_NF_SECURITY
tristate "Security table" tristate "Security table"
depends on SECURITY depends on SECURITY
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
select IP6_NF_IPTABLES_LEGACY
help help
This option adds a `security' table to iptables, for use This option adds a `security' table to iptables, for use
with Mandatory Access Control (MAC) policy. with Mandatory Access Control (MAC) policy.
@ -254,6 +263,7 @@ config IP6_NF_NAT
depends on NF_CONNTRACK depends on NF_CONNTRACK
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
select NF_NAT select NF_NAT
select IP6_NF_IPTABLES_LEGACY
select NETFILTER_XT_NAT select NETFILTER_XT_NAT
help help
This enables the `nat' table in ip6tables. This allows masquerading, This enables the `nat' table in ip6tables. This allows masquerading,
@ -262,25 +272,23 @@ config IP6_NF_NAT
To compile it as a module, choose M here. If unsure, say N. To compile it as a module, choose M here. If unsure, say N.
if IP6_NF_NAT
config IP6_NF_TARGET_MASQUERADE config IP6_NF_TARGET_MASQUERADE
tristate "MASQUERADE target support" tristate "MASQUERADE target support"
select NETFILTER_XT_TARGET_MASQUERADE select NETFILTER_XT_TARGET_MASQUERADE
depends on IP6_NF_NAT
help help
This is a backwards-compat option for the user's convenience This is a backwards-compat option for the user's convenience
(e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE. (e.g. when running oldconfig). It selects NETFILTER_XT_TARGET_MASQUERADE.
config IP6_NF_TARGET_NPT config IP6_NF_TARGET_NPT
tristate "NPT (Network Prefix translation) target support" tristate "NPT (Network Prefix translation) target support"
depends on IP6_NF_NAT || NFT_COMPAT
help help
This option adds the `SNPT' and `DNPT' target, which perform This option adds the `SNPT' and `DNPT' target, which perform
stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296. stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
To compile it as a module, choose M here. If unsure, say N. To compile it as a module, choose M here. If unsure, say N.
endif # IP6_NF_NAT
endif # IP6_NF_IPTABLES endif # IP6_NF_IPTABLES
endmenu endmenu

2
net/ipv6/netfilter/Makefile
View file

@ -4,7 +4,7 @@
# #
# Link order matters here. # Link order matters here.
obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o obj-$(CONFIG_IP6_NF_IPTABLES_LEGACY) += ip6_tables.o
obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o

12
net/netfilter/Kconfig
View file

@ -818,7 +818,7 @@ config NETFILTER_XT_TARGET_AUDIT
config NETFILTER_XT_TARGET_CHECKSUM config NETFILTER_XT_TARGET_CHECKSUM
tristate "CHECKSUM target support" tristate "CHECKSUM target support"
depends on IP_NF_MANGLE || IP6_NF_MANGLE depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This option adds a `CHECKSUM' target, which can be used in the iptables mangle This option adds a `CHECKSUM' target, which can be used in the iptables mangle
@ -869,7 +869,7 @@ config NETFILTER_XT_TARGET_CONNSECMARK
config NETFILTER_XT_TARGET_CT config NETFILTER_XT_TARGET_CT
tristate '"CT" target support' tristate '"CT" target support'
depends on NF_CONNTRACK depends on NF_CONNTRACK
depends on IP_NF_RAW || IP6_NF_RAW depends on IP_NF_RAW || IP6_NF_RAW || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This options adds a `CT' target, which allows to specify initial This options adds a `CT' target, which allows to specify initial
@ -880,7 +880,7 @@ config NETFILTER_XT_TARGET_CT
config NETFILTER_XT_TARGET_DSCP config NETFILTER_XT_TARGET_DSCP
tristate '"DSCP" and "TOS" target support' tristate '"DSCP" and "TOS" target support'
depends on IP_NF_MANGLE || IP6_NF_MANGLE depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This option adds a `DSCP' target, which allows you to manipulate This option adds a `DSCP' target, which allows you to manipulate
@ -896,7 +896,7 @@ config NETFILTER_XT_TARGET_DSCP
config NETFILTER_XT_TARGET_HL config NETFILTER_XT_TARGET_HL
tristate '"HL" hoplimit target support' tristate '"HL" hoplimit target support'
depends on IP_NF_MANGLE || IP6_NF_MANGLE depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This option adds the "HL" (for IPv6) and "TTL" (for IPv4) This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
@ -1080,7 +1080,7 @@ config NETFILTER_XT_TARGET_TPROXY
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
depends on IPV6 || IPV6=n depends on IPV6 || IPV6=n
depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
depends on IP_NF_MANGLE depends on IP_NF_MANGLE || NFT_COMPAT
select NF_DEFRAG_IPV4 select NF_DEFRAG_IPV4
select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
select NF_TPROXY_IPV4 select NF_TPROXY_IPV4
@ -1147,7 +1147,7 @@ config NETFILTER_XT_TARGET_TCPMSS
config NETFILTER_XT_TARGET_TCPOPTSTRIP config NETFILTER_XT_TARGET_TCPOPTSTRIP
tristate '"TCPOPTSTRIP" target support' tristate '"TCPOPTSTRIP" target support'
depends on IP_NF_MANGLE || IP6_NF_MANGLE depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
depends on NETFILTER_ADVANCED depends on NETFILTER_ADVANCED
help help
This option adds a "TCPOPTSTRIP" target, which allows you to strip This option adds a "TCPOPTSTRIP" target, which allows you to strip