diff options
| author | Brett Mastbergen <bmastbergen@untangle.com> | 2018-09-12 15:04:55 -0400 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2018-12-18 11:28:13 +0100 |
| commit | 69d6da1de601eb94285752b0bea44ad4f2381dfe (patch) | |
| tree | 62e535d0fd3456c13508ed4a7e7ce09deb3675f7 /target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch | |
| parent | bbc0c4d9cbfe4f93b759bbf4bb845ad4b72588f1 (diff) | |
| download | upstream-69d6da1de601eb94285752b0bea44ad4f2381dfe.tar.gz upstream-69d6da1de601eb94285752b0bea44ad4f2381dfe.tar.bz2 upstream-69d6da1de601eb94285752b0bea44ad4f2381dfe.zip | |
kernel: generic: Fix nftables inet table breakage
Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup
patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use-
multihook-infrast.patch. That patch switches the netfilter core in the
kernel to use the new native NFPROTO_INET support. Unfortunately, the
new native NFPROTO_INET support does not exist in 4.14 and was not
backported along with this patchset. As such, nftables inet tables never
see any traffic.
As an example the following nft counter rule should increment for every
packet coming into the box, but never will:
nft add table inet foo
nft add chain inet foo bar { type filter hook input priority 0\; }
nft add rule inet foo bar counter
This commit pulls in the required backport patches to add the new
native NFPROTO_INET support, and thus restore nftables inet table
functionality.
Tested on Turris Omnia (mvebu)
Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...")
Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
(backported from f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c)
(rebased patches)
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch')
| -rw-r--r-- | target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch index 2ffb39d9af..5dbd1a4cea 100644 --- a/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch +++ b/target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch @@ -17,7 +17,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h -@@ -274,8 +274,6 @@ struct nf_queue_entry; +@@ -311,8 +311,6 @@ struct nf_queue_entry; struct nf_afinfo { unsigned short family; @@ -26,7 +26,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> int route_key_size; }; -@@ -294,6 +292,7 @@ __sum16 nf_checksum_partial(struct sk_bu +@@ -331,6 +329,7 @@ __sum16 nf_checksum_partial(struct sk_bu u_int8_t protocol, unsigned short family); int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl, bool strict, unsigned short family); @@ -171,7 +171,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/net/netfilter/nf_queue.c +++ b/net/netfilter/nf_queue.c -@@ -250,7 +250,6 @@ void nf_reinject(struct nf_queue_entry * +@@ -266,7 +266,6 @@ void nf_reinject(struct nf_queue_entry * const struct nf_hook_entry *hook_entry; const struct nf_hook_entries *hooks; struct sk_buff *skb = entry->skb; @@ -179,7 +179,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> const struct net *net; unsigned int i; int err; -@@ -277,8 +276,7 @@ void nf_reinject(struct nf_queue_entry * +@@ -293,8 +292,7 @@ void nf_reinject(struct nf_queue_entry * verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state); if (verdict == NF_ACCEPT) { |