diff options
| author | Brett Mastbergen <bmastbergen@untangle.com> | 2018-09-12 15:04:55 -0400 |
|---|---|---|
| committer | Hauke Mehrtens <hauke@hauke-m.de> | 2018-09-22 21:20:55 +0200 |
| commit | f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c (patch) | |
| tree | a852fcd9ee8d2a1746baff1b4a8e8f07501d8e91 /target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch | |
| parent | d3a492c72f15ecf8debe56a3ee35eb213c9d9bcc (diff) | |
| download | upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.tar.gz upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.tar.bz2 upstream-f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c.zip | |
kernel: generic: Fix nftables inet table breakage
Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup
patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use-
multihook-infrast.patch. That patch switches the netfilter core in the
kernel to use the new native NFPROTO_INET support. Unfortunately, the
new native NFPROTO_INET support does not exist in 4.14 and was not
backported along with this patchset. As such, nftables inet tables never
see any traffic.
As an example the following nft counter rule should increment for every
packet coming into the box, but never will:
nft add table inet foo
nft add chain inet foo bar { type filter hook input priority 0\; }
nft add rule inet foo bar counter
This commit pulls in the required backport patches to add the new
native NFPROTO_INET support, and thus restore nftables inet table
functionality.
Tested on Turris Omnia (mvebu)
Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...")
Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
Diffstat (limited to 'target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch')
| -rw-r--r-- | target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch b/target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch index 162086e340..bb8c2d3e5a 100644 --- a/target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch +++ b/target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch @@ -25,7 +25,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig -@@ -79,8 +79,7 @@ endif # NF_TABLES +@@ -80,8 +80,7 @@ endif # NF_TABLES config NF_FLOW_TABLE_IPV4 tristate "Netfilter flow table IPv4 module" @@ -49,7 +49,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig -@@ -670,8 +670,8 @@ endif # NF_TABLES +@@ -676,8 +676,8 @@ endif # NF_TABLES config NF_FLOW_TABLE_INET tristate "Netfilter flow table mixed IPv4/IPv6 module" @@ -60,7 +60,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> help This option adds the flow table mixed IPv4/IPv6 support. -@@ -679,7 +679,9 @@ config NF_FLOW_TABLE_INET +@@ -685,7 +685,9 @@ config NF_FLOW_TABLE_INET config NF_FLOW_TABLE tristate "Netfilter flow table module" |