From f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Wed, 12 Sep 2018 15:04:55 -0400 Subject: kernel: generic: Fix nftables inet table breakage Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use- multihook-infrast.patch. That patch switches the netfilter core in the kernel to use the new native NFPROTO_INET support. Unfortunately, the new native NFPROTO_INET support does not exist in 4.14 and was not backported along with this patchset. As such, nftables inet tables never see any traffic. As an example the following nft counter rule should increment for every packet coming into the box, but never will: nft add table inet foo nft add chain inet foo bar { type filter hook input priority 0\; } nft add rule inet foo bar counter This commit pulls in the required backport patches to add the new native NFPROTO_INET support, and thus restore nftables inet table functionality. Tested on Turris Omnia (mvebu) Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...") Signed-off-by: Brett Mastbergen --- ....16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch') diff --git a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch index 1b571252b5..21381b7e6b 100644 --- a/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch +++ b/target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch @@ -9,7 +9,7 @@ Signed-off-by: Pablo Neira Ayuso --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h -@@ -274,7 +274,6 @@ struct nf_queue_entry; +@@ -311,7 +311,6 @@ struct nf_queue_entry; struct nf_afinfo { unsigned short family; @@ -48,7 +48,7 @@ Signed-off-by: Pablo Neira Ayuso #include #include #include -@@ -148,9 +150,9 @@ static int __nf_queue(struct sk_buff *sk +@@ -145,9 +147,9 @@ static int __nf_queue(struct sk_buff *sk { int status = -ENOENT; struct nf_queue_entry *entry = NULL; @@ -59,7 +59,7 @@ Signed-off-by: Pablo Neira Ayuso /* QUEUE == DROP if no one is waiting, to be safe. */ qh = rcu_dereference(net->nf.queue_handler); -@@ -159,11 +161,19 @@ static int __nf_queue(struct sk_buff *sk +@@ -156,11 +158,19 @@ static int __nf_queue(struct sk_buff *sk goto err; } @@ -83,7 +83,7 @@ Signed-off-by: Pablo Neira Ayuso if (!entry) { status = -ENOMEM; goto err; -@@ -173,7 +183,7 @@ static int __nf_queue(struct sk_buff *sk +@@ -170,7 +180,7 @@ static int __nf_queue(struct sk_buff *sk .skb = skb, .state = *state, .hook_index = index, -- cgit v1.2.3