domenico/openwrt_NSS_ACW
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: generic: Fix nftables inet table breakage

Browse Source 
Commit b7265c59ab ("kernel: backport a series of netfilter cleanup
patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use-
multihook-infrast.patch.  That patch switches the netfilter core in the
kernel to use the new native NFPROTO_INET support.  Unfortunately, the
new native NFPROTO_INET support does not exist in 4.14 and was not
backported along with this patchset.  As such, nftables inet tables never
see any traffic.

As an example the following nft counter rule should increment for every
packet coming into the box, but never will:

nft add table inet foo
nft add chain inet foo bar { type filter hook input priority 0\; }
nft add rule inet foo bar counter

This commit pulls in the required backport patches to add the new
native NFPROTO_INET support, and thus restore nftables inet table
functionality.

Tested on Turris Omnia (mvebu)

Fixes: b7265c59ab ("kernel: backport a series of netfilter cleanup ...")
Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
This commit is contained in:
Brett Mastbergen
2018-09-12 15:04:55 -04:00
committed by Hauke Mehrtens
parent d3a492c72f
commit f57806b56e
31 changed files with 1230 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
target/linux/generic/hack-4.14/250-netfilter_depends.patch
View File

@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -223,7 +223,6 @@ config NF_CONNTRACK_FTP
@@ -229,7 +229,6 @@ config NF_CONNTRACK_FTP
config NF_CONNTRACK_H323
tristate "H.323 protocol support"
@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
depends on NETFILTER_ADVANCED
help
H.323 is a VoIP signalling protocol from ITU-T. As one of the most
@@ -1046,7 +1045,6 @@ config NETFILTER_XT_TARGET_SECMARK
@@ -1052,7 +1051,6 @@ config NETFILTER_XT_TARGET_SECMARK
config NETFILTER_XT_TARGET_TCPMSS
tristate '"TCPMSS" target support'

4
target/linux/generic/hack-4.14/251-sound_kconfig.patch
View File

@@ -122,8 +122,8 @@ Signed-off-by: John Crispin <john@phrozen.org>
- tristate
+ tristate "Netfilter NFNETLINK interface"
config NETFILTER_NETLINK_ACCT
tristate "Netfilter NFACCT over NFNETLINK interface"
config NETFILTER_FAMILY_BRIDGE
bool
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,5 +1,5 @@

10
target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch
View File

@@ -8,7 +8,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -75,8 +75,6 @@ config NF_TABLES_ARP
@@ -76,8 +76,6 @@ config NF_TABLES_ARP
help
This option enables the ARP support for nf_tables.
@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
config NF_FLOW_TABLE_IPV4
tristate "Netfilter flow table IPv4 module"
depends on NF_FLOW_TABLE
@@ -85,6 +83,8 @@ config NF_FLOW_TABLE_IPV4
@@ -86,6 +84,8 @@ config NF_FLOW_TABLE_IPV4
To compile it as a module, choose M here.
@@ -47,7 +47,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
depends on !NF_CONNTRACK || NF_CONNTRACK
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -665,8 +665,6 @@ config NFT_FIB_NETDEV
@@ -671,8 +671,6 @@ config NFT_FIB_NETDEV
endif # NF_TABLES_NETDEV
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
config NF_FLOW_TABLE_INET
tristate "Netfilter flow table mixed IPv4/IPv6 module"
depends on NF_FLOW_TABLE
@@ -675,11 +673,12 @@ config NF_FLOW_TABLE_INET
@@ -681,11 +679,12 @@ config NF_FLOW_TABLE_INET
To compile it as a module, choose M here.
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
help
This option adds the flow table core infrastructure.
@@ -968,6 +967,15 @@ config NETFILTER_XT_TARGET_NOTRACK
@@ -974,6 +973,15 @@ config NETFILTER_XT_TARGET_NOTRACK
depends on NETFILTER_ADVANCED
select NETFILTER_XT_TARGET_CT