[PATCH] netfilter: Fix build for NETFILTER_XT_TARGET_REDIRECT

[PATCH] netfilter: Fix build for NETFILTER_XT_TARGET_REDIRECT

[Guenter Roeck]

Fix:

ERROR: "nf_nat_redirect_ipv6" [net/netfilter/xt_REDIRECT.ko] undefined!

Seen if NETFILTER_XT_TARGET_REDIRECT is configured but NF_NAT_IPV6
is not, since code compiled with NF_NAT_REDIRECT_IPV6 is used
unconditionally by code enabled with NETFILTER_XT_TARGET_REDIRECT.
This means that NETFILTER_XT_TARGET_REDIRECT depends on NF_NAT_IPV6
and must always select NF_NAT_REDIRECT_IPV6.

Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
Seen in and applies to -next. See various qemu test failures
reported at http://server.roeck-us.net:8010/builders,

 net/netfilter/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 57f15a9..2134ef0 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -843,9 +843,9 @@ config NETFILTER_XT_TARGET_RATEEST
 
 config NETFILTER_XT_TARGET_REDIRECT
 	tristate "REDIRECT target support"
-	depends on NF_NAT
+	depends on NF_NAT && NF_NAT_IPV6
 	select NF_NAT_REDIRECT_IPV4 if NF_NAT_IPV4
-	select NF_NAT_REDIRECT_IPV6 if NF_NAT_IPV6
+	select NF_NAT_REDIRECT_IPV6
 	---help---
 	REDIRECT is a special case of NAT: all incoming connections are
 	mapped onto the incoming interface's address, causing the packets to
-- 
1.9.1

Re: [PATCH] netfilter: Fix build for NETFILTER_XT_TARGET_REDIRECT

[Pablo Neira Ayuso]

On Sat, Dec 06, 2014 at 01:41:59AM -0800, Guenter Roeck wrote:
> Fix:
> 
> ERROR: "nf_nat_redirect_ipv6" [net/netfilter/xt_REDIRECT.ko] undefined!
> 
> Seen if NETFILTER_XT_TARGET_REDIRECT is configured but NF_NAT_IPV6
> is not, since code compiled with NF_NAT_REDIRECT_IPV6 is used
> unconditionally by code enabled with NETFILTER_XT_TARGET_REDIRECT.
> This means that NETFILTER_XT_TARGET_REDIRECT depends on NF_NAT_IPV6
> and must always select NF_NAT_REDIRECT_IPV6.

Thanks for your patch. However, we decided to resolve this by
combining nf_reject_ipv4 and nf_reject_ipv6.

See b59eaf9 ("netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one
module").

Let us know if you still hit problems after that patch. Thanks.