[PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Arnd Bergmann]

With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
error when referencing the NF_DUP_IPV6 module:

net/netfilter/xt_TEE.o: In function `tee_tg6':
xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'

The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
that forces NF_DUP_IPV6 to be =m as well rather than setting it
to =y as was intended here. Adding a soft dependency on
IP6_NF_IPTABLES avoids that broken configuration.

Fixes: 35bf1ccecaaa ("netfilter: Kconfig: Change IPv6 select dependencies")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 net/netfilter/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 8aa4883c176a..e42c38c99741 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -985,7 +985,8 @@ config NETFILTER_XT_TARGET_TEE
 	tristate '"TEE" - packet cloning to alternate destination'
 	depends on NETFILTER_ADVANCED
 	depends on IPV6 || IPV6=n
-	depends on !NF_CONNTRACK || NF_CONNTRACK
+	depends on NF_CONNTRACK || !NF_CONNTRACK
+	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
 	select NF_DUP_IPV4
 	select NF_DUP_IPV6 if IP6_NF_IPTABLES
 	---help---
-- 
2.9.0

Re: [PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Pablo Neira Ayuso]

On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote:
> With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
> error when referencing the NF_DUP_IPV6 module:
> 
> net/netfilter/xt_TEE.o: In function `tee_tg6':
> xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'
> 
> The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
> that forces NF_DUP_IPV6 to be =m as well rather than setting it
> to =y as was intended here. Adding a soft dependency on
> IP6_NF_IPTABLES avoids that broken configuration.

Applied to nf.git, thanks Arnd.

Re: [PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Pablo Neira Ayuso]

On Fri, Jul 06, 2018 at 02:45:42PM +0200, Pablo Neira Ayuso wrote:
> On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote:
> > With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
> > error when referencing the NF_DUP_IPV6 module:
> > 
> > net/netfilter/xt_TEE.o: In function `tee_tg6':
> > xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'
> > 
> > The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
> > that forces NF_DUP_IPV6 to be =m as well rather than setting it
> > to =y as was intended here. Adding a soft dependency on
> > IP6_NF_IPTABLES avoids that broken configuration.
> 
> Applied to nf.git, thanks Arnd.

Sorry, let me reconsider.

We many need similar patches to other spots in 35bf1ccecaaa ?

If so, it would be good to fix in the one go.

Thanks!

Re: [PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Arnd Bergmann]

On Fri, Jul 6, 2018 at 2:48 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Jul 06, 2018 at 02:45:42PM +0200, Pablo Neira Ayuso wrote:
>> On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote:
>> > With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
>> > error when referencing the NF_DUP_IPV6 module:
>> >
>> > net/netfilter/xt_TEE.o: In function `tee_tg6':
>> > xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'
>> >
>> > The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
>> > that forces NF_DUP_IPV6 to be =m as well rather than setting it
>> > to =y as was intended here. Adding a soft dependency on
>> > IP6_NF_IPTABLES avoids that broken configuration.
>>
>> Applied to nf.git, thanks Arnd.
>
> Sorry, let me reconsider.
>
> We many need similar patches to other spots in 35bf1ccecaaa ?
>
> If so, it would be good to fix in the one go.

I'm fairly sure that  NETFILTER_XT_TARGET_LOG is safe, since
NF_LOG_IPV6 already depends on IP6_NF_IPTABLES.

NF_SOCKET_IPV6 like NF_DUP_IPV6 does not depend on
IP6_NF_IPTABLES, so we may have a similar problem there, though
I have not come across that. I have done only a few hundred randconfig
builds since I started yesterday, so I may have missed something,
but I think this is safe because CONFIG_NF_SOCKET_IPV6 is
used like a 'bool' symbol these days, we don't actually control building
a module with it, only a small portion in the nft_socket file.

       Arnd

Re: [PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Pablo Neira Ayuso]

On Fri, Jul 06, 2018 at 03:05:13PM +0200, Arnd Bergmann wrote:
> On Fri, Jul 6, 2018 at 2:48 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Fri, Jul 06, 2018 at 02:45:42PM +0200, Pablo Neira Ayuso wrote:
> >> On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote:
> >> > With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
> >> > error when referencing the NF_DUP_IPV6 module:
> >> >
> >> > net/netfilter/xt_TEE.o: In function `tee_tg6':
> >> > xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'
> >> >
> >> > The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
> >> > that forces NF_DUP_IPV6 to be =m as well rather than setting it
> >> > to =y as was intended here. Adding a soft dependency on
> >> > IP6_NF_IPTABLES avoids that broken configuration.
> >>
> >> Applied to nf.git, thanks Arnd.
> >
> > Sorry, let me reconsider.
> >
> > We many need similar patches to other spots in 35bf1ccecaaa ?
> >
> > If so, it would be good to fix in the one go.
> 
> I'm fairly sure that  NETFILTER_XT_TARGET_LOG is safe, since
> NF_LOG_IPV6 already depends on IP6_NF_IPTABLES.
> 
> NF_SOCKET_IPV6 like NF_DUP_IPV6 does not depend on
> IP6_NF_IPTABLES, so we may have a similar problem there, though
> I have not come across that. I have done only a few hundred randconfig
> builds since I started yesterday, so I may have missed something,
> but I think this is safe because CONFIG_NF_SOCKET_IPV6 is
> used like a 'bool' symbol these days, we don't actually control building
> a module with it, only a small portion in the nft_socket file.

Thanks for explaining.

Applied, thanks!

Re: [PATCH net-next] netfilter: fix NETFILTER_XT_TARGET_TEE dependencies

[Arnd Bergmann]

On Fri, Jul 6, 2018 at 5:54 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Jul 06, 2018 at 03:05:13PM +0200, Arnd Bergmann wrote:
>> On Fri, Jul 6, 2018 at 2:48 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> > On Fri, Jul 06, 2018 at 02:45:42PM +0200, Pablo Neira Ayuso wrote:
>> >> On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote:
>> >> > With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link
>> >> > error when referencing the NF_DUP_IPV6 module:
>> >> >
>> >> > net/netfilter/xt_TEE.o: In function `tee_tg6':
>> >> > xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6'
>> >> >
>> >> > The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES'
>> >> > that forces NF_DUP_IPV6 to be =m as well rather than setting it
>> >> > to =y as was intended here. Adding a soft dependency on
>> >> > IP6_NF_IPTABLES avoids that broken configuration.
>> >>
>> >> Applied to nf.git, thanks Arnd.
>> >
>> > Sorry, let me reconsider.
>> >
>> > We many need similar patches to other spots in 35bf1ccecaaa ?
>> >
>> > If so, it would be good to fix in the one go.
>>
>> I'm fairly sure that  NETFILTER_XT_TARGET_LOG is safe, since
>> NF_LOG_IPV6 already depends on IP6_NF_IPTABLES.
>>
>> NF_SOCKET_IPV6 like NF_DUP_IPV6 does not depend on
>> IP6_NF_IPTABLES, so we may have a similar problem there, though
>> I have not come across that. I have done only a few hundred randconfig
>> builds since I started yesterday, so I may have missed something,
>> but I think this is safe because CONFIG_NF_SOCKET_IPV6 is
>> used like a 'bool' symbol these days, we don't actually control building
>> a module with it, only a small portion in the nft_socket file.
>
> Thanks for explaining.

Unfortunately I came across a related build error that my patch failed
to address. I've sent another patch for that one. Feel free to fold it
into my first patch in case you rebased before you forward the patches
to net-next.

      Arnd