From patchwork Tue Nov 10 12:22:15 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 542263 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 989901413B9 for ; Tue, 10 Nov 2015 23:24:46 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752650AbbKJMW6 (ORCPT ); Tue, 10 Nov 2015 07:22:58 -0500 Received: from mout.kundenserver.de ([212.227.126.130]:52798 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751042AbbKJMW4 (ORCPT ); Tue, 10 Nov 2015 07:22:56 -0500 Received: from wuerfel.localnet ([134.3.118.24]) by mrelayeu.kundenserver.de (mreue001) with ESMTPSA (Nemesis) id 0M7hAG-1aHw8x47SC-00vMYK; Tue, 10 Nov 2015 13:22:20 +0100 From: Arnd Bergmann To: Pablo Neira Ayuso Cc: Patrick McHardy , Jozsef Kadlecsik , "David S. Miller" , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] netfilter: fix xt_TEE and xt_TPROXY dependencies Date: Tue, 10 Nov 2015 13:22:15 +0100 Message-ID: <8068952.JJURCanWFy@wuerfel> User-Agent: KMail/4.11.5 (Linux/3.16.0-10-generic; KDE/4.11.5; x86_64; ; ) MIME-Version: 1.0 X-Provags-ID: V03:K0:Fp772TdKY4mR5qSJUt+T0h7Kw+s1Gf1bwwiOanFI713/FtUOiDX GXcTBvUYZSCL0vunqFjLu1xltkt4W62FYuwUEygDz1QbWlyQ231A86azeiE+tPEQCXM8Ri3 VP+o8WDNHIW7rseruWDVrmr9LSKJNt+9po/YGiYgemRfwzzj0N6qwmBzLsfrTWEJI9vRLbL x8pyWHnBP0WCBVME0chWg== X-UI-Out-Filterresults: notjunk:1; V01:K0:iQofPVY4JnY=:ekZ0TouwbktyNkWH8s2neW S/rmpl0sTDEvf2qPBLQQjoiXIkJ2H1q65ElqJAK3I1BjEPZgo/1jwl8fzDbq9aeAtBhybR2fz eeAWKfo4YJ04mOXcyV0TdlDCT6eGeK+JCbGr5BO3UEedx+tIPo10FekZpBG1bFJ1ixAI0buKJ 9kGohxD9/yf/sI73zCAZK7aqKe2P7sDPFDyWfFnPU9dw1C2C2gTtZ2KULt+rrBGmI8aeO24kt 6GYBCjw8af1GhjKfsv3UAiK3hkmdVtSInudHhYCH/yPrd00ARDNtZ+0b/gV1MzTkqXgzd519X Yq3VlBs4ZlkjkYlO3NHHLdPPlga56RBAdNCwilu+a6Ih5RvXpTEB8MxZHt0qB3SOD0t2RRxPu MDT/U33NVd1kAIy7UupVdAP6UOXPqUGFPXF8g6+RCMSXg/PmXqCpIytMWVyX1kW608TjCDZbA MF2u6pFDN3dhTY/sn1yQ3+80YsKDF35m0yS08PBn2FjFrebPi4Ff7hDaelNhRF5EII8NUymnV 1R19KVdSqK1RxDjgS2McYlWZC/1xzNJOYy6BgOYBku2F1ArQD7tghd5KS++a3dvK5gaJFJ858 CoFZ2nNIWvudnXwn40cquAFFX4vAmlNHah4Xi4qha9Rvs+qZTvyp8oSe7CZ20WOjf2oXx/i2/ 2YAKlxwPMw/JjEdKH6O+S3L4RZu3EvzgJUTjwX5Isl1DKBJAbPhRov/KW7QA5nw1aFkQ5Rn1U 4LyJe//U5G4cpIon Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Kconfig is too smart for its own good: a Kconfig line that states select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES means that if IP6_NF_IPTABLES is set to 'm', then NF_DEFRAG_IPV6 will also be set to 'm', regardless of the state of the symbol from which it is selected. When the xt_TEE driver is built-in and nothing else forces NF_DEFRAG_IPV6 to be built-in, this causes a link-time error: net/built-in.o: In function `tee_tg6': net/netfilter/xt_TEE.c:46: undefined reference to `nf_dup_ipv6' This works around that behavior by changing the dependency to 'if IP6_NF_IPTABLES != n', which is interpreted as boolean expression rather than a tristate and causes the NF_DEFRAG_IPV6 symbol to be built-in as well. The bug only occurs once in thousands of 'randconfig' builds and does not really impact real users. From inspecting the other surrounding Kconfig symbols, I am guessing that NETFILTER_XT_TARGET_TPROXY and NETFILTER_XT_MATCH_SOCKET have the same issue. If not, this change should still be harmless. Signed-off-by: Arnd Bergmann --- I have done a few thousand randconfig builds with this applied, and the problem did not come back, but it is super-rare. Several people have tried to fix this in the past, but so far every patch was wrong. Maybe this one is lucky. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index e22349ea7256..4692782b5280 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -869,7 +869,7 @@ config NETFILTER_XT_TARGET_TEE depends on IPV6 || IPV6=n depends on !NF_CONNTRACK || NF_CONNTRACK select NF_DUP_IPV4 - select NF_DUP_IPV6 if IP6_NF_IPTABLES + select NF_DUP_IPV6 if IP6_NF_IPTABLES != n ---help--- This option adds a "TEE" target with which a packet can be cloned and this clone be rerouted to another nexthop. @@ -882,7 +882,7 @@ config NETFILTER_XT_TARGET_TPROXY depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n depends on IP_NF_MANGLE select NF_DEFRAG_IPV4 - select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES + select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n help This option adds a `TPROXY' target, which is somewhat similar to REDIRECT. It can only be used in the mangle table and is useful @@ -1375,7 +1375,7 @@ config NETFILTER_XT_MATCH_SOCKET depends on IPV6 || IPV6=n depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n select NF_DEFRAG_IPV4 - select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES + select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n help This option adds a `socket' match, which can be used to match packets for which a TCP or UDP socket lookup finds a valid socket.