linux-stable.git/net/netfilter/Kconfig, branch linux-3.7.y

netfilter: fix missing dependencies for the NOTRACK target

2013-02-04T00:27:07+00:00

commit 757ae316fb35811cfd8c67de0e0b8680ec4c1f37 upstream.

warning: (NETFILTER_XT_TARGET_NOTRACK) selects NETFILTER_XT_TARGET_CT which has unmet direct
+dependencies (NET && INET && NETFILTER && NETFILTER_XTABLES && NF_CONNTRACK && (IP_NF_RAW ||
+IP6_NF_RAW) && NETFILTER_ADVANCED)

Reported-by: Randy Dunlap 
Reported-by: kbuild test robot 
Acked-by: Randy Dunlap 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: xt_CT: recover NOTRACK target support

2013-02-04T00:27:07+00:00

commit 10db9069eb5c60195170a4119bdbcbce69a4945f upstream.

Florian Westphal reported that the removal of the NOTRACK target
(9655050 netfilter: remove xt_NOTRACK) is breaking some existing
setups.

That removal was scheduled for removal since long time ago as
described in Documentation/feature-removal-schedule.txt

What:  xt_NOTRACK
Files: net/netfilter/xt_NOTRACK.c
When:  April 2011
Why:   Superseded by xt_CT

Still, people may have not notice / may have decided to stick to an
old iptables version. I agree with him in that some more conservative
approach by spotting some printk to warn users for some time is less
agressive.

Current iptables 1.4.16.3 already contains the aliasing support
that makes it point to the CT target, so upgrading would fix it.
Still, the policy so far has been to avoid pushing our users to
upgrade.

As a solution, this patch recovers the NOTRACK target inside the CT
target and it now spots a warning.

Reported-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Greg Kroah-Hartman

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT

2012-09-21T10:12:05+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_REDIRECT becomes a compat option; IP6_NF_TARGET_REDIRECT
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: combine ipt_NETMAP and ip6t_NETMAP

2012-09-21T10:11:08+00:00

Combine more modules since the actual code is so small anyway that the
kmod metadata and the module in its loaded state totally outweighs the
combined actual code size.

IP_NF_TARGET_NETMAP becomes a compat option; IP6_NF_TARGET_NETMAP
is completely eliminated since it has not see a release yet.

Signed-off-by: Jan Engelhardt 
Acked-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

netfilter: remove xt_NOTRACK

2012-09-03T11:36:40+00:00

It was scheduled to be removed for a long time.

Cc: Pablo Neira Ayuso 
Cc: Patrick McHardy 
Cc: "David S. Miller" 
Cc: netfilter@vger.kernel.org
Signed-off-by: Cong Wang 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat: support IPv6 in TFTP NAT helper

2012-08-30T01:00:24+00:00

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in IRC NAT helper

2012-08-30T01:00:23+00:00

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in SIP NAT helper

2012-08-30T01:00:22+00:00

Add IPv6 support to the SIP NAT helper. There are no functional differences
to IPv4 NAT, just different formats for addresses.

Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in amanda NAT helper

2012-08-30T01:00:21+00:00

Signed-off-by: Patrick McHardy

netfilter: nf_nat: support IPv6 in FTP NAT helper

2012-08-30T01:00:20+00:00

Signed-off-by: Patrick McHardy