• Arnd Bergmann's avatar
    netfilter: tee: select NF_DUP_IPV6 unconditionally · 08a7f5d3
    Arnd Bergmann authored
    The NETFILTER_XT_TARGET_TEE option selects NF_DUP_IPV6 whenever
    IP6_NF_IPTABLES is enabled, and it ensures that it cannot be
    builtin itself if NF_CONNTRACK is a loadable module, as that
    is a dependency for NF_DUP_IPV6.
    
    However, NF_DUP_IPV6 can be enabled even if IP6_NF_IPTABLES is
    turned off, and it only really depends on IPV6. With the current
    check in tee_tg6, we call nf_dup_ipv6() whenever NF_DUP_IPV6
    is enabled. This can however be a loadable module which is
    unreachable from a built-in xt_TEE:
    
    net/built-in.o: In function `tee_tg6':
    :(.text+0x67728): undefined reference to `nf_dup_ipv6'
    
    The bug was originally introduced in the split of the xt_TEE module
    into separate modules for ipv4 and ipv6, and two patches tried
    to fix it unsuccessfully afterwards.
    
    This is a revert of the the first incorrect attempt to fix it,
    going back to depending on IPV6 as the dependency, and we
    adapt the 'select' condition accordingly.
    Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
    Fixes: bbde9fc1 ("netfilter: factor out packet duplication for IPv4/IPv6")
    Fixes: 116984a3 ("netfilter: xt_TEE: use IS_ENABLED(CONFIG_NF_DUP_IPV6)")
    Fixes: 74ec4d55 ("netfilter: fix xt_TEE and xt_TPROXY dependencies")
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    08a7f5d3
Kconfig 48.1 KB