kernel: generic: Fix nftables inet table breakage
authorBrett Mastbergen <bmastbergen@untangle.com>
Wed, 12 Sep 2018 19:04:55 +0000 (15:04 -0400)
committerJo-Philipp Wich <jo@mein.io>
Tue, 18 Dec 2018 10:28:13 +0000 (11:28 +0100)
commit69d6da1de601eb94285752b0bea44ad4f2381dfe
tree62e535d0fd3456c13508ed4a7e7ce09deb3675f7
parentbbc0c4d9cbfe4f93b759bbf4bb845ad4b72588f1
kernel: generic: Fix nftables inet table breakage

Commit b7265c59ab7d ("kernel: backport a series of netfilter cleanup
patches to 4.14") added patch 302-netfilter-nf_tables_inet-don-t-use-
multihook-infrast.patch.  That patch switches the netfilter core in the
kernel to use the new native NFPROTO_INET support.  Unfortunately, the
new native NFPROTO_INET support does not exist in 4.14 and was not
backported along with this patchset.  As such, nftables inet tables never
see any traffic.

As an example the following nft counter rule should increment for every
packet coming into the box, but never will:

nft add table inet foo
nft add chain inet foo bar { type filter hook input priority 0\; }
nft add rule inet foo bar counter

This commit pulls in the required backport patches to add the new
native NFPROTO_INET support, and thus restore nftables inet table
functionality.

Tested on Turris Omnia (mvebu)

Fixes: b7265c59ab7d ("kernel: backport a series of netfilter cleanup ...")
Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
(backported from f57806b56e5f6ca7bb9fb66d5b175b5f98ece93c)
(rebased patches)
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
31 files changed:
target/linux/generic/backport-4.14/290-v4.16-netfilter-core-make-nf_unregister_net_hooks-simple-w.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/291-v4.16-netfilter-core-remove-synchronize_net-call-if-nfqueu.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/292-v4.16-netfilter-core-free-hooks-with-call_rcu.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/294-v4.16-netfilter-reduce-hook-array-sizes-to-what-is-needed.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/295-v4.16-netfilter-don-t-allocate-space-for-decnet-hooks-unle.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/296-v4.16-netfilter-don-t-allocate-space-for-arp-bridge-hooks-.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/297-v4.16-netfilter-core-pass-hook-number-family-and-device-to.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/298-v4.16-netfilter-core-add-nf_remove_net_hook.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/298-v4.16-netfilter-core-pass-family-as-parameter-to-nf_remove.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/299-v4.16-netfilter-core-support-for-NFPROTO_INET-hook-registr.patch [new file with mode: 0644]
target/linux/generic/backport-4.14/301-v4.16-netfilter-core-only-allow-one-nat-hook-per-hook-poin.patch
target/linux/generic/backport-4.14/304-v4.16-netfilter-move-checksum-indirection-to-struct-nf_ipv.patch
target/linux/generic/backport-4.14/305-v4.16-netfilter-move-checksum_partial-indirection-to-struc.patch
target/linux/generic/backport-4.14/306-v4.16-netfilter-remove-saveroute-indirection-in-struct-nf_.patch
target/linux/generic/backport-4.14/307-v4.16-netfilter-move-route-indirection-to-struct-nf_ipv6_o.patch
target/linux/generic/backport-4.14/308-v4.16-netfilter-move-reroute-indirection-to-struct-nf_ipv6.patch
target/linux/generic/backport-4.14/309-v4.16-netfilter-remove-route_key_size-field-in-struct-nf_a.patch
target/linux/generic/backport-4.14/310-v4.16-netfilter-remove-struct-nf_afinfo-and-its-helper-fun.patch
target/linux/generic/backport-4.14/322-v4.16-netfilter-add-generic-flow-table-infrastructure.patch
target/linux/generic/backport-4.14/323-v4.16-netfilter-flow-table-support-for-IPv4.patch
target/linux/generic/backport-4.14/325-v4.16-netfilter-flow-table-support-for-the-mixed-IPv4-IPv6.patch
target/linux/generic/backport-4.14/326-v4.16-netfilter-nf_tables-flow-offload-expression.patch
target/linux/generic/backport-4.14/329-v4.16-netfilter-improve-flow-table-Kconfig-dependencies.patch
target/linux/generic/backport-4.14/336-v4.15-netfilter-exit_net-cleanup-check-added.patch
target/linux/generic/backport-4.14/346-v4.16-netfilter-flowtable-infrastructure-depends-on-NETFIL.patch
target/linux/generic/backport-4.14/356-v4.18-netfilter-nf_flow_table-relax-mixed-ipv4-ipv6-flowta.patch
target/linux/generic/hack-4.14/250-netfilter_depends.patch
target/linux/generic/hack-4.14/251-sound_kconfig.patch
target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch
target/linux/generic/pending-4.14/640-netfilter-nf_flow_table-add-hardware-offload-support.patch