REJECT for 2.6.9+

Because include/linux/netfilter_ipv6/ip6t_REJECT.h was removed in 2.6.9, the pom-ng module REJECT does not apply anymore. So this patch adds a 2.6.9 branch which is identical to 2.6 except the .h file is added.

The empty patch file is there so that the original patch won't be attempted.

- xkr47

Index: pom/REJECT/linux-2.6.9.patch
===================================================================

Index: pom/REJECT/linux-2.6.9/include/linux/netfilter_ipv6/ip6t_REJECT.h
===================================================================
@@ -0,0 +1,18 @@
+#ifndef _IP6T_REJECT_H
+#define _IP6T_REJECT_H
+
+enum ip6t_reject_with {
+	IP6T_ICMP6_NO_ROUTE,
+	IP6T_ICMP6_ADM_PROHIBITED,
+	IP6T_ICMP6_NOT_NEIGHBOUR,
+	IP6T_ICMP6_ADDR_UNREACH,
+	IP6T_ICMP6_PORT_UNREACH,
+	IP6T_ICMP6_ECHOREPLY,
+	IP6T_TCP_RESET
+};
+
+struct ip6t_reject_info {
+	enum ip6t_reject_with with;      /* reject type */
+};
+
+#endif /*_IP6T_REJECT_H*/

Index: pom/REJECT/linux-2.6.9/net/ipv6/netfilter/Kconfig.ladd
===================================================================
@@ -0,0 +1,10 @@
+config IP6_NF_TARGET_REJECT
+	tristate  'REJECT target support'
+	depends on IP6_NF_FILTER
+	help
+	  The REJECT target allows a filtering rule to specify that an ICMPv6
+	  error should be issued in response to an incoming packet, rather
+	  than silently being dropped.
+	
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  If unsure, say `N'.

Retry; enigmail produced a badly signed mail.. :/

- xkr47

(enigmail temporary hack to make mail 8-bit: åäö)

Index: pom/REJECT/linux-2.6.9.patch
===================================================================

Index: pom/REJECT/linux-2.6.9/include/linux/netfilter_ipv6/ip6t_REJECT.h
===================================================================
@@ -0,0 +1,18 @@
+#ifndef _IP6T_REJECT_H
+#define _IP6T_REJECT_H
+
+enum ip6t_reject_with {
+	IP6T_ICMP6_NO_ROUTE,
+	IP6T_ICMP6_ADM_PROHIBITED,
+	IP6T_ICMP6_NOT_NEIGHBOUR,
+	IP6T_ICMP6_ADDR_UNREACH,
+	IP6T_ICMP6_PORT_UNREACH,
+	IP6T_ICMP6_ECHOREPLY,
+	IP6T_TCP_RESET
+};
+
+struct ip6t_reject_info {
+	enum ip6t_reject_with with;      /* reject type */
+};
+
+#endif /*_IP6T_REJECT_H*/

Index: pom/REJECT/linux-2.6.9/net/ipv6/netfilter/Kconfig.ladd
===================================================================
@@ -0,0 +1,10 @@
+config IP6_NF_TARGET_REJECT
+	tristate  'REJECT target support'
+	depends on IP6_NF_FILTER
+	help
+	  The REJECT target allows a filtering rule to specify that an ICMPv6
+	  error should be issued in response to an incoming packet, rather
+	  than silently being dropped.
+	
+	  If you want to compile it as a module, say M here and read
+	  Documentation/modules.txt.  If unsure, say `N'.

Hi

I have tried to build libctnetlink I have got the current version using svn
as there is no README i do not know how to build it. I had a look around and thought by running ltmain compile should work. But I am just poking around in the dark. I realize it is pre release but I would like to contribute where possible. Can someone point me off in the right direction.

Thanks
Danke
TchuB

Aside -------
Also note svn from the website link does not work svn replies unknown URL instead use http rather than https

You can access the <a>Subversion</a> server in two ways. For casual browsing, you can use the ViewCVS web interface. To grab the latest sources, you can do the following:

* Check out the iptables code using:
svn co https://svn.netfilter.org/netfilter/trunk/iptables

Is it possible the libctnetlink is missing the configure script ?

just type autoconf and it will generate it.

--
Pablo

Hi
Thanks but when I run autoconf it creates the configure script then
when I run configure it says

creating libtool
configure: creating ./config.status config.status: creating Makefile
config.status: error: cannot find input file: Makefile.in

Version
autoconf -V
autoconf (GNU Autoconf) 2.57

Any ideas ?

Thanks

yes, type automake before.

--
Pablo

I am still trying to compile libctnetlink and libnfnetlink I cannot find a whole lot of info on it. I have 2 questions

When I try compile
I get the error
libctnetlink.c:32:39 linux/nfnetlink_conntrack.h: No such file or directory

Is there a second lib I am missing ? I have looked around and see only a reference to old-nfnetlink

Secondly
Because this should be in linux/* this tells me that it may belong to an older kernel or something that is now deprecated, is that so ? I am trying to compile on 2.6.10

Thanks

Have you applied `nfnetlink-ctnetlink-0.13' in pom-ng? Add -I/your/kernel/include/path to your compilation script.

Unfortunately that won't work with your current kernel, AFAIK those patches work fine for most 2.4.x releases. Anyhow I'm currently working on porting them to 2.6.11 so you could wait until I post them in the mailing list.

--
Pablo

Thanks for the tip Pablo; probably a case of user error; but:

When I try to apply nfnetlink-ctnetlink-0.13 from the latest pom-ng (20050403), I am told:

nfnetlink-ctnetlink-0.13 has dependency on ctstat, but ctstat is not known cannot apply (9 rejects out of 42 hunks)

As far as I can tell ctstats was added to pom-ng in around September 2004 time. There is a ctstat folder in my un-tar'd pom-ng, but it is empty.

I'm running patch-o-matic against iptables 1.2.11 and kernel 2.6.10 source.

Sam

So after much looking, for my part, according to section 6.2 of the 2004 workshop summary at http://www.netfilter.org/documentation/conferences/nf-workshop-2004-summary.html
ctstat has already been merged with... with....

and there you have it.

I can't tell if ctstat has been merged with any particular kernel version or any particular iptables version or both.

This file, http://people.netfilter.org/gandalf/old/ctstat/ctstat-040215-2.6, hints that ctstat may have been merged with kernel 2.6

So assuming that you do have ctstat merged somehow (and ct_cpu_seq_show() seems to be defined in ip_conntrack_standalone.c on 2.6.10), edit nfnetlink-ctnetlink-0.13/info and remove the dependancy on ctstat and then apply with
... ... ./runme --batch nfnetlink-ctnetlink-0.13

You'll still get a failure to apply though, which I'm looking into. I'll post back when I find out more, I'm going to try it on 2.6.11 and then look at the rejects more closely if that doesn't work.

Amin

as Soon as my linux 2.6.11.6 source downloaded I tried:
IPTABLES_DIR=../iptables-1.2.11/ KERNEL_DIR=../linux-2.6.11.6 ./runme --batch nfnetlink-ctnetlink-0.13

But it just says:

unable to find ladd slot in src ../linux-2.6.11.6/include/linux/netfilter_ipv4/ip_conntrack.h (./nfnetlink-ctnetlink-0.13/li)----------------------------------------------------------------- Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?]

I dont know what a ladd slot is (OK, its a line-add slot, but I still don't know what it is) but I'll take this to mean the patch was for 2.6.10

The rejected hunks have thinks like:
#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
struct notifier_block *ip_conntrack_chain;
#endif /* CONFIG_IP_NF_CONNTRACK_EVENTS */

in, which makes it look like ct-event is needed, perhaps such as pablo posted on 28/03/05 for kernel 2.6.11

I'll take this up on the "[PATCH] ct-event API port to 2.6.11" thread.

Amin

Amin nar nin buzee, as ta den feB. Av ni no bin 2.6.12 kez nip obou avayop armal nupiy wen karsanel.

CONFIG_IP_NF_CONNTRACK_EVENTS=y

Niki wen swe ning.

Sound as my lovely dad, you do.

On reflection, netfilter patches against specific kernels are likely to require it as a minimum version to patch against, I mean there is more likelyhood that a patch will patch against the next kernel revision than
the previous kernel revision, so yeah, it may mean a skip up to
2.6.12, if that has ct-event in it

agghh!

thanks

Amin

Or use autoreconf, which seems to be the magic-du-jour to generate all the necessary bits.

Wichert.

Wichert Akkerman <[email protected]>    It is simple to make things.
http://www.wiggy.net/                   It is hard to make things simple.

This seems to be a bug in python, which is used by mailman, which is used by netfilter-devel.

http://sourceforge.net/tracker/index.php?func=detail&aid=968430&group_id=5470&atid=105470

And there seems to be no activity on the bug :P

- xkr47

Why add a new branch instead of simply restoring that file? Even better, I think I'm simply going to submit the IPv6 REJECT target of nobody objects.

Regards
Patrick

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patrick McHardy wrote:

|> The empty patch file is there so that the original patch won't be
|> attempted.
|
| Why add a new branch instead of simply restoring that file?

Maybe I have not understood the pom-ng functionality correctly/fully. I thought that plain files in the tree must not exist already and so I thought I needed to keep the old branch for the <=2.6.8 kernels that still have the file that was deleted in 2.6.9..

| Even better, I think I'm simply going to submit the IPv6 | REJECT target of nobody objects.

No objections here :)

- --
- - xkr47
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCPzPWxyF48ZTvn+4RAo2ZAJ9RUpp6LzOk2J6vT38QCfulSLODCQCfeu83 m2JTEwyTHKe4iZwPrfkeaiI=
=3VtI
-----END PGP SIGNATURE-----

Hi,

From: Patrick McHardy <[email protected]>
Date: Sun, 20 Mar 2005 17:15:16 +0100

I have some thoughts.

I wrote ip6t_REJECT so that the source address of ICMPv6 error was destination address of original packet. Because of this behavior, send_unreach could not use icmpv6_send().
But now I have found that the behavior of ipt_REJECT is different. The source address of ICMP error is its node. I think the behavior of them should be same. Moreover, ipt_REJECT has changed to use icmp_send() recently.

Then I think ip6t_REJECT can use icmpv6_send() like ipt_REJECT. Please consider applying attached patch to REJECT in pom-ng.

Regards,
-----------------------------------------------------------------
Yasuyuki KOZAKAI @ USAGI Project <[email protected]>

diff -Nur -x.svn REJECT/linux-2.4.patch REJECT-changed/linux-2.4.patch
@@ -0,0 +1,28 @@
+diff -Nru linux-2.4.0-test8-ipv6updates/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.4.0-test8-REJECTv6/include/linux/netfilter_ipv6/ip6t_REJECT.h
+--- linux-2.4.0-test8-ipv6updates/include/linux/netfilter_ipv6/ip6t_REJECT.h	Sun Nov 12 13:40:30 2000
++++ linux-2.4.0-test8-REJECTv6/include/linux/netfilter_ipv6/ip6t_REJECT.h	Sun Nov 12 13:38:25 2000
+@@ -2,15 +2,17 @@
+ #define _IP6T_REJECT_H
+ 
+ enum ip6t_reject_with {
+-	IP6T_ICMP_NET_UNREACHABLE,
+-	IP6T_ICMP_HOST_UNREACHABLE,
+-	IP6T_ICMP_PROT_UNREACHABLE,
+-	IP6T_ICMP_PORT_UNREACHABLE,
+-	IP6T_ICMP_ECHOREPLY
++	IP6T_ICMP6_NO_ROUTE,
++	IP6T_ICMP6_ADM_PROHIBITED,
++	IP6T_ICMP6_NOT_NEIGHBOUR,
++	IP6T_ICMP6_ADDR_UNREACH,
++	IP6T_ICMP6_PORT_UNREACH,
++	IP6T_ICMP6_ECHOREPLY,
++	IP6T_TCP_RESET
+ };
+ 
+ struct ip6t_reject_info {
+ 	enum ip6t_reject_with with;      /* reject type */
+ };
+ 
+-#endif /*_IPT_REJECT_H*/
++#endif /*_IP6T_REJECT_H*/
+

diff -Nur -x.svn REJECT/linux-2.6/include/linux/netfilter_ipv6/ip6t_REJECT.h REJECT-changed/linux-2.6/include/linux/netfilter_ipv6/ip6t_REJECT.h
@@ -0,0 +1,18 @@
+#ifndef _IP6T_REJECT_H
+#define _IP6T_REJECT_H
+
+enum ip6t_reject_with {
+	IP6T_ICMP6_NO_ROUTE,
+	IP6T_ICMP6_ADM_PROHIBITED,
+	IP6T_ICMP6_NOT_NEIGHBOUR,
+	IP6T_ICMP6_ADDR_UNREACH,
+	IP6T_ICMP6_PORT_UNREACH,
+	IP6T_ICMP6_ECHOREPLY,
+	IP6T_TCP_RESET
+};
+
+struct ip6t_reject_info {
+	enum ip6t_reject_with with;      /* reject type */
+};
+
+#endif /*_IP6T_REJECT_H*/

diff -Nur -x.svn REJECT/linux-2.6/net/ipv6/ipv6_syms.c.ladd REJECT-changed/linux-2.6/net/ipv6/ipv6_syms.c.ladd
@@ -1 +1,2 @@
+EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 EXPORT_SYMBOL(ip6_dst_lookup);

diff -Nur -x.svn REJECT/linux-2.6/net/ipv6/netfilter/Makefile.ladd REJECT-changed/linux-2.6/net/ipv6/netfilter/Makefile.ladd
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
+obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o

diff -Nur -x.svn REJECT/linux.patch REJECT-changed/linux.patch
@@ -1,28 +0,0 @@
-diff -Nru linux-2.4.0-test8-ipv6updates/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.4.0-test8-REJECTv6/include/linux/netfilter_ipv6/ip6t_REJECT.h
---- linux-2.4.0-test8-ipv6updates/include/linux/netfilter_ipv6/ip6t_REJECT.h	Sun Nov 12 13:40:30 2000
-+++ linux-2.4.0-test8-REJECTv6/include/linux/netfilter_ipv6/ip6t_REJECT.h	Sun Nov 12 13:38:25 2000
-@@ -2,15 +2,17 @@
- #define _IP6T_REJECT_H
- 
- enum ip6t_reject_with {
--	IP6T_ICMP_NET_UNREACHABLE,
--	IP6T_ICMP_HOST_UNREACHABLE,
--	IP6T_ICMP_PROT_UNREACHABLE,
--	IP6T_ICMP_PORT_UNREACHABLE,
--	IP6T_ICMP_ECHOREPLY
-+	IP6T_ICMP6_NO_ROUTE,
-+	IP6T_ICMP6_ADM_PROHIBITED,
-+	IP6T_ICMP6_NOT_NEIGHBOUR,
-+	IP6T_ICMP6_ADDR_UNREACH,
-+	IP6T_ICMP6_PORT_UNREACH,
-+	IP6T_ICMP6_ECHOREPLY,
-+	IP6T_TCP_RESET
- };
- 
- struct ip6t_reject_info {
- 	enum ip6t_reject_with with;      /* reject type */
- };
- 
--#endif /*_IPT_REJECT_H*/
-+#endif /*_IP6T_REJECT_H*/
-

Thanks, Yasuyuki. I agree.

However, please note that your patch didn't apply:

laforge@hanuman%pts/3 (8:05) svn/netfilter/patch-o-matic-ng/REJECT > patch -p1 --dry-run < ~/reject.patch patching file linux-2.4.patch
patching file linux-2.6/include/linux/netfilter_ipv6/ip6t_REJECT.h
can't find file to patch at input line 58
Perhaps you used the wrong -p or --strip option?

I've fixed it up manually and applied it, please verify that everything works fine.

- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

That makes sense. Do you have any other issues with submitting this patch?

Regards
Patrick

Hi, Patrick,

Sorry for late replying. I looked other parts.
This patch makes send_reset() look xfrm policy and deletes unnecessary dst_hold().

Regards,

From: Patrick McHardy <[email protected]>
Date: Sun, 03 Apr 2005 20:26:49 +0200

-----------------------------------------------------------------
Yasuyuki KOZAKAI @ USAGI Project <[email protected]>

Index: linux-2.6/net/ipv6/netfilter/ip6t_REJECT.c
===================================================================
@@ -122,6 +122,11 @@
 		return;
 	}
 
+	if (xfrm_lookup(&dst, &fl, NULL, 0)) {
+		dst_release(dst);
+		return;
+	}
+
 	hh_len = (dst->dev->hard_header_len + 15)&~15;
 	nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
 			 + sizeof(struct tcphdr) + dst->trailer_len,

@@ -135,7 +140,6 @@
 	}
 
 	nskb->dst = dst;
-	dst_hold(dst);
 
 	skb_reserve(nskb, hh_len + dst->header_len);
 

@@ -182,8 +186,6 @@
 
 	NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
 		maybe_reroute);
-
-	dst_release(dst);
 }
 
 static inline void

In article <[email protected]> (at Fri, 08 Apr 2005 16:58:45 +0900 (JST)), Yasuyuki KOZAKAI <[email protected]> says:

How about send_unreach()?

--yoshfuji

It just calls icmpv6_send().

Please see

http://svn.netfilter.org/cgi-bin/viewcvs.cgi/trunk/patch-o-matic-ng/REJECT/linux-2.6/net/ipv6/netfilter/ip6t_REJECT.c?rev=3812&view=auto

Regards,

-----------------------------------------------------------------
Yasuyuki KOZAKAI @ USAGI Project <[email protected]>

From: YOSHIFUJI Hideaki / 吉藤英明 <[email protected]>
Date: Fri, 08 Apr 2005 17:32:06 +0900 (JST)

In article <[email protected]> (at Fri, 08 Apr 2005 18:41:53 +0900 (JST)), Yasuyuki KOZAKAI <[email protected]> says:

Ah, ok, thanks.

--yoshfuji

Looks good, thanks. I've applied it to pom, but can't commit right now, there is some permission problem with SVN. I'll commit it once its working again.

Regards
Patrick