Skip to contentSkip to conversation

net: bpfilter: fix iptables failure if bpfilter_umh is disabled

PATCH Applied Taehee Yoo 2 participants 2 messages Nov 5, 2018 – Nov 6, 2018

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Taehee Yoo

author
#0 lore raw

PATCH 1/1 net: bpfilter: fix iptables failure if bpfilter_umh is disabled

When iptables command is executed, ip_{set/get}sockopt() try to upload bpfilter.ko if bpfilter is enabled. if it couldn't find bpfilter.ko, command is failed.
bpfilter.ko is generated if CONFIG_BPFILTER_UMH is enabled. ip_{set/get}sockopt() only checks CONFIG_BPFILTER.
So that if CONFIG_BPFILTER is enabled and CONFIG_BPFILTER_UMH is disabled, iptables command is always failed.

test config:
CONFIG_BPFILTER=y
# CONFIG_BPFILTER_UMH is not set

test command:
%iptables -L
iptables: No chain/target/match by that name.

Fixes d2ba09c17a06 ("net: add skeleton of bpfilter kernel module")
Signed-off-by Taehee Yoo <[email protected]>
---
 net/ipv4/ip_sockglue.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/ip_sockglue.c +3 -3
index 26c36cccabdc..fffcc130900e 100644
@@ -1246,7 +1246,7 @@ int ip_setsockopt(struct sock *sk, int level,
 		return -ENOPROTOOPT;
 
 	err = do_ip_setsockopt(sk, level, optname, optval, optlen);
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
 	if (optname >= BPFILTER_IPT_SO_SET_REPLACE &&
 	    optname < BPFILTER_IPT_SET_MAX)
 		err = bpfilter_ip_set_sockopt(sk, optname, optval, optlen);

@@ -1559,7 +1559,7 @@ int ip_getsockopt(struct sock *sk, int level,
 	int err;
 
 	err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
 	if (optname >= BPFILTER_IPT_SO_GET_INFO &&
 	    optname < BPFILTER_IPT_GET_MAX)
 		err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);

@@ -1596,7 +1596,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
 	err = do_ip_getsockopt(sk, level, optname, optval, optlen,
 		MSG_CMSG_COMPAT);
 
-#ifdef CONFIG_BPFILTER
+#if IS_ENABLED(CONFIG_BPFILTER_UMH)
 	if (optname >= BPFILTER_IPT_SO_GET_INFO &&
 	    optname < BPFILTER_IPT_GET_MAX)
 		err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
Signature · 1 line
2.17.1
maintainer Applied
#1 lore raw

From: Taehee Yoo <[email protected]>
Date: Mon, 5 Nov 2018 22:31:41 +0900

Quoted 12 lines

When iptables command is executed, ip_{set/get}sockopt() try to upload bpfilter.ko if bpfilter is enabled. if it couldn't find bpfilter.ko, command is failed.
bpfilter.ko is generated if CONFIG_BPFILTER_UMH is enabled. ip_{set/get}sockopt() only checks CONFIG_BPFILTER.
So that if CONFIG_BPFILTER is enabled and CONFIG_BPFILTER_UMH is disabled, iptables command is always failed.

test config:
CONFIG_BPFILTER=y
# CONFIG_BPFILTER_UMH is not set

Quoted 6 lines

test command:
%iptables -L
iptables: No chain/target/match by that name.

Fixes d2ba09c17a06 ("net: add skeleton of bpfilter kernel module")
Signed-off-by Taehee Yoo <[email protected]>

Applied, thanks Taehee-ssi.