Bernhard Thaler <bernhard.thaler@xxxxxxxx> wrote:
> /sys/class/net/brXXX/bridge/nf_call_ip6tables and
> /proc/sys/net/bridge/bridge-nf-call-ip6tables can be set to 1 with
> CONFIG_IPV6=n. But br_nf_pre_routing_ipv6() is not available and
> ip6tables would not be usable as well.
>
> Do not allow to set both flags to 1 with CONFIG_IPV6=n.
>
> Change return value of placeholder for br_validate_ipv6() as it is
> used in br_nf_forward_ip() even with CONFIG_IPV6=n.
>
> Fixes: 230ac490f7fba ("netfilter: bridge: split ipv6 code into separated file")
> Signed-off-by: Bernhard Thaler <bernhard.thaler@xxxxxxxx>
> ---
> static inline unsigned int
> diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
> index d89f4fa..db0d038 100644
> --- a/net/bridge/br_netfilter_hooks.c
> +++ b/net/bridge/br_netfilter_hooks.c
> @@ -47,14 +47,22 @@
> #ifdef CONFIG_SYSCTL
> static struct ctl_table_header *brnf_sysctl_header;
> static int brnf_call_iptables __read_mostly = 1;
> +#if IS_ENABLED(CONFIG_IPV6)
IS_ENABLED(IP6_NF_IPTABLES) ?
> static struct ctl_table brnf_table[] = {
> {
> .procname = "bridge-nf-call-arptables",
> @@ -985,7 +1004,7 @@ static struct ctl_table brnf_table[] = {
> .data = &brnf_call_ip6tables,
> .maxlen = sizeof(int),
> .mode = 0644,
> - .proc_handler = brnf_sysctl_call_tables,
> + .proc_handler = brnf_sysctl_call_ip6tables,
> },
Might also make sense to not create the sysctl and sysfs entry in the
first place if no ip6tables is available.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
