On Fri, Jul 06, 2018 at 03:05:13PM +0200, Arnd Bergmann wrote: > On Fri, Jul 6, 2018 at 2:48 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Fri, Jul 06, 2018 at 02:45:42PM +0200, Pablo Neira Ayuso wrote: > >> On Fri, Jul 06, 2018 at 02:37:58PM +0200, Arnd Bergmann wrote: > >> > With NETFILTER_XT_TARGET_TEE=y and IP6_NF_IPTABLES=m, we get a link > >> > error when referencing the NF_DUP_IPV6 module: > >> > > >> > net/netfilter/xt_TEE.o: In function `tee_tg6': > >> > xt_TEE.c:(.text+0x14): undefined reference to `nf_dup_ipv6' > >> > > >> > The problem here is the 'select NF_DUP_IPV6 if IP6_NF_IPTABLES' > >> > that forces NF_DUP_IPV6 to be =m as well rather than setting it > >> > to =y as was intended here. Adding a soft dependency on > >> > IP6_NF_IPTABLES avoids that broken configuration. > >> > >> Applied to nf.git, thanks Arnd. > > > > Sorry, let me reconsider. > > > > We many need similar patches to other spots in 35bf1ccecaaa ? > > > > If so, it would be good to fix in the one go. > > I'm fairly sure that NETFILTER_XT_TARGET_LOG is safe, since > NF_LOG_IPV6 already depends on IP6_NF_IPTABLES. > > NF_SOCKET_IPV6 like NF_DUP_IPV6 does not depend on > IP6_NF_IPTABLES, so we may have a similar problem there, though > I have not come across that. I have done only a few hundred randconfig > builds since I started yesterday, so I may have missed something, > but I think this is safe because CONFIG_NF_SOCKET_IPV6 is > used like a 'bool' symbol these days, we don't actually control building > a module with it, only a small portion in the nft_socket file. Thanks for explaining. Applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
