netfilter: xt_CT: recover NOTRACK target support
authorPablo Neira Ayuso <pablo@netfilter.org>
Thu, 20 Dec 2012 01:54:51 +0000 (01:54 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 4 Feb 2013 00:27:07 +0000 (18:27 -0600)
commitd401aadc261edfcea6d9e7b794d0629cb24518a9
tree4d6d99bd1462a06ca547ad08b2be20484f032c87
parent11be9a19f21d08bface2c48f848beaeeb813a68f
netfilter: xt_CT: recover NOTRACK target support

commit 10db9069eb5c60195170a4119bdbcbce69a4945f upstream.

Florian Westphal reported that the removal of the NOTRACK target
(9655050 netfilter: remove xt_NOTRACK) is breaking some existing
setups.

That removal was scheduled for removal since long time ago as
described in Documentation/feature-removal-schedule.txt

What:  xt_NOTRACK
Files: net/netfilter/xt_NOTRACK.c
When:  April 2011
Why:   Superseded by xt_CT

Still, people may have not notice / may have decided to stick to an
old iptables version. I agree with him in that some more conservative
approach by spotting some printk to warn users for some time is less
agressive.

Current iptables 1.4.16.3 already contains the aliasing support
that makes it point to the CT target, so upgrading would fix it.
Still, the policy so far has been to avoid pushing our users to
upgrade.

As a solution, this patch recovers the NOTRACK target inside the CT
target and it now spots a warning.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/net/netns/x_tables.h
net/netfilter/Kconfig
net/netfilter/xt_CT.c