#5260 HIGH Never A: iptables or netfilter is missing critical features

[Zarro Boogs per Child]

#5260: iptables or netfilter is missing critical features
----------------------------+-----------------------------------------------
  Reporter:  AlbertCahalan  |       Owner:  dilinger      
      Type:  defect         |      Status:  new           
  Priority:  high           |   Milestone:  Never Assigned
 Component:  kernel         |     Version:                
Resolution:                 |    Keywords:                
  Verified:  0              |  
----------------------------+-----------------------------------------------
Changes (by AlbertCahalan):

  * owner:  jg => dilinger
  * component:  distro => kernel


Comment:

 I just took a quick look at the kernel config here:

 http://dev.laptop.org/git?p=olpc-2.6;a=blob;f=arch/i386/configs/olpc_defconfig;hb=stable

 Bad and potentially bad settings are:

 {{{
 #
 # Networking options
 #
 # CONFIG_NET_IPIP is not set
 # CONFIG_NET_IPGRE is not set
 # CONFIG_IP_MROUTE is not set
 # CONFIG_NETLABEL is not set
 # CONFIG_NETFILTER_DEBUG is not set

 #
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK_QUEUE is not set
 # CONFIG_NETFILTER_NETLINK_LOG is not set
 # CONFIG_NF_CT_ACCT is not set
 # CONFIG_NF_CONNTRACK_MARK is not set
 # CONFIG_NF_CONNTRACK_SECMARK is not set
 # CONFIG_NF_CONNTRACK_EVENTS is not set
 # CONFIG_NF_CT_PROTO_SCTP is not set
 # CONFIG_NF_CONNTRACK_H323 is not set
 # CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
 # CONFIG_NF_CONNTRACK_PPTP is not set
 # CONFIG_NF_CONNTRACK_SANE is not set
 # CONFIG_NF_CONNTRACK_SIP is not set
 # CONFIG_NF_CT_NETLINK is not set
 # CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set
 # CONFIG_NETFILTER_XT_TARGET_MARK is not set
 # CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set
 # CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
 # CONFIG_NETFILTER_XT_TARGET_TCPMSS is not set
 # CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
 # CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set
 # CONFIG_NETFILTER_XT_MATCH_CONNMARK is not set
 # CONFIG_NETFILTER_XT_MATCH_CONNTRACK is not set
 # CONFIG_NETFILTER_XT_MATCH_DCCP is not set
 # CONFIG_NETFILTER_XT_MATCH_DSCP is not set
 # CONFIG_NETFILTER_XT_MATCH_ESP is not set
 # CONFIG_NETFILTER_XT_MATCH_HELPER is not set
 # CONFIG_NETFILTER_XT_MATCH_LENGTH is not set
 # CONFIG_NETFILTER_XT_MATCH_LIMIT is not set
 # CONFIG_NETFILTER_XT_MATCH_MAC is not set
 # CONFIG_NETFILTER_XT_MATCH_MARK is not set
 # CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 # CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
 # CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
 # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
 # CONFIG_NETFILTER_XT_MATCH_SCTP is not set
 # CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set
 # CONFIG_NETFILTER_XT_MATCH_STRING is not set
 # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
 # CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set

 #
 # IP: Netfilter Configuration
 #
 # CONFIG_IP_NF_QUEUE is not set
 # CONFIG_IP_NF_MATCH_IPRANGE is not set
 # CONFIG_IP_NF_MATCH_TOS is not set
 # CONFIG_IP_NF_MATCH_RECENT is not set
 # CONFIG_IP_NF_MATCH_ECN is not set
 # CONFIG_IP_NF_MATCH_AH is not set
 # CONFIG_IP_NF_MATCH_TTL is not set
 # CONFIG_IP_NF_MATCH_OWNER is not set
 # CONFIG_IP_NF_MATCH_ADDRTYPE is not set
 # CONFIG_IP_NF_TARGET_REJECT is not set
 # CONFIG_IP_NF_TARGET_ULOG is not set
 # CONFIG_IP_NF_TARGET_REDIRECT is not set
 # CONFIG_IP_NF_TARGET_NETMAP is not set
 # CONFIG_IP_NF_TARGET_SAME is not set
 # CONFIG_NF_NAT_SNMP_BASIC is not set
 # CONFIG_NF_NAT_PPTP is not set
 # CONFIG_NF_NAT_H323 is not set
 # CONFIG_NF_NAT_SIP is not set
 # CONFIG_IP_NF_MANGLE is not set
 # CONFIG_IP_NF_RAW is not set
 # CONFIG_IP_NF_ARPTABLES is not set

 #
 # IPv6: Netfilter Configuration (EXPERIMENTAL)
 #
 # CONFIG_NF_CONNTRACK_IPV6 is not set
 # CONFIG_IP6_NF_QUEUE is not set
 # CONFIG_IP6_NF_IPTABLES is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
 # CONFIG_TIPC is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set

 #
 # Classification
 #
 # CONFIG_NET_ACT_IPT is not set
 }}}

-- 
Ticket URL: <http://dev.laptop.org/ticket/5260#comment:2>
One Laptop Per Child <http://dev.laptop.org>
OLPC bug tracking system