| Message ID | 20240909084620.3155679-2-leitao@debian.org (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | netfilter: Make IP_NF_IPTABLES_LEGACY selectable | expand |
One more question below. On Mon, Sep 09, 2024 at 01:46:18AM -0700, Breno Leitao wrote: > This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving > users the option to configure iptables without enabling any other > config. > > Signed-off-by: Breno Leitao <leitao@debian.org> > --- > net/ipv6/netfilter/Kconfig | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig > index f3c8e2d918e1..425cb7a3571b 100644 > --- a/net/ipv6/netfilter/Kconfig > +++ b/net/ipv6/netfilter/Kconfig > @@ -8,7 +8,14 @@ menu "IPv6: Netfilter Configuration" > > # old sockopt interface and eval loop > config IP6_NF_IPTABLES_LEGACY > - tristate > + tristate "Legacy IP6 tables support" > + depends on INET && IPV6 > + select NETFILTER_XTABLES > + default n > + help > + ip6tables is a legacy packet classification. Is "packet classifier" the right term? I can mangle this patch before applying, no need to send one more. Thanks. > + This is not needed if you are using iptables over nftables > + (iptables-nft). > > config NF_SOCKET_IPV6 > tristate "IPv6 socket lookup support" > -- > 2.43.5 >
On Thu, Sep 12, 2024 at 12:12:01AM +0200, Pablo Neira Ayuso wrote: > One more question below. > > On Mon, Sep 09, 2024 at 01:46:18AM -0700, Breno Leitao wrote: > > This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving > > users the option to configure iptables without enabling any other > > config. > > > > Signed-off-by: Breno Leitao <leitao@debian.org> > > --- > > net/ipv6/netfilter/Kconfig | 9 ++++++++- > > 1 file changed, 8 insertions(+), 1 deletion(-) > > > > diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig > > index f3c8e2d918e1..425cb7a3571b 100644 > > --- a/net/ipv6/netfilter/Kconfig > > +++ b/net/ipv6/netfilter/Kconfig > > @@ -8,7 +8,14 @@ menu "IPv6: Netfilter Configuration" > > > > # old sockopt interface and eval loop > > config IP6_NF_IPTABLES_LEGACY > > - tristate > > + tristate "Legacy IP6 tables support" > > + depends on INET && IPV6 > > + select NETFILTER_XTABLES > > + default n > > + help > > + ip6tables is a legacy packet classification. > > Is "packet classifier" the right term? > > I can mangle this patch before applying, no need to send one more. Thanks --breno
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index f3c8e2d918e1..425cb7a3571b 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -8,7 +8,14 @@ menu "IPv6: Netfilter Configuration" # old sockopt interface and eval loop config IP6_NF_IPTABLES_LEGACY - tristate + tristate "Legacy IP6 tables support" + depends on INET && IPV6 + select NETFILTER_XTABLES + default n + help + ip6tables is a legacy packet classification. + This is not needed if you are using iptables over nftables + (iptables-nft). config NF_SOCKET_IPV6 tristate "IPv6 socket lookup support"
This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving users the option to configure iptables without enabling any other config. Signed-off-by: Breno Leitao <leitao@debian.org> --- net/ipv6/netfilter/Kconfig | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)