| Message ID | 20240823174855.3052334-1-leitao@debian.org (mailing list archive) |
|---|---|
| Headers | show |
| Series | netfilter: Make IP_NF_IPTABLES_LEGACY selectable | expand |
On Fri, 23 Aug 2024 10:48:51 -0700 Breno Leitao wrote: > These two patches make IP_NF_IPTABLES_LEGACY and IP6_NF_IPTABLES_LEGACY > Kconfigs user selectable, avoiding creating an extra dependency by > enabling some other config that would select IP{6}_NF_IPTABLES_LEGACY. Resulting config in CI still differs quite a bit: --- config.1 2024-08-23 14:19:10.000000000 -0700 +++ config 2024-08-24 05:18:52.000000000 -0700 @@ -1246,7 +1246,7 @@ CONFIG_NETFILTER_XT_MARK=m CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m # CONFIG_NETFILTER_XT_TARGET_CT is not set # CONFIG_NETFILTER_XT_TARGET_DSCP is not set -CONFIG_NETFILTER_XT_TARGET_HL=m +# CONFIG_NETFILTER_XT_TARGET_HL is not set # CONFIG_NETFILTER_XT_TARGET_HMARK is not set # CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set # CONFIG_NETFILTER_XT_TARGET_LED is not set @@ -1333,22 +1333,21 @@ CONFIG_NF_TABLES_IPV4=y # CONFIG_NF_DUP_IPV4 is not set CONFIG_NF_LOG_ARP=m CONFIG_NF_LOG_IPV4=m -CONFIG_NF_REJECT_IPV4=y +CONFIG_NF_REJECT_IPV4=m CONFIG_IP_NF_IPTABLES=m # CONFIG_IP_NF_MATCH_AH is not set # CONFIG_IP_NF_MATCH_ECN is not set CONFIG_IP_NF_MATCH_RPFILTER=m # CONFIG_IP_NF_MATCH_TTL is not set -CONFIG_IP_NF_FILTER=m -CONFIG_IP_NF_TARGET_REJECT=m +# CONFIG_IP_NF_FILTER is not set +# CONFIG_IP_NF_TARGET_REJECT is not set # CONFIG_IP_NF_TARGET_SYNPROXY is not set CONFIG_IP_NF_NAT=m -CONFIG_IP_NF_TARGET_MASQUERADE=m +# CONFIG_IP_NF_TARGET_MASQUERADE is not set # CONFIG_IP_NF_TARGET_NETMAP is not set # CONFIG_IP_NF_TARGET_REDIRECT is not set -CONFIG_IP_NF_MANGLE=m +# CONFIG_IP_NF_MANGLE is not set # CONFIG_IP_NF_TARGET_ECN is not set -CONFIG_IP_NF_TARGET_TTL=m CONFIG_IP_NF_RAW=m # CONFIG_IP_NF_ARPFILTER is not set # end of IP: Netfilter Configuration @@ -1363,7 +1362,7 @@ CONFIG_NF_TABLES_IPV6=y # CONFIG_NFT_DUP_IPV6 is not set # CONFIG_NFT_FIB_IPV6 is not set # CONFIG_NF_DUP_IPV6 is not set -CONFIG_NF_REJECT_IPV6=y +CONFIG_NF_REJECT_IPV6=m CONFIG_NF_LOG_IPV6=m CONFIG_IP6_NF_IPTABLES=m # CONFIG_IP6_NF_MATCH_AH is not set @@ -1376,11 +1375,10 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=m CONFIG_IP6_NF_MATCH_RPFILTER=m # CONFIG_IP6_NF_MATCH_RT is not set # CONFIG_IP6_NF_MATCH_SRH is not set -# CONFIG_IP6_NF_TARGET_HL is not set -CONFIG_IP6_NF_FILTER=m -CONFIG_IP6_NF_TARGET_REJECT=m +# CONFIG_IP6_NF_FILTER is not set +# CONFIG_IP6_NF_TARGET_REJECT is not set # CONFIG_IP6_NF_TARGET_SYNPROXY is not set -CONFIG_IP6_NF_MANGLE=m +# CONFIG_IP6_NF_MANGLE is not set CONFIG_IP6_NF_RAW=m CONFIG_IP6_NF_NAT=m # CONFIG_IP6_NF_TARGET_MASQUERADE is not set
On Sat, Aug 24, 2024 at 10:37:56AM -0700, Jakub Kicinski wrote: > On Fri, 23 Aug 2024 10:48:51 -0700 Breno Leitao wrote: > > These two patches make IP_NF_IPTABLES_LEGACY and IP6_NF_IPTABLES_LEGACY > > Kconfigs user selectable, avoiding creating an extra dependency by > > enabling some other config that would select IP{6}_NF_IPTABLES_LEGACY. > > Resulting config in CI still differs quite a bit: Sorry about it. I wasn't comparing the whole .config. I will submit a next version that preserve the .config intact when running: # rm -fr .config ; vng --build --config tools/testing/selftests/net/config Thanks, --breno
These two patches make IP_NF_IPTABLES_LEGACY and IP6_NF_IPTABLES_LEGACY Kconfigs user selectable, avoiding creating an extra dependency by enabling some other config that would select IP{6}_NF_IPTABLES_LEGACY. Changelog: v2: * Added the new configuration in the selftest configs (Jakub) * Added this simple cover letter v1: * https://lore.kernel.org/all/20240822175537.3626036-1-leitao@debian.org/ Breno Leitao (2): netfilter: Make IP_NF_IPTABLES_LEGACY selectable netfilter: Make IP6_NF_IPTABLES_LEGACY selectable net/ipv4/netfilter/Kconfig | 19 +++++++++++-------- net/ipv6/netfilter/Kconfig | 22 ++++++++++++---------- tools/testing/selftests/net/config | 2 ++ 3 files changed, 25 insertions(+), 18 deletions(-)