[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240930095855.453342-1-leitao@debian.org>
Date: Mon, 30 Sep 2024 02:58:54 -0700
From: Breno Leitao <leitao@...ian.org>
To: fw@...len.de,
davem@...emloft.net,
edumazet@...gle.com,
kuba@...nel.org,
pabeni@...hat.com,
pablo@...filter.org,
Jozsef Kadlecsik <kadlec@...filter.org>,
Roopa Prabhu <roopa@...dia.com>,
Nikolay Aleksandrov <razor@...ckwall.org>,
David Ahern <dsahern@...nel.org>
Cc: rbc@...a.com,
netdev@...r.kernel.org,
linux-kernel@...r.kernel.org,
netfilter-devel@...r.kernel.org,
coreteam@...filter.org (open list:NETFILTER),
bridge@...ts.linux.dev (open list:ETHERNET BRIDGE)
Subject: [PATCH nf-next v6] netfilter: Make legacy configs user selectable
This option makes legacy Netfilter Kconfig user selectable, giving users
the option to configure iptables without enabling any other config.
Make the following KConfig entries user selectable:
* BRIDGE_NF_EBTABLES_LEGACY
* IP_NF_ARPTABLES
* IP_NF_IPTABLES_LEGACY
* IP6_NF_IPTABLES_LEGACY
Signed-off-by: Breno Leitao <leitao@...ian.org>
---
Changelog:
v6:
* Expand it for BRIDGE_NF_EBTABLES_LEGACY and IP_NF_ARPTABLES (Pablo)
* Merge all changes in a single patch (Pablo)
v5:
* Change the description of the legacy Kconfig (Pablo)
* https://lore.kernel.org/all/20240909084620.3155679-2-leitao@debian.org/
v4:
* Remove the "depends on" part, which may come later in a separate
change, given its intrusive on how to configure selftests
* https://lore.kernel.org/all/20240829161656.832208-1-leitao@debian.org/
v3:
* Make sure that the generate from tools/testing/selftests/net/config
look the same before and after. (Jakub)
* https://lore.kernel.org/all/20240827145242.3094777-1-leitao@debian.org/
v2:
* Added the new configuration in the selftest configs (Jakub)
* Added this simple cover letter
* https://lore.kernel.org/all/20240823174855.3052334-1-leitao@debian.org/
v1:
* https://lore.kernel.org/all/20240822175537.3626036-1-leitao@debian.org/
net/bridge/netfilter/Kconfig | 8 +++++++-
net/ipv4/netfilter/Kconfig | 16 ++++++++++++++--
net/ipv6/netfilter/Kconfig | 9 ++++++++-
3 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 104c0125e32e..f16bbbbb9481 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -41,7 +41,13 @@ config NF_CONNTRACK_BRIDGE
# old sockopt interface and eval loop
config BRIDGE_NF_EBTABLES_LEGACY
- tristate
+ tristate "Legacy EBTABLES support"
+ depends on BRIDGE && NETFILTER_XTABLES
+ default n
+ help
+ Legacy ebtables packet/frame classifier.
+ This is not needed if you are using ebtables over nftables
+ (iptables-nft).
menuconfig BRIDGE_NF_EBTABLES
tristate "Ethernet Bridge tables (ebtables) support"
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 1b991b889506..ef8009281da5 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -12,7 +12,13 @@ config NF_DEFRAG_IPV4
# old sockopt interface and eval loop
config IP_NF_IPTABLES_LEGACY
- tristate
+ tristate "Legacy IP tables support"
+ default n
+ select NETFILTER_XTABLES
+ help
+ iptables is a legacy packet classifier.
+ This is not needed if you are using iptables over nftables
+ (iptables-nft).
config NF_SOCKET_IPV4
tristate "IPv4 socket lookup support"
@@ -318,7 +324,13 @@ endif # IP_NF_IPTABLES
# ARP tables
config IP_NF_ARPTABLES
- tristate
+ tristate "Legacy ARPTABLES support"
+ depends on NETFILTER_XTABLES
+ default n
+ help
+ arptables is a legacy packet classifier.
+ This is not needed if you are using arptables over nftables
+ (iptables-nft).
config NFT_COMPAT_ARP
tristate
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index f3c8e2d918e1..e087a8e97ba7 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -8,7 +8,14 @@ menu "IPv6: Netfilter Configuration"
# old sockopt interface and eval loop
config IP6_NF_IPTABLES_LEGACY
- tristate
+ tristate "Legacy IP6 tables support"
+ depends on INET && IPV6
+ select NETFILTER_XTABLES
+ default n
+ help
+ ip6tables is a legacy packet classifier.
+ This is not needed if you are using iptables over nftables
+ (iptables-nft).
config NF_SOCKET_IPV6
tristate "IPv6 socket lookup support"
--
2.43.5
Powered by blists - more mailing lists