netdev - Re: [PATCH nf-next v2 0/2] netfilter: Make IP_NF_IPTABLES

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240824103756.4fb39abc@kernel.org>
Date: Sat, 24 Aug 2024 10:37:56 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Breno Leitao <leitao@...ian.org>
Cc: fw@...len.de, davem@...emloft.net, edumazet@...gle.com,
 pabeni@...hat.com, rbc@...a.com, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH nf-next v2 0/2] netfilter: Make IP_NF_IPTABLES_LEGACY
 selectable

On Fri, 23 Aug 2024 10:48:51 -0700 Breno Leitao wrote:
> These two patches make IP_NF_IPTABLES_LEGACY and IP6_NF_IPTABLES_LEGACY
> Kconfigs user selectable, avoiding creating an extra dependency by
> enabling some other config that would select IP{6}_NF_IPTABLES_LEGACY.

Resulting config in CI still differs quite a bit:

--- config.1	2024-08-23 14:19:10.000000000 -0700
+++ config	2024-08-24 05:18:52.000000000 -0700
@@ -1246,7 +1246,7 @@ CONFIG_NETFILTER_XT_MARK=m
 CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
 # CONFIG_NETFILTER_XT_TARGET_CT is not set
 # CONFIG_NETFILTER_XT_TARGET_DSCP is not set
-CONFIG_NETFILTER_XT_TARGET_HL=m
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
 # CONFIG_NETFILTER_XT_TARGET_HMARK is not set
 # CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
 # CONFIG_NETFILTER_XT_TARGET_LED is not set
@@ -1333,22 +1333,21 @@ CONFIG_NF_TABLES_IPV4=y
 # CONFIG_NF_DUP_IPV4 is not set
 CONFIG_NF_LOG_ARP=m
 CONFIG_NF_LOG_IPV4=m
-CONFIG_NF_REJECT_IPV4=y
+CONFIG_NF_REJECT_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 # CONFIG_IP_NF_MATCH_AH is not set
 # CONFIG_IP_NF_MATCH_ECN is not set
 CONFIG_IP_NF_MATCH_RPFILTER=m
 # CONFIG_IP_NF_MATCH_TTL is not set
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
+# CONFIG_IP_NF_FILTER is not set
+# CONFIG_IP_NF_TARGET_REJECT is not set
 # CONFIG_IP_NF_TARGET_SYNPROXY is not set
 CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
+# CONFIG_IP_NF_TARGET_MASQUERADE is not set
 # CONFIG_IP_NF_TARGET_NETMAP is not set
 # CONFIG_IP_NF_TARGET_REDIRECT is not set
-CONFIG_IP_NF_MANGLE=m
+# CONFIG_IP_NF_MANGLE is not set
 # CONFIG_IP_NF_TARGET_ECN is not set
-CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
 # CONFIG_IP_NF_ARPFILTER is not set
 # end of IP: Netfilter Configuration
@@ -1363,7 +1362,7 @@ CONFIG_NF_TABLES_IPV6=y
 # CONFIG_NFT_DUP_IPV6 is not set
 # CONFIG_NFT_FIB_IPV6 is not set
 # CONFIG_NF_DUP_IPV6 is not set
-CONFIG_NF_REJECT_IPV6=y
+CONFIG_NF_REJECT_IPV6=m
 CONFIG_NF_LOG_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 # CONFIG_IP6_NF_MATCH_AH is not set
@@ -1376,11 +1375,10 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=m
 CONFIG_IP6_NF_MATCH_RPFILTER=m
 # CONFIG_IP6_NF_MATCH_RT is not set
 # CONFIG_IP6_NF_MATCH_SRH is not set
-# CONFIG_IP6_NF_TARGET_HL is not set
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
+# CONFIG_IP6_NF_FILTER is not set
+# CONFIG_IP6_NF_TARGET_REJECT is not set
 # CONFIG_IP6_NF_TARGET_SYNPROXY is not set
-CONFIG_IP6_NF_MANGLE=m
+# CONFIG_IP6_NF_MANGLE is not set
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 # CONFIG_IP6_NF_TARGET_MASQUERADE is not set
-- 
pw-bot: cr