netdev - Re: [PATCH net-next,v2 0/7] Netfilter updates for net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250425175922.GA26506@breakpoint.cc>
Date: Fri, 25 Apr 2025 19:59:22 +0200
From: Florian Westphal <fw@...len.de>
To: Jakub Kicinski <kuba@...nel.org>
Cc: Pablo Neira Ayuso <pablo@...filter.org>, fw@...len.de,
	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, pabeni@...hat.com, edumazet@...gle.com,
	horms@...nel.org
Subject: Re: [PATCH net-next,v2 0/7] Netfilter updates for net-next

Jakub Kicinski <kuba@...nel.org> wrote:
> On Thu, 24 Apr 2025 23:14:48 +0200 Pablo Neira Ayuso wrote:
> > v2: including fixes from Florian to address selftest issues
> >     and a fix for set element count and type.
> 
> Thanks, appreciated! All our networking tests now pass, but there
> seems to still be some breakage on the BPF side, so
> tools/testing/selftests/bpf/config needs touching up.
> 
> I suppose while addressing the RT problem you're trying to move
> straggles off from the legacy stuff to nft? Which I'm entirely
> sympathetic to. But I'm worried that not everybody will be, and 
> there's plenty of defconfigs which include iptables:
> 
> $ git grep CONFIG_IP_NF_IPTABLES= | wc -l
> 54

Pablo, lets toss the relevant patch and try again later.

I have no idea how to make this work the way we want it to
without converting all "selects" to "depends on" clauses as in the patch.

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -14,6 +14,7 @@ config NF_DEFRAG_IPV4
 config IP_NF_IPTABLES_LEGACY
 	tristate "Legacy IP tables support"
 	default	n
+	depends on !PREEMPT_RT
 	select NETFILTER_XTABLES
 	help


... will not work, you just get a "Unmet direct dependencies" warning.