netdev - Re: [PATCH net-next 06/19] netfilter: Exclude LEGACY TABLES on PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aJSR_cFHvqtmGb-B@calendula>
Date: Thu, 7 Aug 2025 13:46:05 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: Ryan Roberts <ryan.roberts@....com>
Cc: netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, kuba@...nel.org, pabeni@...hat.com,
	edumazet@...gle.com, fw@...len.de, horms@...nel.org,
	Aishwarya Rambhadran <Aishwarya.Rambhadran@....com>
Subject: Re: [PATCH net-next 06/19] netfilter: Exclude LEGACY TABLES on
 PREEMPT_RT.

Hi Ryan,

On Tue, Aug 05, 2025 at 04:43:06PM +0100, Ryan Roberts wrote:
[...]
> > +config NETFILTER_XTABLES_LEGACY
> > +	bool "Netfilter legacy tables support"
> > +	depends on !PREEMPT_RT
> > +	help
> > +	  Say Y here if you still require support for legacy tables. This is
> > +	  required by the legacy tools (iptables-legacy) and is not needed if
> > +	  you use iptables over nftables (iptables-nft).
> > +	  Legacy support is not limited to IP, it also includes EBTABLES and
> > +	  ARPTABLES.
> > +
> 
> This has caused some minor pain for me using Docker on Ubuntu 22.04, which I
> guess is still using iptables-legacy. I've had to debug why Docker has stopped
> working and eventually ended here. Explcitly enabling NETFILTER_XTABLES_LEGACY
> solved the problem.

I apologize for the inconvenience. Using iptables-nft should fix it,
if you encounter any issue with iptables-nft in Ubuntu 22.04, it
should be straight forward to compile lastest iptables version, given
you compile your own kernels for such distro version.

> I thought I'd try my luck at convincing you to default this to enabled for
> !PREEMPT_RT to save others from such issues?

Not so easy as removing PREEMPT_RT dependency, x_tables need to be
fixed in order to support it, last time we discussed this there was a
way to address it by making the counters more unreliable in turn.

No objections if anyone wants to fix x_tables to make it work with
PREEMPT_RT from my side.