Re: [PATCH nf-next v2 0/2] netfilter: Make IP_NF_IPTABLES_LEGACY selectable

[Jakub Kicinski]

On Fri, 23 Aug 2024 10:48:51 -0700 Breno Leitao wrote:
> These two patches make IP_NF_IPTABLES_LEGACY and IP6_NF_IPTABLES_LEGACY
> Kconfigs user selectable, avoiding creating an extra dependency by
> enabling some other config that would select IP{6}_NF_IPTABLES_LEGACY.

Resulting config in CI still differs quite a bit:

--- config.1	2024-08-23 14:19:10.000000000 -0700
+++ config	2024-08-24 05:18:52.000000000 -0700
@@ -1246,7 +1246,7 @@ CONFIG_NETFILTER_XT_MARK=m
 CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
 # CONFIG_NETFILTER_XT_TARGET_CT is not set
 # CONFIG_NETFILTER_XT_TARGET_DSCP is not set
-CONFIG_NETFILTER_XT_TARGET_HL=m
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
 # CONFIG_NETFILTER_XT_TARGET_HMARK is not set
 # CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
 # CONFIG_NETFILTER_XT_TARGET_LED is not set
@@ -1333,22 +1333,21 @@ CONFIG_NF_TABLES_IPV4=y
 # CONFIG_NF_DUP_IPV4 is not set
 CONFIG_NF_LOG_ARP=m
 CONFIG_NF_LOG_IPV4=m
-CONFIG_NF_REJECT_IPV4=y
+CONFIG_NF_REJECT_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 # CONFIG_IP_NF_MATCH_AH is not set
 # CONFIG_IP_NF_MATCH_ECN is not set
 CONFIG_IP_NF_MATCH_RPFILTER=m
 # CONFIG_IP_NF_MATCH_TTL is not set
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
+# CONFIG_IP_NF_FILTER is not set
+# CONFIG_IP_NF_TARGET_REJECT is not set
 # CONFIG_IP_NF_TARGET_SYNPROXY is not set
 CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
+# CONFIG_IP_NF_TARGET_MASQUERADE is not set
 # CONFIG_IP_NF_TARGET_NETMAP is not set
 # CONFIG_IP_NF_TARGET_REDIRECT is not set
-CONFIG_IP_NF_MANGLE=m
+# CONFIG_IP_NF_MANGLE is not set
 # CONFIG_IP_NF_TARGET_ECN is not set
-CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
 # CONFIG_IP_NF_ARPFILTER is not set
 # end of IP: Netfilter Configuration
@@ -1363,7 +1362,7 @@ CONFIG_NF_TABLES_IPV6=y
 # CONFIG_NFT_DUP_IPV6 is not set
 # CONFIG_NFT_FIB_IPV6 is not set
 # CONFIG_NF_DUP_IPV6 is not set
-CONFIG_NF_REJECT_IPV6=y
+CONFIG_NF_REJECT_IPV6=m
 CONFIG_NF_LOG_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 # CONFIG_IP6_NF_MATCH_AH is not set
@@ -1376,11 +1375,10 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=m
 CONFIG_IP6_NF_MATCH_RPFILTER=m
 # CONFIG_IP6_NF_MATCH_RT is not set
 # CONFIG_IP6_NF_MATCH_SRH is not set
-# CONFIG_IP6_NF_TARGET_HL is not set
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
+# CONFIG_IP6_NF_FILTER is not set
+# CONFIG_IP6_NF_TARGET_REJECT is not set
 # CONFIG_IP6_NF_TARGET_SYNPROXY is not set
-CONFIG_IP6_NF_MANGLE=m
+# CONFIG_IP6_NF_MANGLE is not set
 CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 # CONFIG_IP6_NF_TARGET_MASQUERADE is not set
-- 
pw-bot: cr