Re: [PATCH nf-next v4 1/2] netfilter: Make IP6_NF_IPTABLES_LEGACY selectable

[Breno Leitao]

Hello Pablom

On Fri, Sep 06, 2024 at 01:01:46AM +0200, Pablo Neira Ayuso wrote:
> On Thu, Aug 29, 2024 at 09:16:54AM -0700, Breno Leitao wrote:
> > This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving
> > users the option to configure iptables without enabling any other
> > config.
> 
> IUC this is to allow to compile iptables core built-in while allowing
> extensions to be compiled as module? What is exactly the combination
> you are trying to achieve which is not possible with the current
> toggle?

Correct. iptable core is built-in, and any extension is a module.

> Florian's motivation to add this knob is to allow to compile kernels
> without iptables-legacy support.

Correct, and this continue to be an option. This change only introduces
you the option to set the core as built-in or module, independent of the
extensions.

> > Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
> > ---
> >  net/ipv6/netfilter/Kconfig | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
> > index f3c8e2d918e1..cbe88cc5b897 100644
> > --- a/net/ipv6/netfilter/Kconfig
> > +++ b/net/ipv6/netfilter/Kconfig
> > @@ -8,7 +8,13 @@ menu "IPv6: Netfilter Configuration"
> >  
> >  # old sockopt interface and eval loop
> >  config IP6_NF_IPTABLES_LEGACY
> > -	tristate
> > +	tristate "Legacy IP6 tables support"
> > +	depends on INET && IPV6
> > +	select NETFILTER_XTABLES
> > +	default n
> > +	help
> > +	  ip6tables is a general, extensible packet identification legacy framework.
> 
> "packet classification" is generally the more appropriate and widely
> used term for firewalls.
> 
> Maybe simply reword this description to ...
> 
> 	  ip6tables is a legacy packet classification.

Sure, I will send an updated version with this change.

Thanks!