Re: [PATCH nf-next v4 1/2] netfilter: Make IP6_NF_IPTABLES_LEGACY selectable

Hello Pablom

On Fri, Sep 06, 2024 at 01:01:46AM +0200, Pablo Neira Ayuso wrote:

On Thu, Aug 29, 2024 at 09:16:54AM -0700, Breno Leitao wrote:

quoted

This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving
users the option to configure iptables without enabling any other
config.

IUC this is to allow to compile iptables core built-in while allowing
extensions to be compiled as module? What is exactly the combination
you are trying to achieve which is not possible with the current
toggle?

Correct. iptable core is built-in, and any extension is a module.

Florian's motivation to add this knob is to allow to compile kernels
without iptables-legacy support.

Correct, and this continue to be an option. This change only introduces
you the option to set the core as built-in or module, independent of the
extensions.

quoted

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 net/ipv6/netfilter/Kconfig | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index f3c8e2d918e1..cbe88cc5b897 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig

@@ -8,7 +8,13 @@ menu "IPv6: Netfilter Configuration"
 
 # old sockopt interface and eval loop
 config IP6_NF_IPTABLES_LEGACY
-	tristate
+	tristate "Legacy IP6 tables support"
+	depends on INET && IPV6
+	select NETFILTER_XTABLES
+	default n
+	help
+	  ip6tables is a general, extensible packet identification legacy framework.

"packet classification" is generally the more appropriate and widely
used term for firewalls.

Maybe simply reword this description to ...

	  ip6tables is a legacy packet classification.

Sure, I will send an updated version with this change.

Thanks!