Skip to content

Commit 0ecdccf

Browse files
ginglis13ginglis13
authored
Merge pull request #271 from ginglis13/nf-modules
kernel-6.12: convert netfilter modules from built-in to loadable
2 parents e19cd42 + b787012 commit 0ecdccf

4 files changed

Lines changed: 38 additions & 18 deletions

File tree

‎packages/kernel-6.12/config-bottlerocket‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,3 +271,14 @@ CONFIG_INFINIBAND_USER_MAD=m
271271

272272
# Enable CephFS SELinux labels
273273
CONFIG_CEPH_FS_SECURITY_LABEL=y
274+
275+
# Include some IP/IPv6 Netfilter drivers as modules
276+
CONFIG_IP_NF_IPTABLES_LEGACY=m
277+
CONFIG_IP_NF_FILTER=m
278+
CONFIG_IP_NF_MANGLE=m
279+
CONFIG_IP_NF_RAW=m
280+
CONFIG_IP_NF_SECURITY=m
281+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
282+
CONFIG_IP6_NF_FILTER=m
283+
CONFIG_IP6_NF_MANGLE=m
284+
CONFIG_IP6_NF_RAW=m

‎packages/kernel-6.12/config-full-bottlerocket-aarch64‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1576,7 +1576,7 @@ CONFIG_IP_VS_PE_SIP=m
15761576
# IP: Netfilter Configuration
15771577
#
15781578
CONFIG_NF_DEFRAG_IPV4=m
1579-
CONFIG_IP_NF_IPTABLES_LEGACY=y
1579+
CONFIG_IP_NF_IPTABLES_LEGACY=m
15801580
CONFIG_NF_SOCKET_IPV4=m
15811581
CONFIG_NF_TPROXY_IPV4=m
15821582
CONFIG_NF_TABLES_IPV4=y
@@ -1596,18 +1596,18 @@ CONFIG_IP_NF_MATCH_AH=m
15961596
CONFIG_IP_NF_MATCH_ECN=m
15971597
CONFIG_IP_NF_MATCH_RPFILTER=m
15981598
CONFIG_IP_NF_MATCH_TTL=m
1599-
CONFIG_IP_NF_FILTER=y
1599+
CONFIG_IP_NF_FILTER=m
16001600
CONFIG_IP_NF_TARGET_REJECT=m
16011601
CONFIG_IP_NF_TARGET_SYNPROXY=m
16021602
CONFIG_IP_NF_NAT=m
16031603
CONFIG_IP_NF_TARGET_MASQUERADE=m
16041604
CONFIG_IP_NF_TARGET_NETMAP=m
16051605
CONFIG_IP_NF_TARGET_REDIRECT=m
1606-
CONFIG_IP_NF_MANGLE=y
1606+
CONFIG_IP_NF_MANGLE=m
16071607
CONFIG_IP_NF_TARGET_ECN=m
16081608
CONFIG_IP_NF_TARGET_TTL=m
1609-
CONFIG_IP_NF_RAW=y
1610-
CONFIG_IP_NF_SECURITY=y
1609+
CONFIG_IP_NF_RAW=m
1610+
CONFIG_IP_NF_SECURITY=m
16111611
CONFIG_IP_NF_ARPTABLES=m
16121612
CONFIG_NFT_COMPAT_ARP=m
16131613
CONFIG_IP_NF_ARPFILTER=m
@@ -1617,7 +1617,7 @@ CONFIG_IP_NF_ARP_MANGLE=m
16171617
#
16181618
# IPv6: Netfilter Configuration
16191619
#
1620-
CONFIG_IP6_NF_IPTABLES_LEGACY=y
1620+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
16211621
CONFIG_NF_SOCKET_IPV6=m
16221622
CONFIG_NF_TPROXY_IPV6=m
16231623
CONFIG_NF_TABLES_IPV6=y
@@ -1639,11 +1639,11 @@ CONFIG_IP6_NF_MATCH_RPFILTER=m
16391639
CONFIG_IP6_NF_MATCH_RT=m
16401640
CONFIG_IP6_NF_MATCH_SRH=m
16411641
CONFIG_IP6_NF_TARGET_HL=m
1642-
CONFIG_IP6_NF_FILTER=y
1642+
CONFIG_IP6_NF_FILTER=m
16431643
CONFIG_IP6_NF_TARGET_REJECT=m
16441644
CONFIG_IP6_NF_TARGET_SYNPROXY=m
1645-
CONFIG_IP6_NF_MANGLE=y
1646-
CONFIG_IP6_NF_RAW=y
1645+
CONFIG_IP6_NF_MANGLE=m
1646+
CONFIG_IP6_NF_RAW=m
16471647
CONFIG_IP6_NF_SECURITY=m
16481648
CONFIG_IP6_NF_NAT=m
16491649
CONFIG_IP6_NF_TARGET_MASQUERADE=m

‎packages/kernel-6.12/config-full-bottlerocket-x86_64‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1598,7 +1598,7 @@ CONFIG_IP_VS_PE_SIP=m
15981598
# IP: Netfilter Configuration
15991599
#
16001600
CONFIG_NF_DEFRAG_IPV4=m
1601-
CONFIG_IP_NF_IPTABLES_LEGACY=y
1601+
CONFIG_IP_NF_IPTABLES_LEGACY=m
16021602
CONFIG_NF_SOCKET_IPV4=m
16031603
CONFIG_NF_TPROXY_IPV4=m
16041604
CONFIG_NF_TABLES_IPV4=y
@@ -1618,18 +1618,18 @@ CONFIG_IP_NF_MATCH_AH=m
16181618
CONFIG_IP_NF_MATCH_ECN=m
16191619
CONFIG_IP_NF_MATCH_RPFILTER=m
16201620
CONFIG_IP_NF_MATCH_TTL=m
1621-
CONFIG_IP_NF_FILTER=y
1621+
CONFIG_IP_NF_FILTER=m
16221622
CONFIG_IP_NF_TARGET_REJECT=m
16231623
CONFIG_IP_NF_TARGET_SYNPROXY=m
16241624
CONFIG_IP_NF_NAT=m
16251625
CONFIG_IP_NF_TARGET_MASQUERADE=m
16261626
CONFIG_IP_NF_TARGET_NETMAP=m
16271627
CONFIG_IP_NF_TARGET_REDIRECT=m
1628-
CONFIG_IP_NF_MANGLE=y
1628+
CONFIG_IP_NF_MANGLE=m
16291629
CONFIG_IP_NF_TARGET_ECN=m
16301630
CONFIG_IP_NF_TARGET_TTL=m
1631-
CONFIG_IP_NF_RAW=y
1632-
CONFIG_IP_NF_SECURITY=y
1631+
CONFIG_IP_NF_RAW=m
1632+
CONFIG_IP_NF_SECURITY=m
16331633
CONFIG_IP_NF_ARPTABLES=m
16341634
CONFIG_NFT_COMPAT_ARP=m
16351635
CONFIG_IP_NF_ARPFILTER=m
@@ -1639,7 +1639,7 @@ CONFIG_IP_NF_ARP_MANGLE=m
16391639
#
16401640
# IPv6: Netfilter Configuration
16411641
#
1642-
CONFIG_IP6_NF_IPTABLES_LEGACY=y
1642+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
16431643
CONFIG_NF_SOCKET_IPV6=m
16441644
CONFIG_NF_TPROXY_IPV6=m
16451645
CONFIG_NF_TABLES_IPV6=y
@@ -1661,11 +1661,11 @@ CONFIG_IP6_NF_MATCH_RPFILTER=m
16611661
CONFIG_IP6_NF_MATCH_RT=m
16621662
CONFIG_IP6_NF_MATCH_SRH=m
16631663
CONFIG_IP6_NF_TARGET_HL=m
1664-
CONFIG_IP6_NF_FILTER=y
1664+
CONFIG_IP6_NF_FILTER=m
16651665
CONFIG_IP6_NF_TARGET_REJECT=m
16661666
CONFIG_IP6_NF_TARGET_SYNPROXY=m
1667-
CONFIG_IP6_NF_MANGLE=y
1668-
CONFIG_IP6_NF_RAW=y
1667+
CONFIG_IP6_NF_MANGLE=m
1668+
CONFIG_IP6_NF_RAW=m
16691669
CONFIG_IP6_NF_SECURITY=m
16701670
CONFIG_IP6_NF_NAT=m
16711671
CONFIG_IP6_NF_TARGET_MASQUERADE=m

‎packages/kernel-6.12/kernel-6.12.spec‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1074,12 +1074,17 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
10741074
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arp_tables.%{_ko}
10751075
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arpt_mangle.%{_ko}
10761076
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arptable_filter.%{_ko}
1077+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ip_tables.%{_ko}
10771078
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_ah.%{_ko}
10781079
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_ECN.%{_ko}
10791080
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_REJECT.%{_ko}
10801081
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_rpfilter.%{_ko}
10811082
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_SYNPROXY.%{_ko}
1083+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_filter.%{_ko}
1084+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_mangle.%{_ko}
10821085
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_nat.%{_ko}
1086+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_raw.%{_ko}
1087+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_security.%{_ko}
10831088
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_defrag_ipv4.%{_ko}
10841089
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_dup_ipv4.%{_ko}
10851090
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_nat_h323.%{_ko}
@@ -1121,6 +1126,7 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
11211126
%{_cross_kmoddir}/kernel/net/ipv6/ip6_vti.%{_ko}
11221127
%{_cross_kmoddir}/kernel/net/ipv6/ipcomp6.%{_ko}
11231128
%{_cross_kmoddir}/kernel/net/ipv6/mip6.%{_ko}
1129+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6_tables.%{_ko}
11241130
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_ah.%{_ko}
11251131
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_eui64.%{_ko}
11261132
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_frag.%{_ko}
@@ -1132,7 +1138,10 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
11321138
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_rt.%{_ko}
11331139
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_srh.%{_ko}
11341140
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_SYNPROXY.%{_ko}
1141+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_filter.%{_ko}
1142+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_mangle.%{_ko}
11351143
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_nat.%{_ko}
1144+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_raw.%{_ko}
11361145
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_security.%{_ko}
11371146
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/nf_defrag_ipv6.%{_ko}
11381147
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/nf_dup_ipv6.%{_ko}

0 commit comments

Comments
 (0)