Skip to content

Commit b787012

Browse files
ginglis13ginglis13
committed
kernel-6.12: convert netfilter modules from built-in to loadable
Change several IP and IPv6 netfilter components from built-in (=y) to loadable modules (=m). Modified modules: * IP_NF_IPTABLES_LEGACY: legacy iptables support * IP_NF_FILTER: IPv4 packet filtering * IP_NF_MANGLE: IPv4 packet mangling * IP_NF_RAW: IPv4 raw table support * IP_NF_SECURITY: IPv4 security table support * IP6_NF_IPTABLES_LEGACY: legacy ip6tables support * IP6_NF_FILTER: IPv6 packet filtering * IP6_NF_MANGLE: IPv6 packet mangling * IP6_NF_RAW: IPv6 raw table support Signed-off-by: Gavin Inglis <giinglis@amazon.com>
1 parent 79952f6 commit b787012

4 files changed

Lines changed: 38 additions & 18 deletions

File tree

‎packages/kernel-6.12/config-bottlerocket‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,3 +271,14 @@ CONFIG_INFINIBAND_USER_MAD=m
271271

272272
# Enable CephFS SELinux labels
273273
CONFIG_CEPH_FS_SECURITY_LABEL=y
274+
275+
# Include some IP/IPv6 Netfilter drivers as modules
276+
CONFIG_IP_NF_IPTABLES_LEGACY=m
277+
CONFIG_IP_NF_FILTER=m
278+
CONFIG_IP_NF_MANGLE=m
279+
CONFIG_IP_NF_RAW=m
280+
CONFIG_IP_NF_SECURITY=m
281+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
282+
CONFIG_IP6_NF_FILTER=m
283+
CONFIG_IP6_NF_MANGLE=m
284+
CONFIG_IP6_NF_RAW=m

‎packages/kernel-6.12/config-full-bottlerocket-aarch64‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1576,7 +1576,7 @@ CONFIG_IP_VS_PE_SIP=m
15761576
# IP: Netfilter Configuration
15771577
#
15781578
CONFIG_NF_DEFRAG_IPV4=m
1579-
CONFIG_IP_NF_IPTABLES_LEGACY=y
1579+
CONFIG_IP_NF_IPTABLES_LEGACY=m
15801580
CONFIG_NF_SOCKET_IPV4=m
15811581
CONFIG_NF_TPROXY_IPV4=m
15821582
CONFIG_NF_TABLES_IPV4=y
@@ -1596,18 +1596,18 @@ CONFIG_IP_NF_MATCH_AH=m
15961596
CONFIG_IP_NF_MATCH_ECN=m
15971597
CONFIG_IP_NF_MATCH_RPFILTER=m
15981598
CONFIG_IP_NF_MATCH_TTL=m
1599-
CONFIG_IP_NF_FILTER=y
1599+
CONFIG_IP_NF_FILTER=m
16001600
CONFIG_IP_NF_TARGET_REJECT=m
16011601
CONFIG_IP_NF_TARGET_SYNPROXY=m
16021602
CONFIG_IP_NF_NAT=m
16031603
CONFIG_IP_NF_TARGET_MASQUERADE=m
16041604
CONFIG_IP_NF_TARGET_NETMAP=m
16051605
CONFIG_IP_NF_TARGET_REDIRECT=m
1606-
CONFIG_IP_NF_MANGLE=y
1606+
CONFIG_IP_NF_MANGLE=m
16071607
CONFIG_IP_NF_TARGET_ECN=m
16081608
CONFIG_IP_NF_TARGET_TTL=m
1609-
CONFIG_IP_NF_RAW=y
1610-
CONFIG_IP_NF_SECURITY=y
1609+
CONFIG_IP_NF_RAW=m
1610+
CONFIG_IP_NF_SECURITY=m
16111611
CONFIG_IP_NF_ARPTABLES=m
16121612
CONFIG_NFT_COMPAT_ARP=m
16131613
CONFIG_IP_NF_ARPFILTER=m
@@ -1617,7 +1617,7 @@ CONFIG_IP_NF_ARP_MANGLE=m
16171617
#
16181618
# IPv6: Netfilter Configuration
16191619
#
1620-
CONFIG_IP6_NF_IPTABLES_LEGACY=y
1620+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
16211621
CONFIG_NF_SOCKET_IPV6=m
16221622
CONFIG_NF_TPROXY_IPV6=m
16231623
CONFIG_NF_TABLES_IPV6=y
@@ -1639,11 +1639,11 @@ CONFIG_IP6_NF_MATCH_RPFILTER=m
16391639
CONFIG_IP6_NF_MATCH_RT=m
16401640
CONFIG_IP6_NF_MATCH_SRH=m
16411641
CONFIG_IP6_NF_TARGET_HL=m
1642-
CONFIG_IP6_NF_FILTER=y
1642+
CONFIG_IP6_NF_FILTER=m
16431643
CONFIG_IP6_NF_TARGET_REJECT=m
16441644
CONFIG_IP6_NF_TARGET_SYNPROXY=m
1645-
CONFIG_IP6_NF_MANGLE=y
1646-
CONFIG_IP6_NF_RAW=y
1645+
CONFIG_IP6_NF_MANGLE=m
1646+
CONFIG_IP6_NF_RAW=m
16471647
CONFIG_IP6_NF_SECURITY=m
16481648
CONFIG_IP6_NF_NAT=m
16491649
CONFIG_IP6_NF_TARGET_MASQUERADE=m

‎packages/kernel-6.12/config-full-bottlerocket-x86_64‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1598,7 +1598,7 @@ CONFIG_IP_VS_PE_SIP=m
15981598
# IP: Netfilter Configuration
15991599
#
16001600
CONFIG_NF_DEFRAG_IPV4=m
1601-
CONFIG_IP_NF_IPTABLES_LEGACY=y
1601+
CONFIG_IP_NF_IPTABLES_LEGACY=m
16021602
CONFIG_NF_SOCKET_IPV4=m
16031603
CONFIG_NF_TPROXY_IPV4=m
16041604
CONFIG_NF_TABLES_IPV4=y
@@ -1618,18 +1618,18 @@ CONFIG_IP_NF_MATCH_AH=m
16181618
CONFIG_IP_NF_MATCH_ECN=m
16191619
CONFIG_IP_NF_MATCH_RPFILTER=m
16201620
CONFIG_IP_NF_MATCH_TTL=m
1621-
CONFIG_IP_NF_FILTER=y
1621+
CONFIG_IP_NF_FILTER=m
16221622
CONFIG_IP_NF_TARGET_REJECT=m
16231623
CONFIG_IP_NF_TARGET_SYNPROXY=m
16241624
CONFIG_IP_NF_NAT=m
16251625
CONFIG_IP_NF_TARGET_MASQUERADE=m
16261626
CONFIG_IP_NF_TARGET_NETMAP=m
16271627
CONFIG_IP_NF_TARGET_REDIRECT=m
1628-
CONFIG_IP_NF_MANGLE=y
1628+
CONFIG_IP_NF_MANGLE=m
16291629
CONFIG_IP_NF_TARGET_ECN=m
16301630
CONFIG_IP_NF_TARGET_TTL=m
1631-
CONFIG_IP_NF_RAW=y
1632-
CONFIG_IP_NF_SECURITY=y
1631+
CONFIG_IP_NF_RAW=m
1632+
CONFIG_IP_NF_SECURITY=m
16331633
CONFIG_IP_NF_ARPTABLES=m
16341634
CONFIG_NFT_COMPAT_ARP=m
16351635
CONFIG_IP_NF_ARPFILTER=m
@@ -1639,7 +1639,7 @@ CONFIG_IP_NF_ARP_MANGLE=m
16391639
#
16401640
# IPv6: Netfilter Configuration
16411641
#
1642-
CONFIG_IP6_NF_IPTABLES_LEGACY=y
1642+
CONFIG_IP6_NF_IPTABLES_LEGACY=m
16431643
CONFIG_NF_SOCKET_IPV6=m
16441644
CONFIG_NF_TPROXY_IPV6=m
16451645
CONFIG_NF_TABLES_IPV6=y
@@ -1661,11 +1661,11 @@ CONFIG_IP6_NF_MATCH_RPFILTER=m
16611661
CONFIG_IP6_NF_MATCH_RT=m
16621662
CONFIG_IP6_NF_MATCH_SRH=m
16631663
CONFIG_IP6_NF_TARGET_HL=m
1664-
CONFIG_IP6_NF_FILTER=y
1664+
CONFIG_IP6_NF_FILTER=m
16651665
CONFIG_IP6_NF_TARGET_REJECT=m
16661666
CONFIG_IP6_NF_TARGET_SYNPROXY=m
1667-
CONFIG_IP6_NF_MANGLE=y
1668-
CONFIG_IP6_NF_RAW=y
1667+
CONFIG_IP6_NF_MANGLE=m
1668+
CONFIG_IP6_NF_RAW=m
16691669
CONFIG_IP6_NF_SECURITY=m
16701670
CONFIG_IP6_NF_NAT=m
16711671
CONFIG_IP6_NF_TARGET_MASQUERADE=m

‎packages/kernel-6.12/kernel-6.12.spec‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1072,12 +1072,17 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
10721072
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arp_tables.%{_ko}
10731073
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arpt_mangle.%{_ko}
10741074
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/arptable_filter.%{_ko}
1075+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ip_tables.%{_ko}
10751076
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_ah.%{_ko}
10761077
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_ECN.%{_ko}
10771078
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_REJECT.%{_ko}
10781079
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_rpfilter.%{_ko}
10791080
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/ipt_SYNPROXY.%{_ko}
1081+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_filter.%{_ko}
1082+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_mangle.%{_ko}
10801083
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_nat.%{_ko}
1084+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_raw.%{_ko}
1085+
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/iptable_security.%{_ko}
10811086
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_defrag_ipv4.%{_ko}
10821087
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_dup_ipv4.%{_ko}
10831088
%{_cross_kmoddir}/kernel/net/ipv4/netfilter/nf_nat_h323.%{_ko}
@@ -1119,6 +1124,7 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
11191124
%{_cross_kmoddir}/kernel/net/ipv6/ip6_vti.%{_ko}
11201125
%{_cross_kmoddir}/kernel/net/ipv6/ipcomp6.%{_ko}
11211126
%{_cross_kmoddir}/kernel/net/ipv6/mip6.%{_ko}
1127+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6_tables.%{_ko}
11221128
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_ah.%{_ko}
11231129
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_eui64.%{_ko}
11241130
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_frag.%{_ko}
@@ -1130,7 +1136,10 @@ install -p -m 0644 %{S:301} %{buildroot}%{_cross_bootconfigdir}/05-vmware.conf
11301136
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_rt.%{_ko}
11311137
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_srh.%{_ko}
11321138
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6t_SYNPROXY.%{_ko}
1139+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_filter.%{_ko}
1140+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_mangle.%{_ko}
11331141
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_nat.%{_ko}
1142+
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_raw.%{_ko}
11341143
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/ip6table_security.%{_ko}
11351144
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/nf_defrag_ipv6.%{_ko}
11361145
%{_cross_kmoddir}/kernel/net/ipv6/netfilter/nf_dup_ipv6.%{_ko}

0 commit comments

Comments
 (0)