mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
c57bcf0d43
Since kernels 6.17, support for netfilter legacy tables were disabled by default [1] but iptables package needs Netfilter legacy tables support enabled in the kernel when nftables compat is not enabled. Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17. Fixes: [BRTEST# iptables --flush modprobe: module ip_tables not found in modules.dep iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. On the other hand, when nftables compat (iptables-nft) is used by default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable nft protocol support in the kernel. iptables --version iptables: Failed to initialize nft: Protocol not supported Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with CONFIG_NFT_SOCKET needed to pass the TestIptables with nftables compat (iptables-nft) enabled. Without CONFIG_NFT_SOCKET: iptables --policy INPUT ACCEPT iptables v1.8.11 (nf_tables): TABLE_ADD failed (Operation not supported): table filter So, enable kernel support for iptables-legacy only if nftables compat is not enabled by default. Enable iptables-nft support when nftables compat is enabled, even if not used by default. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6 Signed-off-by: Romain Naour <romain.naour@smile.fr> [Fiona: fix typo in commit message] Signed-off-by: Fiona Klute <fiona.klute@gmx.de>