Repository navigation
configs: Enable NFT_BRIDGE_META and NF_CONNTRACK_BRIDGE as modules - #7753
Merged
Merged
Conversation
nf_tables bridge support is already enabled, but two of its options are not: - NFT_BRIDGE_META provides the bridge meta keys (meta ibrname, obrname, ibrvproto, ibrpvid). Without it, rules using them fail with "Operation not supported". - NF_CONNTRACK_BRIDGE provides connection tracking for the bridge family. Without it, any ct expression in a bridge table (ct state, ct mark) fails with "Protocol error". Firewalls that filter traffic on bridge ports, such as between Docker containers on a bridge network, need both. Debian's kernels already build both as modules. Enable them as modules in the Pi defconfigs that build nf_tables bridge support.
Contributor
|
That looks reasonable - it just adds two moderately-sized module to the build (12kB and 14kB uncompressed, 2.5kB and 4kB compressed). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Pi defconfigs build nf_tables bridge support (
CONFIG_NF_TABLES_BRIDGE=m) but not two of its options, so common bridge-family rules fail to load. On a Pi 5 running 6.18.60+rpt-rpi-v8:meta ibrname/obrname(andibrvproto,ibrpvid) needCONFIG_NFT_BRIDGE_META.ctexpression in a bridge table needsCONFIG_NF_CONNTRACK_BRIDGE.The 6.18.60+rpt-rpi-2712 config lacks both too.
This patch enables both as modules in the five defconfigs that already enable
NF_TABLES_BRIDGE: bcm2711, bcm2711_rt and bcm2712 (arm64), and bcm2709 and bcmrpi (arm). Neither module loads unless a bridge-family ruleset uses it. Debian's kernels already build both as modules.Use case: dfw, a firewall for Docker containers on bridge networks, filters traffic on the bridge ports and needs both modules. With them it runs on the Pi 4 and Pi 5 as it does on Debian.