From c57bcf0d4352bf53edf436522918bbb3e75b43ec Mon Sep 17 00:00:00 2001 From: Romain Naour Date: Wed, 24 Jun 2026 14:51:52 +0200 Subject: [PATCH 1/3] package/iptables: improve kernel support for iptables-legacy and iptables-nft Since kernels 6.17, support for netfilter legacy tables were disabled by default [1] but iptables package needs Netfilter legacy tables support enabled in the kernel when nftables compat is not enabled. Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17. Fixes: [BRTEST# iptables --flush modprobe: module ip_tables not found in modules.dep iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. On the other hand, when nftables compat (iptables-nft) is used by default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable nft protocol support in the kernel. iptables --version iptables: Failed to initialize nft: Protocol not supported Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with CONFIG_NFT_SOCKET needed to pass the TestIptables with nftables compat (iptables-nft) enabled. Without CONFIG_NFT_SOCKET: iptables --policy INPUT ACCEPT iptables v1.8.11 (nf_tables): TABLE_ADD failed (Operation not supported): table filter So, enable kernel support for iptables-legacy only if nftables compat is not enabled by default. Enable iptables-nft support when nftables compat is enabled, even if not used by default. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6 Signed-off-by: Romain Naour [Fiona: fix typo in commit message] Signed-off-by: Fiona Klute --- package/iptables/iptables.mk | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk index a9d912f6cc9..bb01c07a432 100644 --- a/package/iptables/iptables.mk +++ b/package/iptables/iptables.mk @@ -49,11 +49,33 @@ else IPTABLES_CONF_OPTS += --disable-bpf-compiler --disable-nfsynproxy endif +# Enable kernel support for iptables-nft even if nftables compat is not +# enabled by default. +ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES),y) +define IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_NFT + $(call KCONFIG_ENABLE_OPT,CONFIG_NF_TABLES) + $(call KCONFIG_ENABLE_OPT,CONFIG_NF_TABLES_INET) + $(call KCONFIG_ENABLE_OPT,CONFIG_NFT_SOCKET) +endef +endif + +# Enable kernel support for iptables-legacy only if nftables compat is not +# enabled by default. +ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT),) +define IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_LEGACY + # [for Linux kernel versions 6.17 and later] + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES_LEGACY) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES_LEGACY) +endef +endif + define IPTABLES_LINUX_CONFIG_FIXUPS $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES) $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER) $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER) $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES) + $(IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_LEGACY) + $(IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_NFT) endef define IPTABLES_INSTALL_INIT_SYSV From 1b2f65bbe942ae3f662294bad5cbb839475db92e Mon Sep 17 00:00:00 2001 From: Romain Naour Date: Wed, 24 Jun 2026 14:51:53 +0200 Subject: [PATCH 2/3] support/testing: TestIptables: check for netfilter legacy tables enabled TestIptables expect netfilter legacy tables enabled in the kernel. Make sure we use iptables-legacy: iptables --version iptables v1.8.11 (legacy) The test would fail if nftables compat (iptables-nft) is enabled. iptables --version iptables v1.8.11 (nf_tables) Add the following configuration fragment to enable iptables-nft: BR2_PACKAGE_IPTABLES_NFTABLES=y BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y Acked-by: Fiona Klute Tested-by: Fiona Klute Signed-off-by: Romain Naour Signed-off-by: Fiona Klute --- support/testing/tests/package/test_iptables.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/support/testing/tests/package/test_iptables.py b/support/testing/tests/package/test_iptables.py index 72f2dd71a4f..eeb4ccb5dd7 100644 --- a/support/testing/tests/package/test_iptables.py +++ b/support/testing/tests/package/test_iptables.py @@ -38,7 +38,10 @@ def test_run(self): self.emulator.login() # We check the program can execute. - self.assertRunOk("iptables --version") + cmd = "iptables --version" + output, exit_code = self.emulator.run(cmd) + self.assertEqual(exit_code, 0) + self.assertTrue(output[0].endswith("(legacy)")) # We delete all rules in all chains. We also set default # policies to ACCEPT for INPUT and OUTPUT chains. This should From 92214c922de4f789dd8f1211e85e2cc77f62e189 Mon Sep 17 00:00:00 2001 From: Romain Naour Date: Wed, 24 Jun 2026 14:51:54 +0200 Subject: [PATCH 3/3] support/testing: TestIptables: bump kernel to 6.18 LTS Tested-by: Fiona Klute Signed-off-by: Romain Naour Signed-off-by: Fiona Klute --- support/testing/tests/package/test_iptables.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/support/testing/tests/package/test_iptables.py b/support/testing/tests/package/test_iptables.py index eeb4ccb5dd7..918fa4fb297 100644 --- a/support/testing/tests/package/test_iptables.py +++ b/support/testing/tests/package/test_iptables.py @@ -15,7 +15,7 @@ class TestIptables(infra.basetest.BRTest): BR2_TARGET_GENERIC_GETTY_PORT="ttyAMA0" BR2_LINUX_KERNEL=y BR2_LINUX_KERNEL_CUSTOM_VERSION=y - BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.1.82" + BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36" BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/aarch64-virt/linux.config" BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y