Hi, On Fri, 10 Jan 2025, Maciej Żenczykowski wrote: > nvm - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/netfilter/xt_mark.c?id=306ed1728e8438caed30332e1ab46b28c25fe3d8 Sorry, but I don't understand the patch at all. With it applied now it'd be not possible to load in the "MARK" target with IPv4. The code segment after the patch: static struct xt_target mark_tg_reg[] __read_mostly = { { .name = "MARK", .revision = 2, .family = NFPROTO_IPV6, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE, }, #if IS_ENABLED(CONFIG_IP_NF_ARPTABLES) { .name = "MARK", .revision = 2, .family = NFPROTO_ARP, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE, }, #endif #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) { .name = "MARK", .revision = 2, .family = NFPROTO_IPV6, .target = mark_tg, .targetsize = sizeof(struct xt_mark_tginfo2), .me = THIS_MODULE, }, #endif }; How is it supposed to work for IPv4? Why the "IS_ENABLED(CONFIG_IP6_NF_IPTABLES)" part was not enough for the IPv6-specific MARK target to be compiled in? Isn't it an issue about selecting CONFIG_IP6_NF_IPTABLES vs CONFIG_IP6_NF_IPTABLES_LEGACY? Also, why the "mark" match was not split into NFPROTO_IPV4, NFPROTO_ARP, NFPROTO_IPV6 explicitly (and other matches where the target was split)? Best regards, Jozsef -- E-mail : kadlec@xxxxxxxxxxxxx, kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx Address: Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary
