Florian Westphal <fw@xxxxxxxxx> wrote: > ./extensions/libxt_TCPOPTSTRIP.t: ERROR: line 4 (cannot load: ip6tables -A PREROUTING -t mangle -p tcp -j TCPOPTSTRIP) > ./extensions/libxt_TCPOPTSTRIP.t: ERROR: line 5 (cannot load: ip6tables -A PREROUTING -t mangle -p tcp -j TCPOPTSTRIP --strip-options 2,3,4,5,6,7) > > The kernel module has a 'defined' check for ipv6 mangle table, not sure > yet how to replace this (ipv4 works). Probably best to replace two IS_ENABLED(CONFIG_IP6_NF_MANGLE) with IS_ENABLED(CONFIG_IP6_NF_IPTABLES) The Kconfig dependencies require either NFT_COMPAT or IP6_NF_MANGLE. With the planned LEGACY change MANGLE table isn't set anymore but NFT_COMPAT is. For existing cases (LEGACY set) there would be no difference in behavior given MANGLE is a subset of IP6_NF_IPTABLES. We should propbably also select CONFIG_IP6_NF_IPTABLES in case CONFIG_IP6_NF_IPTABLES=y|m to make sure you can't create a kernel with CONFIG_IP6_NF_IPTABLES=n CONFIG_IP6_NF_IPTABLES_LEGACY=m|y
