Re: Android boot failure with 6.12

[Florian Westphal <fw@strlen.de>]

Jozsef Kadlecsik <kadlec@netfilter.org> wrote:
> > nvm - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/net/netfilter/xt_mark.c?id=306ed1728e8438caed30332e1ab46b28c25fe3d8
> 
> Sorry, but I don't understand the patch at all. With it applied now it'd 
> be not possible to load in the "MARK" target with IPv4. The code segment 
> after the patch:
> 
> static struct xt_target mark_tg_reg[] __read_mostly = {
>         {
>                 .name           = "MARK",
>                 .revision       = 2,
>                 .family         = NFPROTO_IPV6,
>                 .target         = mark_tg,
>                 .targetsize     = sizeof(struct xt_mark_tginfo2),
>                 .me             = THIS_MODULE,
>         },
> #if IS_ENABLED(CONFIG_IP_NF_ARPTABLES)

Then you re-applied the patch, its already in 6.12.
NFPROTO_IPV6 is only set in the IP6_NF_IPTABLES section.

> Why the "IS_ENABLED(CONFIG_IP6_NF_IPTABLES)" part was not enough for the 
> IPv6-specific MARK target to be compiled in? Isn't it an issue about 
> selecting CONFIG_IP6_NF_IPTABLES vs CONFIG_IP6_NF_IPTABLES_LEGACY?

No, _LEGACY is about the set/gersockopt interface and the old
xt traversers, we could still use e.g. xt_mark.ko via NFT_COMPAT
interface.

> Also, why the "mark" match was not split into NFPROTO_IPV4, NFPROTO_ARP, 
> NFPROTO_IPV6 explicitly (and other matches where the target was split)?

mark match is fine, afaics.  Whats the concern?

The target got split because ebtables EBT_CONTINUE isn't equal to
XT_CONTINUE, so it won't do the right thing.