Re: [PATCH iproute2-next v2] remove support for iptables action

[Jamal Hadi Salim <jhs@mojatatu.com>]

On Thu, Jan 4, 2024 at 9:33 PM Eyal Birger <eyal.birger@gmail.com> wrote:
>
> Hi,
>
> On Thu, Jan 4, 2024 at 8:15 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> >
> > On Thu, Jan 4, 2024 at 10:25 AM Jakub Kicinski <kuba@kernel.org> wrote:
> > >
> > > On Wed, 27 Dec 2023 12:25:24 -0500 Jamal Hadi Salim wrote:
> > > > On Tue, Dec 26, 2023 at 1:25 PM Stephen Hemminger
> > > > <stephen@networkplumber.org> wrote:
> > > > >
> > > > > There is an open upstream kernel patch to remove ipt action from
> > > > > kernel. This is corresponding iproute2 change.
> > > > >
> > > > >  - Remove support fot ipt and xt in tc.
> > > > >  - Remove no longer used header files.
> > > > >  - Update man pages.
> > > > >
> > > > > Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> > > >
> > > > Does em_ipt need the m_xt*.c? Florian/Eyal can comment. Otherwise,
> > > > Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
> > >
> > > Damn, I was waiting for Eyal to comment but you didn't CC
> > > either him or Florian 😆️
> > >
> > > Eyal, would it be possible for you to test if the latest
> > > net-next and iproute2 with this patch works for you?
> >
> > Sorry bout that. Also Florian (who wrote the code).
>
> I tested and it looks like the patch doesn't affect em_ipt, as expected.
>
> I did however run into a related issue while testing - seems that
> using the old "ingress" qdisc - that em_ipt iproute2 code still uses -
> isn't working, i.e:
>
> $ tc qdisc add dev ipsec1 ingress
> Error: Egress block dev insert failed.
>
> This seems to originate from recent commit 913b47d3424e
> ("net/sched: Introduce tc block netdev tracking infra").
>
> When I disabled that code in my build I was able to use em_ipt
> as expected.

Resolved in: https://lore.kernel.org/netdev/20240104125844.1522062-1-jiri@resnulli.us/
Eyal, if you have cycles please give it a try. Jakub, can we get that applied?

cheers,
jamal
> Eyal.