LWN: Comments on "The 6.17 kernel has been released"

legacy iptables broken

alanjwylie — Tue, 30 Sep 2025 06:08:45 +0000

I've just had a helpful email from Brad Spengler. Setting CONFIG_NETFILTER_XTABLES_LEGACY to y won't help in a config where it's previously defaulted to no, there are other options that will have been set to no at the same time. Starting afresh with a good config and setting it to y in "make oldconfig" should work.

legacy iptables broken

alanjwylie — Mon, 29 Sep 2025 20:05:58 +0000

> Replying to self... looks like iptables-nft should make the transition pretty easy. Does that not work for you?

I run Gentoo, which allows selection of nft

# eselect iptables list
Available iptables symlink targets:
[1] xtables-legacy-multi *
[2] xtables-nft-multi
#

I did try setting it to [2] at one point, but I'm not sure whether that was before or after I'd identified CONFIG_NETFILTER_XTABLES_LEGACY as possibly being implicated and rebuilt the kernel. Anyway, it didn't
help at that time. There may be other config options I need to set.

It's getting late here, I'm out tomorrow, a build of the kernel on my aging AMD FX-4300 with spinning rust takes ages.

I'll try again tomorrow evening.

legacy iptables broken

dskoll — Mon, 29 Sep 2025 19:09:34 +0000

Replying to self... looks like iptables-nft should make the transition pretty easy. Does that not work for you?

legacy iptables broken

dskoll — Mon, 29 Sep 2025 19:07:01 +0000

Ooh, thanks for the heads-up. I guess I'd better research the new way of doing things (nftables?) sigh

legacy iptables broken

alanjwylie — Mon, 29 Sep 2025 18:52:15 +0000

I'm still using legacy iptables.

During a "make oldconfig", CONFIG_NETFILTER_XTABLES_LEGACY defaulted to "n". On rebooting into 6.17.0 iptables wouldn't work. Even rebuilding with the option set to "y", things still weren't the same as with 6.16.9.

Not a bot

knewt — Mon, 29 Sep 2025 15:01:17 +0000

Possibly you had a non-expired cookie from Anubis for the "web." domain, so not triggering the challenge and bypassing the issue as a result?

Not a bot

jake — Mon, 29 Sep 2025 14:27:53 +0000

> I'm not sure why the redirect is causing anubis to get mixed up, but it's easy to just drop the "web." part.

When I checked those links last night, they worked fine, but they aren't now for me either, so I removed 'web.' as you suggest.

thanks,

jake

Not a bot

johill — Mon, 29 Sep 2025 10:19:48 +0000

As far as I've heard, Konstantin is phasing out web.git.kernel.org in favour of just git.kernel.org. I've seen a (near) infinite redirect on web.git.kernel.org from anubis, but the almost-same URLs work fine with just git.kernel.org instead. I'm not sure why the redirect is causing anubis to get mixed up, but it's easy to just drop the "web." part.

Not a bot

corbet — Mon, 29 Sep 2025 09:33:14 +0000

Any link policy that disallows linking into kernel.org would clearly pose certain difficulties here ... in any case, the link works for me, but I know that the bot protections there have occasionally had problems. I don't doubt that they will be worked out.

Not a bot

knewt — Mon, 29 Sep 2025 09:32:48 +0000

It appears to be a web.git.kernel.org issue, as when trying to follow the link myself just now I found what appeared to be an infinite loop. It did eventually pass me through, though it felt like that would never happen. I tried a couple more times to confirm, and got the same result.

Then found this: https://github.com/TecharoHQ/anubis/issues/1128 # Any link to Linux kernel Git repository at web.git.kernel.org causes infnite loop

So it seems to have been an issue for at least a couple of weeks now. I will note that it's the only Anubis-protected site that I've seen an issue with, so as noted in the issue it seems to be a site-specific issue. Not that this stops it being frustrating!

Not a bot

alfille — Mon, 29 Sep 2025 09:22:36 +0000

The link to DualPI2 is impossible because of the Bot test. At least for me. I understand the desire, but it makes browsing (and learning) difficult.

Is theres policy on links?