armbian build machinery - force all iptables/nftables to be built

Author: tabris

lib/functions/compilation/armbian-kernel.sh

@@ -191,6 +191,185 @@ function armbian_kernel_config__enable_zram_support() {
 	fi
 }
 
+# Enables almost all IPTABLES/NFTABLES options as modules [whilst 
+# allowing them to be built-in]. no particular modules are intentionally 
+# excluded, but this author doesn't want to claim it's 100.00% 
+# comprehensive, in case more are added or some oversight is found. 
+# split in part from armbian_kernel_config__enable_docker_support.
+#
+function armbian_kernel_config__select_nftables() {
+	if [[ -f .config ]]; then
+		kernel_config_set_m BRIDGE_NETFILTER
+		kernel_config_set_m IP6_NF_FILTER
+		kernel_config_set_m IP6_NF_IPTABLES_LEGACY
+		kernel_config_set_m IP6_NF_IPTABLES
+		kernel_config_set_m IP6_NF_MANGLE
+		kernel_config_set_m IP6_NF_MATCH_AH
+		kernel_config_set_m IP6_NF_MATCH_EUI64
+		kernel_config_set_m IP6_NF_MATCH_FRAG
+		kernel_config_set_m IP6_NF_MATCH_HL
+		kernel_config_set_m IP6_NF_MATCH_IPV6HEADER
+		kernel_config_set_m IP6_NF_MATCH_MH
+		kernel_config_set_m IP6_NF_MATCH_OPTS
+		kernel_config_set_m IP6_NF_MATCH_RPFILTER
+		kernel_config_set_m IP6_NF_MATCH_RT
+		kernel_config_set_m IP6_NF_MATCH_SRH
+		kernel_config_set_m IP6_NF_NAT
+		kernel_config_set_m IP6_NF_RAW
+		kernel_config_set_m IP6_NF_SECURITY
+		kernel_config_set_m IP6_NF_TARGET_HL
+		kernel_config_set_m IP6_NF_TARGET_MASQUERADE
+		kernel_config_set_m IP6_NF_TARGET_NPT
+		kernel_config_set_m IP6_NF_TARGET_REJECT
+		kernel_config_set_m IP6_NF_TARGET_SYNPROXY
+		kernel_config_set_m IP_NF_IPTABLES_LEGACY
+		kernel_config_set_m IP_NF_IPTABLES
+		kernel_config_set_m NET_ACT_IPT
+		kernel_config_set_m NET_EMATCH_IPT
+		kernel_config_set_y NETFILTER_ADVANCED
+		kernel_config_set_y NETFILTER_BPF_LINK
+		kernel_config_set_m NETFILTER_CONNCOUNT
+		kernel_config_set_y NETFILTER_EGRESS
+		kernel_config_set_y NETFILTER_FAMILY_ARP
+		kernel_config_set_y NETFILTER_FAMILY_BRIDGE
+		kernel_config_set_y NETFILTER_INGRESS
+		kernel_config_set_m NETFILTER_NETLINK_ACCT
+		kernel_config_set_y NETFILTER_NETLINK_GLUE_CT
+		kernel_config_set_m NETFILTER_NETLINK_HOOK
+		kernel_config_set_m NETFILTER_NETLINK_LOG
+		kernel_config_set_m NETFILTER_NETLINK
+		kernel_config_set_m NETFILTER_NETLINK_OSF
+		kernel_config_set_m NETFILTER_NETLINK_QUEUE
+		kernel_config_set_m NETFILTER_SYNPROXY
+		kernel_config_set_y NETFILTER_XTABLES_COMPAT
+		kernel_config_set_m NETFILTER_XTABLES
+		kernel_config_set_m NETFILTER_XT_CONNMARK
+		kernel_config_set_m NETFILTER_XT_MARK
+		kernel_config_set_m NETFILTER_XT_MATCH_ADDRTYPE
+		kernel_config_set_m NETFILTER_XT_MATCH_BPF
+		kernel_config_set_m NETFILTER_XT_MATCH_CGROUP
+		kernel_config_set_m NETFILTER_XT_MATCH_CLUSTER
+		kernel_config_set_m NETFILTER_XT_MATCH_COMMENT
+		kernel_config_set_m NETFILTER_XT_MATCH_CONNBYTES
+		kernel_config_set_m NETFILTER_XT_MATCH_CONNLABEL
+		kernel_config_set_m NETFILTER_XT_MATCH_CONNLIMIT
+		kernel_config_set_m NETFILTER_XT_MATCH_CONNMARK
+		kernel_config_set_m NETFILTER_XT_MATCH_CONNTRACK
+		kernel_config_set_m NETFILTER_XT_MATCH_CPU
+		kernel_config_set_m NETFILTER_XT_MATCH_DCCP
+		kernel_config_set_m NETFILTER_XT_MATCH_DEVGROUP
+		kernel_config_set_m NETFILTER_XT_MATCH_DSCP
+		kernel_config_set_m NETFILTER_XT_MATCH_ECN
+		kernel_config_set_m NETFILTER_XT_MATCH_ESP
+		kernel_config_set_m NETFILTER_XT_MATCH_HASHLIMIT
+		kernel_config_set_m NETFILTER_XT_MATCH_HELPER
+		kernel_config_set_m NETFILTER_XT_MATCH_HL
+		kernel_config_set_m NETFILTER_XT_MATCH_IPCOMP
+		kernel_config_set_m NETFILTER_XT_MATCH_IPRANGE
+		kernel_config_set_m NETFILTER_XT_MATCH_IPVS
+		kernel_config_set_m NETFILTER_XT_MATCH_L2TP
+		kernel_config_set_m NETFILTER_XT_MATCH_LENGTH
+		kernel_config_set_m NETFILTER_XT_MATCH_LIMIT
+		kernel_config_set_m NETFILTER_XT_MATCH_MAC
+		kernel_config_set_m NETFILTER_XT_MATCH_MARK
+		kernel_config_set_m NETFILTER_XT_MATCH_MULTIPORT
+		kernel_config_set_m NETFILTER_XT_MATCH_NFACCT
+		kernel_config_set_m NETFILTER_XT_MATCH_OSF
+		kernel_config_set_m NETFILTER_XT_MATCH_OWNER
+		kernel_config_set_m NETFILTER_XT_MATCH_PHYSDEV
+		kernel_config_set_m NETFILTER_XT_MATCH_PKTTYPE
+		kernel_config_set_m NETFILTER_XT_MATCH_POLICY
+		kernel_config_set_m NETFILTER_XT_MATCH_QUOTA
+		kernel_config_set_m NETFILTER_XT_MATCH_RATEEST
+		kernel_config_set_m NETFILTER_XT_MATCH_REALM
+		kernel_config_set_m NETFILTER_XT_MATCH_RECENT
+		kernel_config_set_m NETFILTER_XT_MATCH_SCTP
+		kernel_config_set_m NETFILTER_XT_MATCH_SOCKET
+		kernel_config_set_m NETFILTER_XT_MATCH_STATE
+		kernel_config_set_m NETFILTER_XT_MATCH_STATISTIC
+		kernel_config_set_m NETFILTER_XT_MATCH_STRING
+		kernel_config_set_m NETFILTER_XT_MATCH_TCPMSS
+		kernel_config_set_m NETFILTER_XT_MATCH_TIME
+		kernel_config_set_m NETFILTER_XT_MATCH_U32
+		kernel_config_set_m NETFILTER_XT_NAT
+		kernel_config_set_m NETFILTER_XT_SET
+		kernel_config_set_m NETFILTER_XT_TARGET_AUDIT
+		kernel_config_set_m NETFILTER_XT_TARGET_CHECKSUM
+		kernel_config_set_m NETFILTER_XT_TARGET_CLASSIFY
+		kernel_config_set_m NETFILTER_XT_TARGET_CONNMARK
+		kernel_config_set_m NETFILTER_XT_TARGET_CONNSECMARK
+		kernel_config_set_m NETFILTER_XT_TARGET_CT
+		kernel_config_set_m NETFILTER_XT_TARGET_DSCP
+		kernel_config_set_m NETFILTER_XT_TARGET_FLOWOFFLOAD
+		kernel_config_set_m NETFILTER_XT_TARGET_HL
+		kernel_config_set_m NETFILTER_XT_TARGET_HMARK
+		kernel_config_set_m NETFILTER_XT_TARGET_IDLETIMER
+		kernel_config_set_m NETFILTER_XT_TARGET_LED
+		kernel_config_set_m NETFILTER_XT_TARGET_LOG
+		kernel_config_set_m NETFILTER_XT_TARGET_MARK
+		kernel_config_set_m NETFILTER_XT_TARGET_MASQUERADE
+		kernel_config_set_m NETFILTER_XT_TARGET_NETMAP
+		kernel_config_set_m NETFILTER_XT_TARGET_NFLOG
+		kernel_config_set_m NETFILTER_XT_TARGET_NFQUEUE
+		kernel_config_set_m NETFILTER_XT_TARGET_NOTRACK
+		kernel_config_set_m NETFILTER_XT_TARGET_RATEEST
+		kernel_config_set_m NETFILTER_XT_TARGET_REDIRECT
+		kernel_config_set_m NETFILTER_XT_TARGET_SECMARK
+		kernel_config_set_m NETFILTER_XT_TARGET_TCPMSS
+		kernel_config_set_m NETFILTER_XT_TARGET_TCPOPTSTRIP
+		kernel_config_set_m NETFILTER_XT_TARGET_TEE
+		kernel_config_set_m NETFILTER_XT_TARGET_TPROXY
+		kernel_config_set_m NETFILTER_XT_TARGET_TRACE
+		kernel_config_set_y NETFILTER
+		kernel_config_set_m NET_IP_TUNNEL
+		kernel_config_set_y NF_TABLES_ARP
+		kernel_config_set_m NF_TABLES_BRIDGE
+		kernel_config_set_y NF_TABLES_INET
+		kernel_config_set_y NF_TABLES_IPV4
+		kernel_config_set_y NF_TABLES_IPV6
+		kernel_config_set_m NF_TABLES
+		kernel_config_set_y NF_TABLES_NETDEV
+		kernel_config_set_m NFT_BRIDGE_META
+		kernel_config_set_m NFT_BRIDGE_REJECT
+		kernel_config_set_m NFT_COMPAT_ARP
+		kernel_config_set_m NFT_COMPAT
+		kernel_config_set_m NFT_CONNLIMIT
+		kernel_config_set_m NFT_COUNTER
+		kernel_config_set_m NFT_CT
+		kernel_config_set_m NFT_DUP_IPV4
+		kernel_config_set_m NFT_DUP_IPV6
+		kernel_config_set_m NFT_DUP_NETDEV
+		kernel_config_set_m NFT_FIB_INET
+		kernel_config_set_m NFT_FIB_IPV4
+		kernel_config_set_m NFT_FIB_IPV6
+		kernel_config_set_m NFT_FIB
+		kernel_config_set_m NFT_FIB_NETDEV
+		kernel_config_set_m NFT_FLOW_OFFLOAD
+		kernel_config_set_m NFT_FWD_NETDEV
+		kernel_config_set_m NFT_HASH
+		kernel_config_set_m NFT_LIMIT
+		kernel_config_set_m NFT_LOG
+		kernel_config_set_m NFT_MASQ
+		kernel_config_set_m NFT_NAT
+		kernel_config_set_m NFT_NUMGEN
+		kernel_config_set_m NFT_OBJREF
+		kernel_config_set_m NFT_OSF
+		kernel_config_set_m NFT_QUEUE
+		kernel_config_set_m NFT_QUOTA
+		kernel_config_set_m NFT_REDIR
+		kernel_config_set_m NFT_REJECT_INET
+		kernel_config_set_m NFT_REJECT_IPV4
+		kernel_config_set_m NFT_REJECT_IPV6
+		kernel_config_set_m NFT_REJECT
+		kernel_config_set_m NFT_REJECT_NETDEV
+		kernel_config_set_m NFT_SOCKET
+		kernel_config_set_m NFT_SYNPROXY
+		kernel_config_set_m NFT_TPROXY
+		kernel_config_set_m NFT_TUNNEL
+		kernel_config_set_m NFT_XFRM
+	fi
+}
+
 # Enables Docker support by configuring a comprehensive set of kernel options required for Docker functionality.
 #
 # Globals:
@@ -232,34 +411,17 @@ function armbian_kernel_config__enable_docker_support() {
 		kernel_config_set_m CRYPTO_SEQIV                    # Enables sequential initialization vector support for cryptographic operations
 		kernel_config_set_y EVENTFD                         # Enables eventfd system calls for event notification
 		kernel_config_set_y BPF_SYSCALL                     # Enables BPF (Berkeley Packet Filter) system call support
-		kernel_config_set_y NF_TABLES                       # Enables nf_tables framework support
-		kernel_config_set_y NF_TABLES_INET                  # Enables IPv4 and IPv6 support for nf_tables
-		kernel_config_set_y NF_TABLES_NETDEV                # Enables netdevice support for nf_tables
 		kernel_config_set_y CFS_BANDWIDTH                   # Enables bandwidth control for CFS (Completely Fair Scheduler)
 		kernel_config_set_m DUMMY                           # Enables dummy network driver module
 		kernel_config_set_y DEVPTS_MULTIPLE_INSTANCES       # Enables multiple instances of devpts (pseudo-terminal master/slave pairs)
 		kernel_config_set_y ENCRYPTED_KEYS                  # Enables support for encrypted keys in the kernel
 		kernel_config_set_m EXT4_FS                         # Enables EXT4 file system support as a module
 		kernel_config_set_y EXT4_FS_POSIX_ACL               # Enables POSIX ACL support for EXT4
 		kernel_config_set_y EXT4_FS_SECURITY                # Enables security extensions for EXT4 file system
-		kernel_config_set_m IP6_NF_FILTER                   # Enables IPv6 netfilter filtering support
-		kernel_config_set_m IP6_NF_MANGLE                   # Enables IPv6 netfilter mangling support
-		kernel_config_set_m IP6_NF_NAT                      # Enables IPv6 network address translation support
-		kernel_config_set_m IP6_NF_RAW                      # Enables raw support for IPv6 netfilter
-		kernel_config_set_m IP6_NF_SECURITY                 # Enables IPv6 netfilter security features
-		kernel_config_set_m IP6_NF_TARGET_MASQUERADE        # Enables IPv6 netfilter target for masquerading (NAT)
 		kernel_config_set_m IPVLAN                          # Enables IPvlan network driver support
 		kernel_config_set_y INET                            # Enables Internet protocol (IPv4) support
 		kernel_config_set_y FAIR_GROUP_SCHED                # Enables fair group scheduling support
 		kernel_config_set_m INET_ESP                        # Enables ESP (Encapsulating Security Payload) for IPv4
-		kernel_config_set_y IP_NF_FILTER                    # Enables IPv4 netfilter filtering support
-		kernel_config_set_m IP_NF_TARGET_MASQUERADE         # Enables IPv4 netfilter target for masquerading (NAT)
-		kernel_config_set_m IP_NF_TARGET_NETMAP             # Enables IPv4 netfilter target for netmap
-		kernel_config_set_m IP_NF_TARGET_REDIRECT           # Enables IPv4 netfilter target for redirect
-		kernel_config_set_y IP_NF_IPTABLES                  # Enables iptables for IPv4
-		kernel_config_set_m IP_NF_NAT                       # Enables NAT (Network Address Translation) support for IPv4
-		kernel_config_set_m IP_NF_RAW                       # Enables raw support for IPv4 netfilter
-		kernel_config_set_y IP_NF_SECURITY                  # Enables security features for IPv4 netfilter
 		kernel_config_set_y IP_VS_NFCT                      # Enables connection tracking for IPVS (IP Virtual Server)
 		kernel_config_set_y IP_VS_PROTO_TCP                 # Enables TCP protocol support for IPVS
 		kernel_config_set_y IP_VS_PROTO_UDP                 # Enables UDP protocol support for IPVS
@@ -270,49 +432,11 @@ function armbian_kernel_config__enable_docker_support() {
 		kernel_config_set_m MACVLAN                         # Enables MACVLAN network driver support
 		kernel_config_set_y MEMCG                           # Enables memory controller for cgroups
 		kernel_config_set_y MEMCG_KMEM                      # Enables memory controller for kmem (kernel memory) cgroups
-		kernel_config_set_m NFT_NAT                         # Enables NAT (Network Address Translation) support in nftables
-		kernel_config_set_m NFT_TUNNEL                      # Enables tunneling support in nftables
-		kernel_config_set_m NFT_QUOTA                       # Enables quota support in nftables
-		kernel_config_set_m NFT_REJECT                      # Enables reject target support in nftables
-		kernel_config_set_m NFT_COMPAT                      # Enables compatibility support for older nftables versions
-		kernel_config_set_m NFT_HASH                        # Enables hash-based set operations support in nftables
-		kernel_config_set_m NFT_XFRM                        # Enables transformation support in nftables
-		kernel_config_set_m NFT_SOCKET                      # Enables socket operations support in nftables
-		kernel_config_set_m NFT_TPROXY                      # Enables transparent proxy support in nftables
-		kernel_config_set_m NFT_SYNPROXY                    # Enables SYN proxy support in nftables
-		kernel_config_set_m NFT_DUP_NETDEV                  # Enables duplicate netdev (network device) support in nftables
-		kernel_config_set_m NFT_FWD_NETDEV                  # Enables forward netdev support in nftables
-		kernel_config_set_m NFT_REJECT_NETDEV               # Enables reject netdev support in nftables
-		kernel_config_set_m NF_CONNMARK_IPV4                # Enables connection mark support for IPv4 netfilter
-		kernel_config_set_y NF_CONNTRACK                    # Enables connection tracking support
-		kernel_config_set_m NF_CONNTRACK_FTP                # Enables FTP connection tracking support
-		kernel_config_set_m NF_CONNTRACK_IRC                # Enables IRC connection tracking support
-		kernel_config_set_y NF_CONNTRACK_MARK               # Enables connection mark support in netfilter
-		kernel_config_set_m NF_CONNTRACK_PPTP               # Enables PPTP connection tracking support
-		kernel_config_set_m NF_CONNTRACK_TFTP               # Enables TFTP connection tracking support
-		kernel_config_set_y NF_CONNTRACK_ZONES              # Enables connection tracking zones support
-		kernel_config_set_y NF_CONNTRACK_EVENTS             # Enables connection tracking events support
-		kernel_config_set_y NF_CONNTRACK_LABELS             # Enables connection tracking labels support
-		kernel_config_set_m NF_NAT                          # Enables NAT support in nf_conntrack
-		kernel_config_set_m NF_NAT_MASQUERADE_IPV4          # Enables IPv4 masquerading for NAT in nf_conntrack
-		kernel_config_set_m NF_NAT_IPV4                     # Enables IPv4 NAT support in nf_conntrack
-		kernel_config_set_m NF_NAT_NEEDED                   # Enables NAT support in nf_conntrack when needed
-		kernel_config_set_m NF_NAT_FTP                      # Enables FTP NAT support in nf_conntrack
-		kernel_config_set_m NF_NAT_TFTP                     # Enables TFTP NAT support in nf_conntrack
 		kernel_config_set_m NET_CLS_CGROUP                  # Enables network classification using cgroups
 		kernel_config_set_y NET_CORE                        # Enables core networking stack support
 		kernel_config_set_y NET_L3_MASTER_DEV               # Enables master device support for Layer 3 (L3) networking
 		kernel_config_set_y NET_NS                          # Enables network namespace support
 		kernel_config_set_y NET_SCHED                       # Enables network scheduler support
-		kernel_config_set_y NETFILTER                       # Enables support for netfilter framework
-		kernel_config_set_y NETFILTER_ADVANCED              # Enables advanced netfilter options
-		kernel_config_set_m NETFILTER_XT_MATCH_ADDRTYPE     # Enables address type matching for netfilter
-		kernel_config_set_m NETFILTER_XT_MATCH_BPF          # Enables BPF match support in netfilter
-		kernel_config_set_m NETFILTER_XT_MATCH_CONNTRACK    # Enables connection tracking match support in netfilter
-		kernel_config_set_m NETFILTER_XT_MATCH_IPVS         # Enables IPVS match support in netfilter
-		kernel_config_set_m NETFILTER_XT_MARK               # Enables mark matching for netfilter
-		kernel_config_set_m NETFILTER_XTABLES               # Enables x_tables support in netfilter
-		kernel_config_set_m NETFILTER_XT_TARGET_MASQUERADE  # Enables masquerade target for netfilter
 		kernel_config_set_y NETDEVICES                      # Enables support for network devices
 		kernel_config_set_y NAMESPACES                      # Enables support for namespaces (including network namespaces)
 		kernel_config_set_m OVERLAY_FS                      # Enables support for OverlayFS