linux-2.6.16 features changes making iptables deactivated, if we don't manually activate the new options for it... An `ewarn` in the gentoo-sources ebuild is absolutely *REQUIRED*... Even when iptables is not loaded, the network connections are established, so if someone does not check the boot log, he will be connected without a firewall and obviously without firewall logs... There's a Gentoo forum thread about it: http://forums.gentoo.org/viewtopic-t-446271.html
I don't understand this bug report. You are reporting that netfilter is now disabled by default, whereas it was enabled by default in 2.6.15?
(In reply to comment #1) > I don't understand this bug report. You are reporting that netfilter is now > disabled by default, whereas it was enabled by default in 2.6.15? Nah, I believe he's referring to the Xtables thing.
I still don't follow. He's saying that iptables is enabled by default on 2.6.15, but the 2.6.16 equivalent (xtables) is not?
(In reply to comment #3) > I still don't follow. He's saying that iptables is enabled by default on > 2.6.15, but the 2.6.16 equivalent (xtables) is not? > I report that the options to activate iptables have been changed, so when we update (and use a previous kernel configuration), iptables is not activated without activating the new options... I don't think most people check the linux changelog, so a warning is required, because, as said, if the user don't check the boot log, he will be connected without a firewall...
Ok, thanks for the explanation. We discourage reusing kernel configs between real kernel upgrades (e.g. 2.6.15 to 2.6.16) because too much changes to make this a practical option. Reusing config is only safe over revision updates (e.g. 2.6.16 to 2.6.16-r1). There is a note in the kernel upgrade guide about this.
(In reply to comment #5) > Ok, thanks for the explanation. > > We discourage reusing kernel configs between real kernel upgrades (e.g. 2.6.15 > to 2.6.16) because too much changes to make this a practical option. Reusing > config is only safe over revision updates (e.g. 2.6.16 to 2.6.16-r1). There is > a note in the kernel upgrade guide about this. > Well, I guess I'll be more careful next time (as anyone who ran into the problem), but you can't except most people to check the whole kernel configuration, even once every few months... (it takes hours to do it, when you seldom do it...). A warning really is required, for major changes like this, moreover when security is involved...
This will become easier when emerge news is available, but I'm still not sure this would be a suitable candidate. Also, we do provide genkernel for those who can not afford to spend some time every 2 months configuring a kernel. Thanks for the feedback.
