From d045db2f41b5dea92634ef1f82b82e206b9f8aaf Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Mon, 20 Jul 2026 13:12:24 -0700 Subject: [PATCH 1/4] Enable xtables statistic match for all platforms Allows kube-proxy in iptables mode and other networking tools to use probabilistic packet matching for load balancing across multiple endpoints. e.g. `iptables -m statistic ...` Sets CONFIG_NETFILTER_XT_MATCH_STATISTIC=y On arm64, enable two Xtables options needed, already set on x86_64 CONFIG_NETFILTER_XT_MATCH_COMMENT=y CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y Signed-off-by: Christian Kruse --- configs/arm64/6.1.158.config | 6 +++--- configs/x86_64/6.1.158.config | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index 77a1050..b42987c 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1162,7 +1162,7 @@ CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y # CONFIG_NETFILTER_XT_MATCH_BPF is not set # CONFIG_NETFILTER_XT_MATCH_CGROUP is not set # CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set -# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set +CONFIG_NETFILTER_XT_MATCH_COMMENT=y # CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set # CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set # CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set @@ -1184,7 +1184,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_LIMIT is not set # CONFIG_NETFILTER_XT_MATCH_MAC is not set # CONFIG_NETFILTER_XT_MATCH_MARK is not set -# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_NFACCT is not set # CONFIG_NETFILTER_XT_MATCH_OSF is not set # CONFIG_NETFILTER_XT_MATCH_OWNER is not set @@ -1198,7 +1198,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set -# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_STRING is not set # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set # CONFIG_NETFILTER_XT_MATCH_TIME is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 2129f5d..3c89091 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1203,7 +1203,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set -# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y # CONFIG_NETFILTER_XT_MATCH_STRING is not set # CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set # CONFIG_NETFILTER_XT_MATCH_TIME is not set From a2bbe7e4919a0322b6b86627e229e91b3878d8b4 Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Tue, 21 Jul 2026 11:33:02 -0700 Subject: [PATCH 2/4] Enable nftables numgen and fib expressions for x86_64 Allows kube-proxy in nftables mode and other networking tools to use random number generation for endpoint selection and forwarding information base lookups for local-address dispatch. e.g. `nft add rule ... numgen random mod 1 map { ... }`, `nft add rule ... fib daddr type local` Sets CONFIG_NFT_NUMGEN=y Sets CONFIG_NFT_FIB_IPV4=y (selects CONFIG_NFT_FIB=y) Sets CONFIG_NFT_FIB_IPV6=y Signed-off-by: Christian Kruse --- configs/x86_64/6.1.158.config | 3 +++ 1 file changed, 3 insertions(+) diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 3c89091..6612c70 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1101,6 +1101,7 @@ CONFIG_NF_TABLES_IPV4=y CONFIG_NF_TABLES_IPV6=y CONFIG_NFT_EXTHDR=y CONFIG_NFT_META=y +CONFIG_NFT_NUMGEN=y CONFIG_NFT_CT=y CONFIG_NFT_RBTREE=y CONFIG_NFT_HASH=y @@ -1116,11 +1117,13 @@ CONFIG_NFT_REJECT_INET=y CONFIG_NFT_COMPAT=y CONFIG_NFT_CHAIN_ROUTE_IPV4=y CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_FIB_IPV4=y CONFIG_NFT_CHAIN_NAT_IPV4=y CONFIG_NFT_MASQ_IPV4=y # CONFIG_NFT_REDIR_IPV4 is not set CONFIG_NFT_CHAIN_ROUTE_IPV6=y CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_FIB_IPV6=y CONFIG_NFT_CHAIN_NAT_IPV6=y CONFIG_NFT_MASQ_IPV6=y # CONFIG_NFT_REDIR_IPV6 is not set From 1849240d7a76d2152360faf7d6d4d120c1326b77 Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Tue, 21 Jul 2026 13:16:10 -0700 Subject: [PATCH 3/4] Enable nftables NFQUEUE policy enforcement for x86_64 Allows kindnetd using the kube-network-policies reference implementation, firewalls, and other networking tools to enforce policy via first-packet NFQUEUE inspection with conntrack label caching. e.g. `nft add table inet ...`, `nft add rule ... queue num 101 bypass`, `ct label set 28` Sets CONFIG_NF_TABLES_INET=y Sets CONFIG_NETFILTER_NETLINK_QUEUE=y Sets CONFIG_NETFILTER_NETLINK_GLUE_CT=y Sets CONFIG_NF_CT_NETLINK=y Signed-off-by: Christian Kruse --- configs/x86_64/6.1.158.config | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 6612c70..4cb875f 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1060,7 +1060,8 @@ CONFIG_NETFILTER_INGRESS=y # CONFIG_NETFILTER_EGRESS is not set CONFIG_NETFILTER_FAMILY_BRIDGE=y # CONFIG_NETFILTER_NETLINK_ACCT is not set -# CONFIG_NETFILTER_NETLINK_QUEUE is not set +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y # CONFIG_NETFILTER_NETLINK_LOG is not set # CONFIG_NETFILTER_NETLINK_OSF is not set CONFIG_NF_CONNTRACK=y @@ -1086,7 +1087,7 @@ CONFIG_NF_CT_PROTO_UDPLITE=y # CONFIG_NF_CONNTRACK_SANE is not set # CONFIG_NF_CONNTRACK_SIP is not set # CONFIG_NF_CONNTRACK_TFTP is not set -# CONFIG_NF_CT_NETLINK is not set +CONFIG_NF_CT_NETLINK=y # CONFIG_NF_CT_NETLINK_TIMEOUT is not set CONFIG_NF_NAT=y CONFIG_NF_NAT_REDIRECT=y @@ -1097,6 +1098,7 @@ CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XTABLES_COMPAT=y # nf_tables targets +CONFIG_NF_TABLES_INET=y CONFIG_NF_TABLES_IPV4=y CONFIG_NF_TABLES_IPV6=y CONFIG_NFT_EXTHDR=y From ee876be2f8deb07e43b5dfd95943cb05baa4409a Mon Sep 17 00:00:00 2001 From: Christian Kruse Date: Wed, 22 Jul 2026 09:23:26 -0700 Subject: [PATCH 4/4] Enable xtables recent match for all platforms Allows kube-proxy in iptables mode and other networking tools to implement session affinity, rate limiting and throttling with xtables recency rules. Sets CONFIG_NETFILTER_XT_MATCH_RECENT=y Signed-off-by: Christian Kruse --- configs/arm64/6.1.158.config | 2 +- configs/x86_64/6.1.158.config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/configs/arm64/6.1.158.config b/configs/arm64/6.1.158.config index b42987c..3425186 100644 --- a/configs/arm64/6.1.158.config +++ b/configs/arm64/6.1.158.config @@ -1194,7 +1194,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set # CONFIG_NETFILTER_XT_MATCH_REALM is not set -# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_RECENT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set diff --git a/configs/x86_64/6.1.158.config b/configs/x86_64/6.1.158.config index 4cb875f..94f672c 100644 --- a/configs/x86_64/6.1.158.config +++ b/configs/x86_64/6.1.158.config @@ -1204,7 +1204,7 @@ CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y # CONFIG_NETFILTER_XT_MATCH_QUOTA is not set # CONFIG_NETFILTER_XT_MATCH_RATEEST is not set # CONFIG_NETFILTER_XT_MATCH_REALM is not set -# CONFIG_NETFILTER_XT_MATCH_RECENT is not set +CONFIG_NETFILTER_XT_MATCH_RECENT=y # CONFIG_NETFILTER_XT_MATCH_SCTP is not set # CONFIG_NETFILTER_XT_MATCH_SOCKET is not set # CONFIG_NETFILTER_XT_MATCH_STATE is not set