[sjmiller609]

Summary

Enable built-in IPv4 TPROXY and policy routing in the x86 and ARM64 guest kernel configurations. These support transparent UDP interception inside a guest network namespace.

Based on the exact ch-6.12.8-kernel-3.0-202605291 commit. No kernel source or workflow changes, no default-kernel change, and no deployment.

Validation

• Reviewed Kconfig dependencies and the full config-only diff; whitespace checks pass.
• Successful CI artifact build: https://github.com/kernel/linux/actions/runs/41064990833
• Verified both packaged .config files enable IP_ADVANCED_ROUTER, IP_MULTIPLE_TABLES, NETFILTER_XT_TARGET_TPROXY and NF_TPROXY_IPV4, along with required namespace, veth and netfilter dependencies. Header archive SHA-256 checksums match the release asset digests.
• Published normal release: https://github.com/kernel/linux/releases/tag/ch-6.12.8-kernel-3.1-202610301
• The normal tag points to the identical source commit as the successful CI build. A later rebuild failed in objtool static linking against libelf with unresolved ZSTD symbols; the release uses the earlier successful artifacts, not that failed attempt.
• No kernel clone or local kernel build. Actual guest boot and UDP lifecycle tests remain required. RISC-V artifacts come from the unchanged workflow and do not include these config changes.

---

Note

Medium Risk
Config-only but expands the guest networking attack surface by enabling policy routing and TPROXY packet redirection; misconfigured rules could redirect traffic unexpectedly until guest boot and UDP tests validate behavior.

Overview
Turns on IPv4 policy routing and transparent proxy (TPROXY) in the ch_defconfig guest kernels for arm64 and x86. The diff only flips Kconfig symbols—no kernel source or build workflow changes.

Routing: CONFIG_IP_ADVANCED_ROUTER and CONFIG_IP_MULTIPLE_TABLES replace the previous disabled advanced-router setting so the guest can use multiple routing tables and policy rules (needed for steering intercepted traffic).

Netfilter: CONFIG_NETFILTER_XT_TARGET_TPROXY and CONFIG_NF_TPROXY_IPV4 add the xtables TPROXY target and IPv4 TPROXY support for transparent UDP interception inside a guest network namespace.

The same four options are applied identically on both architectures; other arches (e.g. RISC-V) are unchanged in this diff.

^{Reviewed by Cursor Bugbot for commit ccd5885. Bugbot is set up for automated code reviews on this repo. Configure here.}