Fedora kernel list - Mar 2007 - Backwards-compatible /proc and sysctl conntrack entries

It looks like we need to enable this option. See:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232742

So we need to set this:

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

On Tue, 2007-03-27 at 11:03 -0400, Chuck Ebbert wrote:
> It looks like we need to enable this option. See:
> 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232742
> 
> So we need to set this:
> 
> CONFIG_NF_CONNTRACK_PROC_COMPAT=y
For how long?  I''m wondering why the application can''t be
fixed
instead...

josh

Josh Boyer wrote:
> On Tue, 2007-03-27 at 11:03 -0400, Chuck Ebbert wrote:
>> It looks like we need to enable this option. See:
>>
>> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232742
>>
>> So we need to set this:
>>
>> CONFIG_NF_CONNTRACK_PROC_COMPAT=y
> 
> For how long?  I''m wondering why the application can''t be
fixed
> instead...
Users also have firewall configuration scripts that rely on these
entries.

Some are broken by the module renaming but I''m not sure how we can
fix that.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=234174

On Tue, 2007-03-27 at 12:52 -0400, Chuck Ebbert wrote:
> Josh Boyer wrote:
> > On Tue, 2007-03-27 at 11:03 -0400, Chuck Ebbert wrote:
> >> It looks like we need to enable this option. See:
> >>
> >> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232742
> >>
> >> So we need to set this:
> >>
> >> CONFIG_NF_CONNTRACK_PROC_COMPAT=y
> > 
> > For how long?  I''m wondering why the application
can''t be fixed
> > instead...
> 
> Users also have firewall configuration scripts that rely on these
> entries.
Damn.  That does suck.

So how long does upstream intend to keep CONFIG_NF_CONNTRACK_PROC_COMPAT
around?

josh

Josh Boyer wrote:
>> Users also have firewall configuration scripts that rely on these
>> entries.
> 
> Damn.  That does suck.
> 
> So how long does upstream intend to keep CONFIG_NF_CONNTRACK_PROC_COMPAT
> around?
Until FC-6 dies, hopefully... :)

A new comment in bz 234174 is interesting:

|  Or, ideally, the kernel rpm should look into obvious places (e.g.
|  /etc/sysconfig/iptables-config, /etc/sysctl.conf) and do some perl -pie
magic.

On Tue, Mar 27, 2007 at 03:13:22PM -0400, Chuck Ebbert wrote:
 > Josh Boyer wrote:
 > >> Users also have firewall configuration scripts that rely on these
 > >> entries.
 > > 
 > > Damn.  That does suck.
 > > 
 > > So how long does upstream intend to keep
CONFIG_NF_CONNTRACK_PROC_COMPAT
 > > around?
 > 
 > Until FC-6 dies, hopefully... :)
 > 
 > A new comment in bz 234174 is interesting:
 > 
 > |  Or, ideally, the kernel rpm should look into obvious places (e.g.
 > |  /etc/sysconfig/iptables-config, /etc/sysctl.conf) and do some perl -pie
magic.

This would break booting back into the earlier kernel (which used to work
until we munged these files).

I think enabling the compat stuff for FC6''s lifetime should be safe.
Hopefully upstream won''t rip them out too soon.

	Dave


-- 
http://www.codemonkey.org.uk

Dave Jones wrote:
> On Tue, Mar 27, 2007 at 03:13:22PM -0400, Chuck Ebbert wrote:
>  > Josh Boyer wrote:
>  > >> Users also have firewall configuration scripts that rely on
these
>  > >> entries.
>  > > 
>  > > Damn.  That does suck.
>  > > 
>  > > So how long does upstream intend to keep
CONFIG_NF_CONNTRACK_PROC_COMPAT
>  > > around?
>  > 
>  > Until FC-6 dies, hopefully... :)
>  > 
>  > A new comment in bz 234174 is interesting:
>  > 
>  > |  Or, ideally, the kernel rpm should look into obvious places (e.g.
>  > |  /etc/sysconfig/iptables-config, /etc/sysctl.conf) and do some perl
-pie magic.
> 
> This would break booting back into the earlier kernel (which used to work
> until we munged these files).
> 
Maybe we could create symlinks in the new kernel directory so the old module
names would work?
> I think enabling the compat stuff for FC6''s lifetime should be
safe.
> Hopefully upstream won''t rip them out too soon.
We''ll just leave FC 6 on 2.6.20 until 2.6.21 is stable, i.e. forever.
:)

On Tue, Mar 27, 2007 at 05:48:40PM -0400, Chuck Ebbert wrote:
 > Dave Jones wrote:
 > > On Tue, Mar 27, 2007 at 03:13:22PM -0400, Chuck Ebbert wrote:
 > >  > Josh Boyer wrote:
 > >  > >> Users also have firewall configuration scripts that
rely on these
 > >  > >> entries.
 > >  > > 
 > >  > > Damn.  That does suck.
 > >  > > 
 > >  > > So how long does upstream intend to keep
CONFIG_NF_CONNTRACK_PROC_COMPAT
 > >  > > around?
 > >  > 
 > >  > Until FC-6 dies, hopefully... :)
 > >  > 
 > >  > A new comment in bz 234174 is interesting:
 > >  > 
 > >  > |  Or, ideally, the kernel rpm should look into obvious places
(e.g.
 > >  > |  /etc/sysconfig/iptables-config, /etc/sysctl.conf) and do
some perl -pie magic.
 > > 
 > > This would break booting back into the earlier kernel (which used to
work
 > > until we munged these files).
 > > 
 > 
 > Maybe we could create symlinks in the new kernel directory so the old
module
 > names would work?

maybe. if the contents are the same, then it should work.
Makes me wonder why that isn''t what CONFIG_NF_CONNTRACK_PROC_COMPAT
would do.
But then, I''m trying not to think too hard today. Vacationing is hard.

 > > I think enabling the compat stuff for FC6''s lifetime should
be safe.
 > > Hopefully upstream won''t rip them out too soon.
 > 
 > We''ll just leave FC 6 on 2.6.20 until 2.6.21 is stable, i.e.
forever. :)

Forever the optimist eh? :)

	Dave

-- 
http://www.codemonkey.org.uk