diff options
| author | Vladimír Čunát <v@cunat.cz> | 2023-03-11 16:41:00 +0100 |
|---|---|---|
| committer | Vladimír Čunát <v@cunat.cz> | 2023-03-11 16:41:00 +0100 |
| commit | 6966f3a9f76698521875c548b3a79e7edd1fc27d (patch) | |
| tree | 164e4f133b6ef02b52a54e7cc4de9a3db77d0196 | |
| parent | Merge pull request #220650 from NixOS/backport-220612-to-release-22.11 (diff) | |
| parent | nixos/firewall: assert that the kernel supports conntrack helper auto-loading (diff) | |
| download | nixpkgs-6966f3a9f76698521875c548b3a79e7edd1fc27d.tar.gz | |
Merge #219653: nixos/firewall: assert kernel supports conntrack helper
..auto-loading; merge into release-22.11
| -rw-r--r-- | nixos/modules/services/networking/firewall.nix | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 27119dcc57c5..01746fe78708 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -551,6 +551,11 @@ in # values. { assertion = cfg.checkReversePath == false || kernelHasRPFilter; message = "This kernel does not support rpfilter"; } + + { + assertion = cfg.autoLoadConntrackHelpers -> lib.versionOlder config.boot.kernelPackages.kernel.version "6"; + message = "conntrack helper autoloading has been removed from kernel 6.0 and newer"; + } ]; systemd.services.firewall = { |