REJECT iptables rule not applying after 6.12.1 => 6.12.4 upgrade

[danog]

An iptables setup containing a iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited doesn't block incoming connections on 6.12.4, on an Ubuntu system running the cachyos kernel.

Everything worked correctly on 6.12.1, and testing on a dev cachyos machine on 6.12.5 also seems to work fine: will attempt to test 6.12.5 on ubuntu, opening this issue just to track the existence of the problem at least on 6.12.4.

[ptr1337]

An iptables setup containing a iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited doesn't block incoming connections on 6.12.4, on an Ubuntu system running the cachyos kernel.

Everything worked correctly on 6.12.1, and testing on a dev cachyos machine on 6.12.5 also seems to work fine: will attempt to test 6.12.5 on ubuntu, opening this issue just to track the existence of the problem at least on 6.12.4.

Since this was likely then an upstream issue, I think we can close this, since its fixed .5. :)

[danog]

Reopening the issue as it reproduces on 6.12.6.

[danog]

The kernel is built with the following config, from the official PKGBUILD (not the linux-cachyos-deb script):

# Disable automatic CPU selection
export _use_auto_optimization=n
# Use full LLVM LTO
export _use_llvm_lto=full
# Use hugepages
export _hugepage=always
# Enable -O3
export _cc_harder=y
# Use performance governor by default
export _per_gov=y
# No forced preemption
export _preempt=server

# server config (copied from non-lts server config)
export _cpusched=eevdf
export _HZ_ticks=300
export _tickrate=idle
export _cachy_config=''
export _use_lto_suffix=y

packaging happens using https://paste.daniil.it/package-kernel.sh

[danog]

Built for -march=znver4

[1Naim]

Can this be reproduced in a stock 6.12.6/6.12.7 kernel?

[danog]

Actually, it cannot be reliably reproduced even with the custom-built kernel, might be caused by a combination of factors...

[1Naim]

Are you sure this is a kernel bug and not a bug that was introduced from another package?, e.g. if you go back to 6.12.1, does everything work correctly?

[danog]

The issue is most definitely caused by another package, in conjunction with the kernel upgrade.

[1Naim]

Have you figured out the corresponding package that introduced this? If so, has a bug report been made in the upstream project instead? if that is also yes, please link the bug report here :)