From: Florian Westphal Date: Wed, 11 Mar 2026 09:53:15 +0000 (+0100) Subject: netfilter: add deprecation warning for dccp support X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=606bd17ef0de1b8f4227cb070308ddfd702979dc;p=thirdparty%2Fkernel%2Flinux.git netfilter: add deprecation warning for dccp support Add a deprecation warning for the xt_dccp match and the nft exthdr code. Signed-off-by: Florian Westphal --- diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c index 5f01269a49bd..14d4ad7f518c 100644 --- a/net/netfilter/nft_exthdr.c +++ b/net/netfilter/nft_exthdr.c @@ -796,6 +796,9 @@ nft_exthdr_select_ops(const struct nft_ctx *ctx, break; #ifdef CONFIG_NFT_EXTHDR_DCCP case NFT_EXTHDR_OP_DCCP: + pr_warn_once("The dccp option matching is deprecated and scheduled to be removed in 2027.\n" + "Please contact the netfilter-devel mailing list or update your nftables rules.\n"); + if (tb[NFTA_EXTHDR_DREG]) return &nft_exthdr_dccp_ops; break; diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index 037ab93e25d0..3db81e041af9 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -159,6 +159,9 @@ static int __init dccp_mt_init(void) { int ret; + pr_warn_once("The DCCP match is deprecated and scheduled to be removed in 2027.\n" + "Please contact the netfilter-devel mailing list or update your iptables rules\n"); + /* doff is 8 bits, so the maximum option size is (4*256). Don't put * this in BSS since DaveM is worried about locked TLB's for kernel * BSS. */