configs: enable netfilter targets/matches OEM firewall scripts need

[lacraig2]

Problem

Rehosted router firmware commonly regenerates its whole ruleset from nvram and loads it with iptables-restore. iptables resolves match/target names kernel-side at COMMIT, and restore is atomic per table, so one unknown target discards the entire table and the remaining tables are never attempted — the guest boots with no firewall at all.

Hit while rehosting an armel/4.10 target whose service manager writes a *mangle/*nat/*filter script and restores it:

iptables-restore: line 52 failed          <- COMMIT of *mangle
iptables: No chain/target/match by that name
ip6tables-restore: line 22 failed

The failing line is the *mangle COMMIT; that table's first substantive rules are -j LOG --log-prefix .... xt_LOG was not built in — only the nf_log core, pulled in by NFLOG — and the guest can't load modules (modprobe: cannot parse modules.dep, insmod stubbed), so nothing could rescue it.

What this changes

Counting rule fragments that firmware emits, the targets it uses are ACCEPT, DROP, MARK, LOG, DNAT, DSCP, RETURN, TRIGGER, SNAT, REJECT, QUEUE, IPS, CONNMARK, LED, TCPMSS and the matches are state, tcp, limit, udp, mark, iprange, webstr, physdev, mac, ipv6header, tunnel, tcpmss, dscp, 6to6. Everything in-tree that was missing is now enabled in configs/{4.10,6.13}/all-common.inc:

• NETFILTER_XT_TARGET_LOG (NF_LOG_IPV4/NF_LOG_IPV6 follow by select)
• NETFILTER_XT_TARGET_DSCP + NETFILTER_XT_MATCH_DSCP (DSCP/TOS)
• NETFILTER_XT_TARGET_LED plus LEDS_CLASS/LEDS_TRIGGERS/NEW_LEDS — 6.13 already listed the LED target but it was silently dropped, since no LED class was enabled
• IP6_NF_MATCH_{AH,EUI64,FRAG,HL,IPV6HEADER,MH,OPTS,RT}
• conntrack helpers NF_CONNTRACK_{H323,IRC,PPTP,SIP} (PPTP pulls NF_CT_PROTO_GRE); the matching NF_NAT_* helpers follow by default

Such firmware kernels enable the equivalents of all of these, so this narrows a real fidelity gap rather than adding speculative options.

Known remaining gaps (not fixable by config)

TRIGGER, IPS, webstr, tunnel, 6to6 are out-of-tree vendor modules. The legacy QUEUE target and ULOG were removed upstream; NFQUEUE/NFLOG (already enabled) are the replacements. A ruleset using those names will still fail its table.

Verification

• Built 4.10/armel end to end (./build.sh --versions 4.10 --targets armel, exit 0). The resulting .config has NETFILTER_XT_TARGET_LOG=y, NF_LOG_IPV4=y, NF_LOG_IPV6=y, NETFILTER_XT_TARGET_DSCP=y, NETFILTER_XT_TARGET_HL=y, NETFILTER_XT_MATCH_DSCP=y, the full IP6_NF_MATCH_* set, and NF_NAT_{SIP,IRC,PPTP,H323}=y.
• ./build.sh --config-only clean for 4.10 and 6.13 (armel); the linted defconfig keeps every added symbol, including the LED target and its LEDS deps.
• Not yet re-verified in-guest: that the ruleset restores cleanly under this kernel. It will still hit -j TRIGGER in *filter; the *mangle and *nat failures should be gone.

Note: the LED/LEDS additions came after the local 4.10 build above, so CI's build is the first one covering the final config.