iptables: bump to 1.8.3
This commit is contained in:
CN_SZTL
parent
d1535afe40
commit
01e9e1ac9a
@ -9,13 +9,12 @@ include $(TOPDIR)/rules.mk
|
||||
include $(INCLUDE_DIR)/kernel.mk
|
||||
|
||||
PKG_NAME:=iptables
|
||||
PKG_VERSION:=1.8.2
|
||||
PKG_RELEASE:=2
|
||||
PKG_VERSION:=1.8.3
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE_PROTO:=git
|
||||
PKG_SOURCE_URL:=https://git.netfilter.org/iptables
|
||||
PKG_SOURCE_VERSION:=bba6bc692b0e6137e13881a1f398c134822e9f83
|
||||
PKG_MIRROR_HASH:=23a61d2a23fc0d587029690ef2564625d78fba4b2d90117edaf5b9eaf55bb7f9
|
||||
PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
|
||||
PKG_HASH:=a23cac034181206b4545f4e7e730e76e08b5f3dd78771ba9645a6756de9cdd80
|
||||
|
||||
PKG_FIXUP:=autoreconf
|
||||
PKG_FLAGS:=nonshared
|
||||
@ -37,7 +36,7 @@ define Package/iptables/Default
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
SUBMENU:=Firewall
|
||||
URL:=http://netfilter.org/
|
||||
URL:=https://netfilter.org/
|
||||
endef
|
||||
|
||||
define Package/iptables/Module
|
||||
@ -178,7 +177,7 @@ endef
|
||||
define Package/iptables-mod-imq/description
|
||||
iptables extension for IMQ support.
|
||||
|
||||
Targets:
|
||||
Targets:
|
||||
- IMQ
|
||||
|
||||
endef
|
||||
@ -526,7 +525,7 @@ $(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
DEPENDS:=+libip4tc +libip6tc +libxtables
|
||||
ABI_VERSION:=$(PKG_VERSION)
|
||||
ABI_VERSION:=0
|
||||
TITLE:=IPv4/IPv6 firewall - shared libiptc library (nf compatibility stub)
|
||||
endef
|
||||
|
||||
@ -535,7 +534,7 @@ $(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4 firewall - shared libiptc library
|
||||
ABI_VERSION:=$(PKG_VERSION)
|
||||
ABI_VERSION:=2
|
||||
DEPENDS:=+libxtables
|
||||
endef
|
||||
|
||||
@ -544,7 +543,7 @@ $(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv6 firewall - shared libiptc library
|
||||
ABI_VERSION:=$(PKG_VERSION)
|
||||
ABI_VERSION:=2
|
||||
DEPENDS:=+libxtables
|
||||
endef
|
||||
|
||||
@ -553,7 +552,7 @@ define Package/libxtables
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4/IPv6 firewall - shared xtables library
|
||||
ABI_VERSION:=$(PKG_VERSION)
|
||||
ABI_VERSION:=12
|
||||
DEPENDS:= \
|
||||
+IPTABLES_CONNLABEL:libnetfilter-conntrack \
|
||||
+IPTABLES_NFTABLES:libnftnl
|
||||
@ -564,7 +563,7 @@ define Package/libxtables-nft
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4/IPv6 firewall - shared xtables nft library
|
||||
ABI_VERSION:=$(PKG_VERSION)
|
||||
ABI_VERSION:=12
|
||||
DEPENDS:=libxtables
|
||||
endef
|
||||
|
||||
@ -665,24 +664,24 @@ endef
|
||||
|
||||
define Package/libiptc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so.* $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libip4tc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libip6tc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libxtables/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
|
||||
@ -1,52 +0,0 @@
|
||||
From 907e429d7548157016cd51aba4adc5d0c7d9f816 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
|
||||
Date: Wed, 14 Nov 2018 07:35:28 +0100
|
||||
Subject: extensions: format-security fixes in libip[6]t_icmp
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
introduced support for gcc feature to check format string against passed
|
||||
argument. This commit adds missing bits to extenstions's libipt_icmp.c
|
||||
and libip6t_icmp6.c that were causing build to fail.
|
||||
|
||||
Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
---
|
||||
extensions/libip6t_icmp6.c | 4 ++--
|
||||
extensions/libipt_icmp.c | 2 +-
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/extensions/libip6t_icmp6.c
|
||||
+++ b/extensions/libip6t_icmp6.c
|
||||
@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(str
|
||||
type_name = icmp6_type_xlate(icmptype);
|
||||
|
||||
if (type_name) {
|
||||
- xt_xlate_add(xl, type_name);
|
||||
+ xt_xlate_add(xl, "%s", type_name);
|
||||
} else {
|
||||
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
|
||||
if (icmpv6_codes[i].type == icmptype &&
|
||||
@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(str
|
||||
break;
|
||||
|
||||
if (i != ARRAY_SIZE(icmpv6_codes))
|
||||
- xt_xlate_add(xl, icmpv6_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
|
||||
else
|
||||
return 0;
|
||||
}
|
||||
--- a/extensions/libipt_icmp.c
|
||||
+++ b/extensions/libipt_icmp.c
|
||||
@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(str
|
||||
if (icmp_codes[i].type == icmptype &&
|
||||
icmp_codes[i].code_min == code_min &&
|
||||
icmp_codes[i].code_max == code_max) {
|
||||
- xt_xlate_add(xl, icmp_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmp_codes[i].name);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
@ -1,48 +0,0 @@
|
||||
From 8d9d7e4b9ef4c6e6abab2cf35c747d7ca36824bd Mon Sep 17 00:00:00 2001
|
||||
From: Baruch Siach <baruch@tkos.co.il>
|
||||
Date: Fri, 16 Nov 2018 09:30:33 +0200
|
||||
Subject: include: fix build with kernel headers before 4.2
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Commit 672accf1530 (include: update kernel netfilter header files)
|
||||
updated linux/netfilter.h and brought with it the update from kernel
|
||||
commit a263653ed798 (netfilter: don't pull include/linux/netfilter.h
|
||||
from netns headers). This triggers conflict of headers that is fixed in
|
||||
kernel commit 279c6c7fa64f (api: fix compatibility of linux/in.h with
|
||||
netinet/in.h) included in kernel version 4.2. For earlier kernel headers
|
||||
we need a workaround that prevents the headers conflict.
|
||||
|
||||
Fixes the following build failure:
|
||||
|
||||
In file included from .../sysroot/usr/include/netinet/ip.h:25:0,
|
||||
from ../include/libiptc/ipt_kernel_headers.h:8,
|
||||
from ../include/libiptc/libiptc.h:6,
|
||||
from libip4tc.c:29:
|
||||
.../sysroot/usr/include/linux/in.h:26:3: error: redeclaration of enumerator ‘IPPROTO_IP’
|
||||
IPPROTO_IP = 0, /* Dummy protocol for TCP */
|
||||
^
|
||||
.../sysroot/usr/include/netinet/in.h:33:5: note: previous definition of ‘IPPROTO_IP’ was here
|
||||
IPPROTO_IP = 0, /* Dummy protocol for TCP. */
|
||||
^~~~~~~~~~
|
||||
|
||||
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
---
|
||||
include/linux/netfilter.h | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
--- a/include/linux/netfilter.h
|
||||
+++ b/include/linux/netfilter.h
|
||||
@@ -3,8 +3,10 @@
|
||||
|
||||
#include <linux/types.h>
|
||||
|
||||
+#ifndef _NETINET_IN_H
|
||||
#include <linux/in.h>
|
||||
#include <linux/in6.h>
|
||||
+#endif
|
||||
#include <limits.h>
|
||||
|
||||
/* Responses from hook functions. */
|
||||
@ -1,41 +0,0 @@
|
||||
From 51d374ba41ae4f1bb851228c06b030b83dd2092f Mon Sep 17 00:00:00 2001
|
||||
From: Baruch Siach <baruch@tkos.co.il>
|
||||
Date: Tue, 13 Nov 2018 19:22:08 +0200
|
||||
Subject: ebtables: vlan: fix userspace/kernel headers collision
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Build with musl libc fails because of conflicting struct ethhdr
|
||||
definitions:
|
||||
|
||||
In file included from .../sysroot/usr/include/net/ethernet.h:10:0,
|
||||
from ../iptables/nft-bridge.h:8,
|
||||
from libebt_vlan.c:18:
|
||||
.../sysroot/usr/include/netinet/if_ether.h:107:8: error: redefinition of ‘struct ethhdr’
|
||||
struct ethhdr {
|
||||
^~~~~~
|
||||
In file included from libebt_vlan.c:16:0:
|
||||
.../sysroot/usr/include/linux/if_ether.h:160:8: note: originally defined here
|
||||
struct ethhdr {
|
||||
^~~~~~
|
||||
|
||||
Include the userspace header first for the definition suppression logic
|
||||
to do the right thing.
|
||||
|
||||
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
---
|
||||
extensions/libebt_vlan.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/extensions/libebt_vlan.c
|
||||
+++ b/extensions/libebt_vlan.c
|
||||
@@ -12,6 +12,7 @@
|
||||
#include <getopt.h>
|
||||
#include <ctype.h>
|
||||
#include <xtables.h>
|
||||
+#include <netinet/if_ether.h>
|
||||
#include <linux/netfilter_bridge/ebt_vlan.h>
|
||||
#include <linux/if_ether.h>
|
||||
#include "iptables/nft.h"
|
||||
@ -0,0 +1,214 @@
|
||||
From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
Date: Sat, 23 Mar 2019 10:21:03 +0000
|
||||
Subject: [PATCH] savedscp
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
---
|
||||
extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++-
|
||||
include/linux/netfilter/xt_connmark.h | 3 +-
|
||||
2 files changed, 69 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/extensions/libxt_CONNMARK.c
|
||||
+++ b/extensions/libxt_CONNMARK.c
|
||||
@@ -22,6 +22,7 @@
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
+#include <strings.h>
|
||||
#include <xtables.h>
|
||||
#include <linux/netfilter/xt_CONNMARK.h>
|
||||
|
||||
@@ -49,6 +50,7 @@ enum {
|
||||
O_CTMASK,
|
||||
O_NFMASK,
|
||||
O_MASK,
|
||||
+ O_SAVEDSCP_MARK,
|
||||
F_SET_MARK = 1 << O_SET_MARK,
|
||||
F_SAVE_MARK = 1 << O_SAVE_MARK,
|
||||
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
|
||||
@@ -61,8 +63,10 @@ enum {
|
||||
F_CTMASK = 1 << O_CTMASK,
|
||||
F_NFMASK = 1 << O_NFMASK,
|
||||
F_MASK = 1 << O_MASK,
|
||||
+ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK,
|
||||
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
|
||||
- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
|
||||
+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
|
||||
+ F_SAVEDSCP_MARK,
|
||||
};
|
||||
|
||||
static const char *const xt_connmark_shift_ops[] = {
|
||||
@@ -75,6 +79,7 @@ static void CONNMARK_help(void)
|
||||
printf(
|
||||
"CONNMARK target options:\n"
|
||||
" --set-mark value[/mask] Set conntrack mark value\n"
|
||||
+" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n"
|
||||
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
|
||||
" --restore-mark [--mask mask] Restore saved nfmark value\n");
|
||||
}
|
||||
@@ -83,6 +88,8 @@ static void CONNMARK_help(void)
|
||||
static const struct xt_option_entry CONNMARK_opts[] = {
|
||||
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
|
||||
.excl = F_OP_ANY},
|
||||
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
|
||||
+ .excl = F_OP_ANY},
|
||||
{.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
|
||||
.excl = F_OP_ANY},
|
||||
{.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
|
||||
@@ -98,6 +105,8 @@ static const struct xt_option_entry conn
|
||||
.excl = F_OP_ANY},
|
||||
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
|
||||
.excl = F_OP_ANY},
|
||||
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
|
||||
+ .excl = F_OP_ANY},
|
||||
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
|
||||
.excl = F_OP_ANY},
|
||||
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
|
||||
@@ -124,6 +133,8 @@ static const struct xt_option_entry conn
|
||||
.excl = F_OP_ANY},
|
||||
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
|
||||
.excl = F_OP_ANY},
|
||||
+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32,
|
||||
+ .excl = F_OP_ANY},
|
||||
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
|
||||
.excl = F_OP_ANY},
|
||||
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
|
||||
@@ -158,6 +169,7 @@ static void connmark_tg_help(void)
|
||||
" --restore-mark [--ctmask mask] [--nfmask mask]\n"
|
||||
" Copy nfmark to ctmark using masks\n"
|
||||
" --set-mark value[/mask] Set conntrack mark value\n"
|
||||
+" --savedscp-mark value/mask Save DSCP to conntrack mark value\n"
|
||||
" --save-mark [--mask mask] Save the packet nfmark in the connection\n"
|
||||
" --restore-mark [--mask mask] Restore saved nfmark value\n"
|
||||
" --and-mark value Binary AND the ctmark with bits\n"
|
||||
@@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt
|
||||
markinfo->mark = cb->val.mark;
|
||||
markinfo->mask = cb->val.mask;
|
||||
break;
|
||||
+ case O_SAVEDSCP_MARK:
|
||||
+ markinfo->mode = XT_CONNMARK_SAVEDSCP;
|
||||
+ markinfo->mark = cb->val.mark;
|
||||
+ markinfo->mask = cb->val.mask;
|
||||
+ break;
|
||||
case O_SAVE_MARK:
|
||||
markinfo->mode = XT_CONNMARK_SAVE;
|
||||
break;
|
||||
@@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_
|
||||
info->ctmark = cb->val.mark;
|
||||
info->ctmask = cb->val.mark | cb->val.mask;
|
||||
break;
|
||||
+ case O_SAVEDSCP_MARK:
|
||||
+ info->mode = XT_CONNMARK_SAVEDSCP;
|
||||
+ info->ctmark = cb->val.mark;
|
||||
+ info->ctmask = cb->val.mask;
|
||||
+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
|
||||
+ /* need 6 contiguous bits */
|
||||
+ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
|
||||
+ if (info->ctmark & info->ctmask)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
|
||||
+ break;
|
||||
case O_AND_MARK:
|
||||
info->mode = XT_CONNMARK_SET;
|
||||
info->ctmark = 0;
|
||||
@@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct
|
||||
info->ctmark = cb->val.mark;
|
||||
info->ctmask = cb->val.mark | cb->val.mask;
|
||||
break;
|
||||
+ case O_SAVEDSCP_MARK:
|
||||
+ info->mode = XT_CONNMARK_SAVEDSCP;
|
||||
+ info->ctmark = cb->val.mark;
|
||||
+ info->ctmask = cb->val.mask;
|
||||
+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
|
||||
+ /* need 6 contiguous bits */
|
||||
+ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "CONNMARK savedscp: insufficient contiguous dscpmask bits");
|
||||
+ if (info->ctmark & info->ctmask)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "CONNMARK savedscp: dscpmask/statemask bits overlap");
|
||||
+ break;
|
||||
case O_AND_MARK:
|
||||
info->mode = XT_CONNMARK_SET;
|
||||
info->ctmark = 0;
|
||||
@@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i
|
||||
print_mark(markinfo->mark);
|
||||
print_mask("/", markinfo->mask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" CONNMARK savedscp ");
|
||||
+ print_mark(markinfo->mark);
|
||||
+ print_mask("/", markinfo->mask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
printf(" CONNMARK save ");
|
||||
print_mask("mask ", markinfo->mask);
|
||||
@@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const
|
||||
printf(" CONNMARK xset 0x%x/0x%x",
|
||||
info->ctmark, info->ctmask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" CONNMARK DSCP set 0x%x/0x%x",
|
||||
+ info->ctmark, info->ctmask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
|
||||
printf(" CONNMARK save");
|
||||
@@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con
|
||||
printf(" CONNMARK xset 0x%x/0x%x",
|
||||
info->ctmark, info->ctmask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" CONNMARK DSCP xset 0x%x/0x%x",
|
||||
+ info->ctmark, info->ctmask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
|
||||
printf(" CONNMARK save");
|
||||
@@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip
|
||||
print_mark(markinfo->mark);
|
||||
print_mask("/", markinfo->mask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" --savedscp-mark ");
|
||||
+ print_mark(markinfo->mark);
|
||||
+ print_mask("/", markinfo->mask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
printf(" --save-mark ");
|
||||
print_mask("--mask ", markinfo->mask);
|
||||
@@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s
|
||||
case XT_CONNMARK_SET:
|
||||
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
|
||||
info->nfmask, info->ctmask);
|
||||
@@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons
|
||||
case XT_CONNMARK_SET:
|
||||
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
|
||||
break;
|
||||
+ case XT_CONNMARK_SAVEDSCP:
|
||||
+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask);
|
||||
+ break;
|
||||
case XT_CONNMARK_SAVE:
|
||||
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
|
||||
info->nfmask, info->ctmask);
|
||||
--- a/include/linux/netfilter/xt_connmark.h
|
||||
+++ b/include/linux/netfilter/xt_connmark.h
|
||||
@@ -15,7 +15,8 @@
|
||||
enum {
|
||||
XT_CONNMARK_SET = 0,
|
||||
XT_CONNMARK_SAVE,
|
||||
- XT_CONNMARK_RESTORE
|
||||
+ XT_CONNMARK_RESTORE,
|
||||
+ XT_CONNMARK_SAVEDSCP
|
||||
};
|
||||
|
||||
struct xt_connmark_tginfo1 {
|
||||
4
package/network/utils/iptables/patches/101-remove-check-already.patch
Executable file → Normal file
4
package/network/utils/iptables/patches/101-remove-check-already.patch
Executable file → Normal file
@ -1,6 +1,6 @@
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -887,12 +887,6 @@ static void xtables_check_options(const
|
||||
@@ -903,12 +903,6 @@ static void xtables_check_options(const
|
||||
|
||||
void xtables_register_match(struct xtables_match *me)
|
||||
{
|
||||
@ -13,7 +13,7 @@
|
||||
if (me->version == NULL) {
|
||||
fprintf(stderr, "%s: match %s<%u> is missing a version\n",
|
||||
xt_params->program_name, me->name, me->revision);
|
||||
@@ -1080,12 +1074,6 @@ void xtables_register_matches(struct xta
|
||||
@@ -1096,12 +1090,6 @@ void xtables_register_matches(struct xta
|
||||
|
||||
void xtables_register_target(struct xtables_target *me)
|
||||
{
|
||||
|
||||
0
package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
Executable file → Normal file
0
package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
Executable file → Normal file
2
package/network/utils/iptables/patches/103-optional-xml.patch
Executable file → Normal file
2
package/network/utils/iptables/patches/103-optional-xml.patch
Executable file → Normal file
@ -1,6 +1,6 @@
|
||||
--- a/iptables/xtables-legacy-multi.c
|
||||
+++ b/iptables/xtables-legacy-multi.c
|
||||
@@ -31,8 +31,10 @@ static const struct subcommand multi_sub
|
||||
@@ -32,8 +32,10 @@ static const struct subcommand multi_sub
|
||||
|
||||
|
||||
#endif
|
||||
|
||||
12
package/network/utils/iptables/patches/200-configurable_builtin.patch
Executable file → Normal file
12
package/network/utils/iptables/patches/200-configurable_builtin.patch
Executable file → Normal file
@ -34,10 +34,10 @@
|
||||
+pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_static})
|
||||
+pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static})
|
||||
+pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static})
|
||||
pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod} ${pfx_symlinks})
|
||||
pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod})
|
||||
pfb_solibs := $(patsubst %,libebt_%.so,${pfb_build_mod})
|
||||
pfa_solibs := $(patsubst %,libarpt_%.so,${pfa_build_mod})
|
||||
@@ -67,13 +87,13 @@ pf6_solibs := $(patsubst %,libip6t_%.
|
||||
@@ -68,14 +88,14 @@ pfx_symlink_files := $(patsubst %,libxt_
|
||||
#
|
||||
targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man
|
||||
targets_install :=
|
||||
@ -46,19 +46,21 @@
|
||||
-@ENABLE_STATIC_TRUE@ libext_arpt_objs := ${pfa_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs}
|
||||
-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}
|
||||
-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
|
||||
-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}
|
||||
-@ENABLE_STATIC_FALSE@ symlinks_install := ${pfx_symlink_files}
|
||||
+libext_objs := ${pfx_objs}
|
||||
+libext_ebt_objs := ${pfb_objs}
|
||||
+libext_arpt_objs := ${pfa_objs}
|
||||
+libext4_objs := ${pf4_objs}
|
||||
+libext6_objs := ${pf6_objs}
|
||||
+targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}
|
||||
+targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
|
||||
+targets_install := $(strip ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs})
|
||||
+symlinks_install := ${pfx_symlink_files}
|
||||
|
||||
.SECONDARY:
|
||||
|
||||
@@ -141,11 +161,11 @@ libext4.a: initext4.o ${libext4_objs}
|
||||
@@ -148,11 +168,11 @@ libext4.a: initext4.o ${libext4_objs}
|
||||
libext6.a: initext6.o ${libext6_objs}
|
||||
${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
|
||||
|
||||
22
package/network/utils/iptables/patches/600-shared-libext.patch
Executable file → Normal file
22
package/network/utils/iptables/patches/600-shared-libext.patch
Executable file → Normal file
@ -1,6 +1,6 @@
|
||||
--- a/extensions/GNUmakefile.in
|
||||
+++ b/extensions/GNUmakefile.in
|
||||
@@ -85,7 +85,7 @@ pf6_solibs := $(patsubst %,libip6t_%.
|
||||
@@ -86,7 +86,7 @@ pfx_symlink_files := $(patsubst %,libxt_
|
||||
#
|
||||
# Building blocks
|
||||
#
|
||||
@ -9,7 +9,7 @@
|
||||
targets_install :=
|
||||
libext_objs := ${pfx_objs}
|
||||
libext_ebt_objs := ${pfb_objs}
|
||||
@@ -112,7 +112,7 @@ clean:
|
||||
@@ -119,7 +119,7 @@ clean:
|
||||
distclean: clean
|
||||
|
||||
init%.o: init%.c
|
||||
@ -18,7 +18,7 @@
|
||||
|
||||
-include .*.d
|
||||
|
||||
@@ -144,22 +144,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
|
||||
@@ -151,22 +151,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
|
||||
# handling code in the Makefiles.
|
||||
#
|
||||
lib%.o: ${srcdir}/lib%.c
|
||||
@ -54,7 +54,7 @@
|
||||
initextb_func := $(addprefix ebt_,${pfb_build_static})
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -8,7 +8,8 @@ BUILT_SOURCES =
|
||||
@@ -8,19 +8,22 @@ BUILT_SOURCES =
|
||||
|
||||
xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c
|
||||
xtables_legacy_multi_CFLAGS = ${AM_CFLAGS}
|
||||
@ -64,25 +64,23 @@
|
||||
if ENABLE_STATIC
|
||||
xtables_legacy_multi_CFLAGS += -DALL_INCLUSIVE
|
||||
endif
|
||||
@@ -16,13 +17,15 @@ if ENABLE_IPV4
|
||||
xtables_legacy_multi_SOURCES += iptables-save.c iptables-restore.c \
|
||||
iptables-standalone.c iptables.c
|
||||
if ENABLE_IPV4
|
||||
xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c
|
||||
xtables_legacy_multi_CFLAGS += -DENABLE_IPV4
|
||||
-xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a
|
||||
+xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la
|
||||
+xtables_legacy_multi_LDFLAGS += -liptext4
|
||||
endif
|
||||
if ENABLE_IPV6
|
||||
xtables_legacy_multi_SOURCES += ip6tables-save.c ip6tables-restore.c \
|
||||
ip6tables-standalone.c ip6tables.c
|
||||
xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c
|
||||
xtables_legacy_multi_CFLAGS += -DENABLE_IPV6
|
||||
-xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
|
||||
+xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la
|
||||
+xtables_legacy_multi_LDFLAGS += -liptext6
|
||||
endif
|
||||
xtables_legacy_multi_SOURCES += xshared.c
|
||||
xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c
|
||||
xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
|
||||
@@ -32,7 +35,8 @@ if ENABLE_NFTABLES
|
||||
@@ -30,7 +33,8 @@ if ENABLE_NFTABLES
|
||||
BUILT_SOURCES += xtables-config-parser.h
|
||||
xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c
|
||||
xtables_nft_multi_CFLAGS = ${AM_CFLAGS}
|
||||
@ -92,7 +90,7 @@
|
||||
if ENABLE_STATIC
|
||||
xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE
|
||||
endif
|
||||
@@ -47,7 +51,8 @@ xtables_nft_multi_SOURCES += xtables-sav
|
||||
@@ -45,7 +49,8 @@ xtables_nft_multi_SOURCES += xtables-sav
|
||||
xtables-eb-standalone.c xtables-eb.c \
|
||||
xtables-eb-translate.c \
|
||||
xtables-translate.c
|
||||
|
||||
0
package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
Executable file → Normal file
0
package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
Executable file → Normal file
0
package/network/utils/iptables/patches/800-flowoffload_target.patch
Executable file → Normal file
0
package/network/utils/iptables/patches/800-flowoffload_target.patch
Executable file → Normal file
Loading…
Reference in New Issue
Block a user