From 53c9bd735d17f7c8f64915d57cca55b3a4ded68a Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Mon, 23 Mar 2020 00:29:09 +0800 Subject: [PATCH] iptables: refresh patches --- .../patches/010-add-savedscp-support.patch | 214 ------------------ .../iptables/patches/600-shared-libext.patch | 12 +- .../700-disable-legacy-revisions.patch | 10 +- 3 files changed, 11 insertions(+), 225 deletions(-) delete mode 100644 package/network/utils/iptables/patches/010-add-savedscp-support.patch diff --git a/package/network/utils/iptables/patches/010-add-savedscp-support.patch b/package/network/utils/iptables/patches/010-add-savedscp-support.patch deleted file mode 100644 index c85aa9ead2..0000000000 --- a/package/network/utils/iptables/patches/010-add-savedscp-support.patch +++ /dev/null @@ -1,214 +0,0 @@ -From 69b427fb5e1211c1110ce63be62b70504d04b0ff Mon Sep 17 00:00:00 2001 -From: Kevin Darbyshire-Bryant -Date: Sat, 23 Mar 2019 10:21:03 +0000 -Subject: [PATCH] savedscp - -Signed-off-by: Kevin Darbyshire-Bryant ---- - extensions/libxt_CONNMARK.c | 68 ++++++++++++++++++++++++++- - include/linux/netfilter/xt_connmark.h | 3 +- - 2 files changed, 69 insertions(+), 2 deletions(-) - ---- a/extensions/libxt_CONNMARK.c -+++ b/extensions/libxt_CONNMARK.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -49,6 +50,7 @@ enum { - O_CTMASK, - O_NFMASK, - O_MASK, -+ O_SAVEDSCP_MARK, - F_SET_MARK = 1 << O_SET_MARK, - F_SAVE_MARK = 1 << O_SAVE_MARK, - F_RESTORE_MARK = 1 << O_RESTORE_MARK, -@@ -61,8 +63,10 @@ enum { - F_CTMASK = 1 << O_CTMASK, - F_NFMASK = 1 << O_NFMASK, - F_MASK = 1 << O_MASK, -+ F_SAVEDSCP_MARK = 1 << O_SAVEDSCP_MARK, - F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK | -- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK, -+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK | -+ F_SAVEDSCP_MARK, - }; - - static const char *const xt_connmark_shift_ops[] = { -@@ -75,6 +79,7 @@ static void CONNMARK_help(void) - printf( - "CONNMARK target options:\n" - " --set-mark value[/mask] Set conntrack mark value\n" -+" --savedscp-mark dscpmask/statemask Save DSCP to conntrack mark value\n" - " --save-mark [--mask mask] Save the packet nfmark in the connection\n" - " --restore-mark [--mask mask] Restore saved nfmark value\n"); - } -@@ -83,6 +88,8 @@ static void CONNMARK_help(void) - static const struct xt_option_entry CONNMARK_opts[] = { - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE, - .excl = F_OP_ANY}, - {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE, -@@ -98,6 +105,8 @@ static const struct xt_option_entry conn - .excl = F_OP_ANY}, - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, - .excl = F_OP_ANY}, - {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, -@@ -124,6 +133,8 @@ static const struct xt_option_entry conn - .excl = F_OP_ANY}, - {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32, - .excl = F_OP_ANY}, -+ {.name = "savedscp-mark", .id = O_SAVEDSCP_MARK, .type = XTTYPE_MARKMASK32, -+ .excl = F_OP_ANY}, - {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32, - .excl = F_OP_ANY}, - {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32, -@@ -158,6 +169,7 @@ static void connmark_tg_help(void) - " --restore-mark [--ctmask mask] [--nfmask mask]\n" - " Copy nfmark to ctmark using masks\n" - " --set-mark value[/mask] Set conntrack mark value\n" -+" --savedscp-mark value/mask Save DSCP to conntrack mark value\n" - " --save-mark [--mask mask] Save the packet nfmark in the connection\n" - " --restore-mark [--mask mask] Restore saved nfmark value\n" - " --and-mark value Binary AND the ctmark with bits\n" -@@ -210,6 +222,11 @@ static void CONNMARK_parse(struct xt_opt - markinfo->mark = cb->val.mark; - markinfo->mask = cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ markinfo->mode = XT_CONNMARK_SAVEDSCP; -+ markinfo->mark = cb->val.mark; -+ markinfo->mask = cb->val.mask; -+ break; - case O_SAVE_MARK: - markinfo->mode = XT_CONNMARK_SAVE; - break; -@@ -238,6 +255,19 @@ static void connmark_tg_parse(struct xt_ - info->ctmark = cb->val.mark; - info->ctmask = cb->val.mark | cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ info->mode = XT_CONNMARK_SAVEDSCP; -+ info->ctmark = cb->val.mark; -+ info->ctmask = cb->val.mask; -+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0; -+ /* need 6 contiguous bits */ -+ if ((0x3f & (info->ctmark >> info->nfmask)) != 0x3f) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); -+ if (info->ctmark & info->ctmask) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: dscpmask/statemask bits overlap"); -+ break; - case O_AND_MARK: - info->mode = XT_CONNMARK_SET; - info->ctmark = 0; -@@ -283,6 +313,19 @@ static void connmark_tg_parse_v2(struct - info->ctmark = cb->val.mark; - info->ctmask = cb->val.mark | cb->val.mask; - break; -+ case O_SAVEDSCP_MARK: -+ info->mode = XT_CONNMARK_SAVEDSCP; -+ info->ctmark = cb->val.mark; -+ info->ctmask = cb->val.mask; -+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0; -+ /* need 6 contiguous bits */ -+ if ((0x3f & (info->ctmark >> info->shift_bits)) != 0x3f) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: insufficient contiguous dscpmask bits"); -+ if (info->ctmark & info->ctmask) -+ xtables_error(PARAMETER_PROBLEM, -+ "CONNMARK savedscp: dscpmask/statemask bits overlap"); -+ break; - case O_AND_MARK: - info->mode = XT_CONNMARK_SET; - info->ctmark = 0; -@@ -351,6 +394,11 @@ static void CONNMARK_print(const void *i - print_mark(markinfo->mark); - print_mask("/", markinfo->mask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK savedscp "); -+ print_mark(markinfo->mark); -+ print_mask("/", markinfo->mask); -+ break; - case XT_CONNMARK_SAVE: - printf(" CONNMARK save "); - print_mask("mask ", markinfo->mask); -@@ -386,6 +434,10 @@ connmark_tg_print(const void *ip, const - printf(" CONNMARK xset 0x%x/0x%x", - info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK DSCP set 0x%x/0x%x", -+ info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) - printf(" CONNMARK save"); -@@ -433,6 +485,10 @@ connmark_tg_print_v2(const void *ip, con - printf(" CONNMARK xset 0x%x/0x%x", - info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" CONNMARK DSCP xset 0x%x/0x%x", -+ info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX) - printf(" CONNMARK save"); -@@ -474,6 +530,11 @@ static void CONNMARK_save(const void *ip - print_mark(markinfo->mark); - print_mask("/", markinfo->mask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark "); -+ print_mark(markinfo->mark); -+ print_mask("/", markinfo->mask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark "); - print_mask("--mask ", markinfo->mask); -@@ -505,6 +566,9 @@ connmark_tg_save(const void *ip, const s - case XT_CONNMARK_SET: - printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", - info->nfmask, info->ctmask); -@@ -529,6 +593,9 @@ connmark_tg_save_v2(const void *ip, cons - case XT_CONNMARK_SET: - printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask); - break; -+ case XT_CONNMARK_SAVEDSCP: -+ printf(" --savedscp-mark 0x%x/0x%x", info->ctmark, info->ctmask); -+ break; - case XT_CONNMARK_SAVE: - printf(" --save-mark --nfmask 0x%x --ctmask 0x%x", - info->nfmask, info->ctmask); ---- a/include/linux/netfilter/xt_connmark.h -+++ b/include/linux/netfilter/xt_connmark.h -@@ -15,7 +15,8 @@ - enum { - XT_CONNMARK_SET = 0, - XT_CONNMARK_SAVE, -- XT_CONNMARK_RESTORE -+ XT_CONNMARK_RESTORE, -+ XT_CONNMARK_SAVEDSCP - }; - - struct xt_connmark_tginfo1 { diff --git a/package/network/utils/iptables/patches/600-shared-libext.patch b/package/network/utils/iptables/patches/600-shared-libext.patch index 7b798b7fda..f5c9c9d779 100644 --- a/package/network/utils/iptables/patches/600-shared-libext.patch +++ b/package/network/utils/iptables/patches/600-shared-libext.patch @@ -54,7 +54,7 @@ initextb_func := $(addprefix ebt_,${pfb_build_static}) --- a/iptables/Makefile.am +++ b/iptables/Makefile.am -@@ -7,19 +7,22 @@ BUILT_SOURCES = +@@ -8,19 +8,22 @@ BUILT_SOURCES = xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c xtables_legacy_multi_CFLAGS = ${AM_CFLAGS} @@ -80,8 +80,8 @@ endif xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm -@@ -28,7 +31,8 @@ xtables_legacy_multi_LDADD += ../libxt - if ENABLE_NFTABLES +@@ -30,7 +33,8 @@ if ENABLE_NFTABLES + BUILT_SOURCES += xtables-config-parser.h xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c xtables_nft_multi_CFLAGS = ${AM_CFLAGS} -xtables_nft_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a @@ -90,13 +90,13 @@ if ENABLE_STATIC xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE endif -@@ -42,7 +46,8 @@ xtables_nft_multi_SOURCES += xtables-sav +@@ -45,7 +49,8 @@ xtables_nft_multi_SOURCES += xtables-sav xtables-eb-standalone.c xtables-eb.c \ xtables-eb-translate.c \ xtables-translate.c -xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a +xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} +xtables_nft_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt + # yacc and lex generate dirty code + xtables_nft_multi-xtables-config-parser.o xtables_nft_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls xtables_nft_multi_SOURCES += xshared.c - xtables_nft_multi_LDADD += ../libxtables/libxtables.la -lm - endif diff --git a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch index 86715fc8e7..328f3af18d 100644 --- a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch +++ b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch @@ -1,6 +1,6 @@ --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c -@@ -1387,6 +1387,7 @@ static int conntrack3_mt6_xlate(struct x +@@ -1389,6 +1389,7 @@ static int conntrack3_mt6_xlate(struct x } static struct xtables_match conntrack_mt_reg[] = { @@ -8,7 +8,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1462,6 +1463,7 @@ static struct xtables_match conntrack_mt +@@ -1464,6 +1465,7 @@ static struct xtables_match conntrack_mt .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, @@ -16,7 +16,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1494,6 +1496,7 @@ static struct xtables_match conntrack_mt +@@ -1496,6 +1498,7 @@ static struct xtables_match conntrack_mt .x6_options = conntrack3_mt_opts, .xlate = conntrack3_mt6_xlate, }, @@ -24,7 +24,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1524,6 +1527,8 @@ static struct xtables_match conntrack_mt +@@ -1526,6 +1529,8 @@ static struct xtables_match conntrack_mt .x6_parse = state_ct23_parse, .x6_options = state_opts, }, @@ -33,7 +33,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1553,6 +1558,7 @@ static struct xtables_match conntrack_mt +@@ -1555,6 +1560,7 @@ static struct xtables_match conntrack_mt .x6_parse = state_parse, .x6_options = state_opts, },