From d23443f4d9b2151f98f498791843f5610dc4755c Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Sat, 24 Oct 2020 18:28:58 +0800 Subject: [PATCH 1/9] netifd: bump to version 2020-10-22 Changelog follows ced0d535 build: find and use libnl header dirs 5722218e proto: rework parse_addr to return struct device_addr 3d7bf604 device_addr: record address index as in the blob 24ce1eab interface: proto_ip: order by address index first This bump mainly affects order of interface addresses in ubus output. At the moment dnsmasq uses first address of an interface for setting dhcp-range option in its config Signed-off-by: Yousong Zhou --- package/network/config/netifd/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile index 3614861e83..2c26517f44 100644 --- a/package/network/config/netifd/Makefile +++ b/package/network/config/netifd/Makefile @@ -5,9 +5,9 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git -PKG_SOURCE_DATE:=2020-10-08 -PKG_SOURCE_VERSION:=64ff909328c095749ef6eaed7302b3e024409d2f -PKG_MIRROR_HASH:=2419944c2e715f1ffaad601ce2a80a6cff279de3912de8262c27183d9c758345 +PKG_SOURCE_DATE:=2020-10-22 +PKG_SOURCE_VERSION:=24ce1eab4910869576406bafd0489daf0d3e6e28 +PKG_MIRROR_HASH:=aa73b4e470e81165baba0262144f410bb05a3ff141cf72ad451914f033868ea1 PKG_MAINTAINER:=Felix Fietkau PKG_LICENSE:=GPL-2.0 From d1592306cc07b9003d554653fc7c53c9168effa7 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 25 Sep 2020 22:59:04 +0800 Subject: [PATCH 2/9] netfilter.mk: use CONFIG_NETFILTER_XT_TARGET_MASQUERADE CONFIG_IP_NF_TARGET_MASQUERADE and its counterpart CONFIG_IP6_NF_TARGET_MASQUERADE are "backwards-compat option for the user's convenience" Related commit d22c1755 ("netfilter: fix NAT packaging with kernels 5.2+") Signed-off-by: Yousong Zhou --- include/netfilter.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 5d6e3a0c98..2047dcc842 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -199,7 +199,7 @@ $(eval $(if $(NF_KMOD),,$(call nf_add,IPT_NAT,CONFIG_NF_NAT, ipt_SNAT ipt_DNAT)) $(eval $(if $(NF_KMOD),,$(call nf_add,IPT_NAT6,CONFIG_IP6_NF_TARGET_NPT, ip6t_DNPT ip6t_SNPT))) $(eval $(call nf_add,IPT_NAT,CONFIG_IP_NF_TARGET_MASQUERADE, $(P_V4)ipt_MASQUERADE, lt 5.2)) -$(eval $(call nf_add,IPT_NAT,CONFIG_IP_NF_TARGET_MASQUERADE, $(P_XT)xt_MASQUERADE, ge 5.2)) +$(eval $(call nf_add,IPT_NAT,CONFIG_NETFILTER_XT_TARGET_MASQUERADE, $(P_XT)xt_MASQUERADE, ge 5.2)) $(eval $(call nf_add,IPT_NAT,CONFIG_IP_NF_TARGET_REDIRECT, $(P_XT)xt_REDIRECT)) From c6bdd7321f8c4fb453e03b48595bcfc87b10331a Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 9 Oct 2020 16:32:48 +0800 Subject: [PATCH 3/9] netfilter.mk: use CONFIG_NETFILTER_XT_TARGET_REDIRECT CONFIG_IP_NF_TARGET_REDIRECT is a compat option since upstream commit 2cbc78a2 ("netfilter: combine ipt_REDIRECT and ip6t_REDIRECT"). That happened since linux 3.10 Signed-off-by: Yousong Zhou --- include/netfilter.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 2047dcc842..9f22512d68 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -200,7 +200,7 @@ $(eval $(if $(NF_KMOD),,$(call nf_add,IPT_NAT6,CONFIG_IP6_NF_TARGET_NPT, ip6t_DN $(eval $(call nf_add,IPT_NAT,CONFIG_IP_NF_TARGET_MASQUERADE, $(P_V4)ipt_MASQUERADE, lt 5.2)) $(eval $(call nf_add,IPT_NAT,CONFIG_NETFILTER_XT_TARGET_MASQUERADE, $(P_XT)xt_MASQUERADE, ge 5.2)) -$(eval $(call nf_add,IPT_NAT,CONFIG_IP_NF_TARGET_REDIRECT, $(P_XT)xt_REDIRECT)) +$(eval $(call nf_add,IPT_NAT,CONFIG_NETFILTER_XT_TARGET_REDIRECT, $(P_XT)xt_REDIRECT)) # nat-extra From a5c10ba9809454226fea6dda175150bc17e793d5 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 25 Sep 2020 22:37:43 +0800 Subject: [PATCH 4/9] netfilter.mk: add version conditional for nf_nat_ipv4,6 The upstream linux commit is 3bf195ae ("netfilter: nat: merge nf_nat_ipv4,6 into nat core"). It was included since linux 5.1 Signed-off-by: Yousong Zhou --- include/netfilter.mk | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 9f22512d68..3c217db106 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -185,8 +185,8 @@ $(eval $(call nf_add,IPT_IPV6_EXTRA,CONFIG_IP6_NF_MATCH_RT, $(P_V6)ip6t_rt)) # kernel only $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT, $(P_XT)nf_nat),)) $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_REDIRECT, $(P_XT)nf_nat_redirect),)) -$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_IPV4, $(P_V4)nf_nat_ipv4),)) -$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT6,CONFIG_NF_NAT_IPV6, $(P_V6)nf_nat_ipv6),)) +$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_IPV4, $(P_V4)nf_nat_ipv4, lt 5.1))) +$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT6,CONFIG_NF_NAT_IPV6, $(P_V6)nf_nat_ipv6, lt 5.1))) $(eval $(if $(NF_KMOD),$(call nf_add,IPT_NAT,CONFIG_NETFILTER_XT_NAT, $(P_XT)xt_nat),)) $(eval $(if $(NF_KMOD),$(call nf_add,IPT_NAT,CONFIG_IP_NF_NAT, $(P_V4)iptable_nat),)) From 4c2141535063b6fe61f36c9bffab7684a48344c5 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 25 Sep 2020 23:02:05 +0800 Subject: [PATCH 5/9] generic: 5.4: make nf nat masquerade in unset state by default Upstream linux 5.1 commit d1aca8ab ("netfilter: nat: merge ipv4 and ipv6 masquerade functionality") replaces the following 2 options - CONFIG_NF_NAT_MASQUERADE_IPV4 - CONFIG_NF_NAT_MASQUERADE_IPV6 with CONFIG_NF_NAT_MASQUERADE. The new option is one without prompt and will be selected by CONFIG_NETFILTER_XT_TARGET_MASQUERADE introduced still later in 5.2. Signed-off-by: Yousong Zhou --- target/linux/generic/config-5.4 | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/target/linux/generic/config-5.4 b/target/linux/generic/config-5.4 index 04fda5de24..b911efdf4e 100644 --- a/target/linux/generic/config-5.4 +++ b/target/linux/generic/config-5.4 @@ -3689,8 +3689,7 @@ CONFIG_NF_CONNTRACK_PROCFS=y # CONFIG_NF_NAT_H323 is not set # CONFIG_NF_NAT_IPV6 is not set # CONFIG_NF_NAT_IRC is not set -CONFIG_NF_NAT_MASQUERADE_IPV4=y -CONFIG_NF_NAT_MASQUERADE_IPV6=y +# CONFIG_NF_NAT_MASQUERADE is not set # CONFIG_NF_NAT_NEEDED is not set # CONFIG_NF_NAT_PPTP is not set # CONFIG_NF_NAT_PROTO_GRE is not set From 32931f18f274741795789e669b92ab6b73e93963 Mon Sep 17 00:00:00 2001 From: Tony Ambardar Date: Mon, 27 Jul 2020 00:24:23 -0700 Subject: [PATCH 6/9] netfilter.mk: add version conditional for CONFIG_NF_CT_PROTO_GRE Kernel commit 22fc4c4c9fd6 ("netfilter: conntrack: gre: switch module to be built-in") moved the CT GRE code into the core nf_conntrack.ko module and changed the CONFIG_NF_CT_PROTO_GRE option to boolean for kernel 5.1 and onwards. CONFIG_NF_CT_PROTO_GRE at the moment has no prompt and can only be selected by NF_CONNTRACK_PPTP Fixes: FS#2990 (partial) Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2990 Signed-off-by: Tony Ambardar [note that the option now can not be enabled on its own] Signed-off-by: Yousong Zhou --- include/netfilter.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 3c217db106..8776391f96 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -219,7 +219,7 @@ $(eval $(call nf_add,NF_NATHELPER,CONFIG_NF_NAT_FTP, $(P_XT)nf_nat_ftp)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_BROADCAST, $(P_XT)nf_conntrack_broadcast)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_AMANDA, $(P_XT)nf_conntrack_amanda)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_AMANDA, $(P_XT)nf_nat_amanda)) -$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CT_PROTO_GRE, $(P_XT)nf_conntrack_proto_gre)) +$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CT_PROTO_GRE, $(P_XT)nf_conntrack_proto_gre, lt 5.1)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_PROTO_GRE, $(P_V4)nf_nat_proto_gre)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_H323, $(P_XT)nf_conntrack_h323)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_H323, $(P_V4)nf_nat_h323)) From 2407118db9adfd4e42be2fa8f1165d30abee007a Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 9 Oct 2020 17:22:04 +0800 Subject: [PATCH 7/9] netfilter.mk: add version conditional around CONFIG_NF_NAT_PROTO_GRE It was removed in upstream linux commit faec18db ("netfilter: nat: remove l4proto->manip_pkt"). This happened since linux 5.0 Signed-off-by: Yousong Zhou --- include/netfilter.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 8776391f96..02173d4355 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -220,7 +220,7 @@ $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_BROADCAST, $(P_XT)nf $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_AMANDA, $(P_XT)nf_conntrack_amanda)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_AMANDA, $(P_XT)nf_nat_amanda)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CT_PROTO_GRE, $(P_XT)nf_conntrack_proto_gre, lt 5.1)) -$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_PROTO_GRE, $(P_V4)nf_nat_proto_gre)) +$(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_PROTO_GRE, $(P_V4)nf_nat_proto_gre, lt 5.0)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_H323, $(P_XT)nf_conntrack_h323)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_H323, $(P_V4)nf_nat_h323)) $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_PPTP, $(P_XT)nf_conntrack_pptp)) From dd5b04bf986962d449d0c7943c712f50aa60bfcc Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Fri, 9 Oct 2020 16:34:16 +0800 Subject: [PATCH 8/9] netfilter.mk: add version conditional around nf_nat_redirect mod Kernel commit 1ac89d20150e ("netfilter: nat: merge nf_nat_redirect into nf_nat") made the redirect module part of the nat core and changed the CONFIG_NF_NAT_REDIRECT option to a boolean, without prompt, affecting kernel 4.18 onwards. CONFIG_NF_NAT_REDIRECT now can only be selected by CONFIG_NFT_REDIR or NETFILTER_XT_TARGET_REDIRECT Fixes: FS#2476 Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2476 Fixes: FS#2990 (partial) Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2990 Signed-off-by: Tony Ambardar [note that the option has no prompt and can only be selected by other kconfig options] Signed-off-by: Yousong Zhou --- include/netfilter.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 02173d4355..0c29c0bd04 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -184,7 +184,7 @@ $(eval $(call nf_add,IPT_IPV6_EXTRA,CONFIG_IP6_NF_MATCH_RT, $(P_V6)ip6t_rt)) # kernel only $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT, $(P_XT)nf_nat),)) -$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_REDIRECT, $(P_XT)nf_nat_redirect),)) +$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_REDIRECT, $(P_XT)nf_nat_redirect, lt 4.18),)) $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_IPV4, $(P_V4)nf_nat_ipv4, lt 5.1))) $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT6,CONFIG_NF_NAT_IPV6, $(P_V6)nf_nat_ipv6, lt 5.1))) From 472a06f7076f5dff5eacad4287792c6ed03ba1d8 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Tue, 20 Oct 2020 09:41:07 +0800 Subject: [PATCH 9/9] netfilter.mk: remove now obsolete kmod nf_nat_redirect Now that the minimal kernel version maintained here is 4.19 Signed-off-by: Yousong Zhou --- include/netfilter.mk | 1 - 1 file changed, 1 deletion(-) diff --git a/include/netfilter.mk b/include/netfilter.mk index 0c29c0bd04..2c71c07056 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -184,7 +184,6 @@ $(eval $(call nf_add,IPT_IPV6_EXTRA,CONFIG_IP6_NF_MATCH_RT, $(P_V6)ip6t_rt)) # kernel only $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT, $(P_XT)nf_nat),)) -$(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_REDIRECT, $(P_XT)nf_nat_redirect, lt 4.18),)) $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT,CONFIG_NF_NAT_IPV4, $(P_V4)nf_nat_ipv4, lt 5.1))) $(eval $(if $(NF_KMOD),$(call nf_add,NF_NAT6,CONFIG_NF_NAT_IPV6, $(P_V6)nf_nat_ipv6, lt 5.1)))