Initial commit
This commit is contained in:
domenico
706
package/network/utils/iptables/Makefile
Normal file
706
package/network/utils/iptables/Makefile
Normal file
@@ -0,0 +1,706 @@
|
||||
#
|
||||
# Copyright (C) 2006-2016 OpenWrt.org
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v2.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
include $(INCLUDE_DIR)/kernel.mk
|
||||
|
||||
PKG_NAME:=iptables
|
||||
PKG_VERSION:=1.8.3
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
|
||||
PKG_HASH:=a23cac034181206b4545f4e7e730e76e08b5f3dd78771ba9645a6756de9cdd80
|
||||
|
||||
PKG_FIXUP:=autoreconf
|
||||
PKG_FLAGS:=nonshared
|
||||
|
||||
PKG_INSTALL:=1
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
PKG_LICENSE:=GPL-2.0
|
||||
PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
ifeq ($(DUMP),)
|
||||
-include $(LINUX_DIR)/.config
|
||||
include $(INCLUDE_DIR)/netfilter.mk
|
||||
STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
|
||||
endif
|
||||
|
||||
|
||||
define Package/iptables/Default
|
||||
SECTION:=net
|
||||
CATEGORY:=Network
|
||||
SUBMENU:=Firewall
|
||||
URL:=https://netfilter.org/
|
||||
endef
|
||||
|
||||
define Package/iptables/Module
|
||||
$(call Package/iptables/Default)
|
||||
DEPENDS:=iptables $(1)
|
||||
endef
|
||||
|
||||
define Package/iptables
|
||||
$(call Package/iptables/Default)
|
||||
TITLE:=IP firewall administration tool
|
||||
MENU:=1
|
||||
DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
|
||||
endef
|
||||
|
||||
define Package/iptables/config
|
||||
config IPTABLES_CONNLABEL
|
||||
bool "Enable Connlabel support"
|
||||
default n
|
||||
help
|
||||
This enable connlabel support in iptables.
|
||||
|
||||
config IPTABLES_NFTABLES
|
||||
bool "Enable Nftables support"
|
||||
default n
|
||||
help
|
||||
This enable nftables support in iptables.
|
||||
endef
|
||||
|
||||
define Package/iptables/description
|
||||
IP firewall administration tool.
|
||||
|
||||
Matches:
|
||||
- icmp
|
||||
- tcp
|
||||
- udp
|
||||
- comment
|
||||
- conntrack
|
||||
- limit
|
||||
- mac
|
||||
- mark
|
||||
- multiport
|
||||
- set
|
||||
- state
|
||||
- time
|
||||
|
||||
Targets:
|
||||
- ACCEPT
|
||||
- CT
|
||||
- DNAT
|
||||
- DROP
|
||||
- REJECT
|
||||
- FLOWOFFLOAD
|
||||
- LOG
|
||||
- MARK
|
||||
- MASQUERADE
|
||||
- REDIRECT
|
||||
- SET
|
||||
- SNAT
|
||||
- TCPMSS
|
||||
|
||||
Tables:
|
||||
- filter
|
||||
- mangle
|
||||
- nat
|
||||
- raw
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-nft
|
||||
$(call Package/iptables/Default)
|
||||
TITLE:=IP firewall administration tool nft
|
||||
DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-nft
|
||||
endef
|
||||
|
||||
define Package/iptables-nft/description
|
||||
Extra iptables nftables nft binaries.
|
||||
iptables-nft
|
||||
iptables-nft-restore
|
||||
iptables-nft-save
|
||||
iptables-translate
|
||||
iptables-restore-translate
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-conntrack-extra
|
||||
$(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw)
|
||||
TITLE:=Extra connection tracking extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-conntrack-extra/description
|
||||
Extra iptables extensions for connection tracking.
|
||||
|
||||
Matches:
|
||||
- connbytes
|
||||
- connlimit
|
||||
- connmark
|
||||
- recent
|
||||
- helper
|
||||
|
||||
Targets:
|
||||
- CONNMARK
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-conntrack-label
|
||||
$(call Package/iptables/Module, +kmod-ipt-conntrack-label @IPTABLES_CONNLABEL)
|
||||
TITLE:=Connection tracking labeling extension
|
||||
DEFAULT:=y if IPTABLES_CONNLABEL
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-conntrack-label/description
|
||||
Match and set label(s) on connection tracking entries
|
||||
|
||||
Matches:
|
||||
- connlabel
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-filter
|
||||
$(call Package/iptables/Module, +kmod-ipt-filter)
|
||||
TITLE:=Content inspection extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-filter/description
|
||||
iptables extensions for packet content inspection.
|
||||
Includes support for:
|
||||
|
||||
Matches:
|
||||
- string
|
||||
- bpf
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ipopt
|
||||
$(call Package/iptables/Module, +kmod-ipt-ipopt)
|
||||
TITLE:=IP/Packet option extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ipopt/description
|
||||
iptables extensions for matching/changing IP packet options.
|
||||
|
||||
Matches:
|
||||
- dscp
|
||||
- ecn
|
||||
- length
|
||||
- statistic
|
||||
- tcpmss
|
||||
- unclean
|
||||
- hl
|
||||
|
||||
Targets:
|
||||
- DSCP
|
||||
- CLASSIFY
|
||||
- ECN
|
||||
- HL
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ipsec
|
||||
$(call Package/iptables/Module, +kmod-ipt-ipsec)
|
||||
TITLE:=IPsec extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ipsec/description
|
||||
iptables extensions for matching ipsec traffic.
|
||||
|
||||
Matches:
|
||||
- ah
|
||||
- esp
|
||||
- policy
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-nat-extra
|
||||
$(call Package/iptables/Module, +kmod-ipt-nat-extra)
|
||||
TITLE:=Extra NAT extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-nat-extra/description
|
||||
iptables extensions for extra NAT targets.
|
||||
|
||||
Targets:
|
||||
- MIRROR
|
||||
- NETMAP
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ulog
|
||||
$(call Package/iptables/Module, +kmod-ipt-ulog)
|
||||
TITLE:=user-space packet logging
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-ulog/description
|
||||
iptables extensions for user-space packet logging.
|
||||
|
||||
Targets:
|
||||
- ULOG
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-nflog
|
||||
$(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
|
||||
TITLE:=Netfilter NFLOG target
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-nflog/description
|
||||
iptables extension for user-space logging via NFNETLINK.
|
||||
|
||||
Includes:
|
||||
- libxt_NFLOG
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-trace
|
||||
$(call Package/iptables/Module, +kmod-ipt-debug)
|
||||
TITLE:=Netfilter TRACE target
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-trace/description
|
||||
iptables extension for TRACE target
|
||||
|
||||
Includes:
|
||||
- libxt_TRACE
|
||||
|
||||
endef
|
||||
|
||||
|
||||
define Package/iptables-mod-nfqueue
|
||||
$(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
|
||||
TITLE:=Netfilter NFQUEUE target
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-nfqueue/description
|
||||
iptables extension for user-space queuing via NFNETLINK.
|
||||
|
||||
Includes:
|
||||
- libxt_NFQUEUE
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-hashlimit
|
||||
$(call Package/iptables/Module, +kmod-ipt-hashlimit)
|
||||
TITLE:=hashlimit matching
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-hashlimit/description
|
||||
iptables extensions for hashlimit matching
|
||||
|
||||
Matches:
|
||||
- hashlimit
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-rpfilter
|
||||
$(call Package/iptables/Module, +kmod-ipt-rpfilter)
|
||||
TITLE:=rpfilter iptables extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-rpfilter/description
|
||||
iptables extensions for reverse path filter test on a packet
|
||||
|
||||
Matches:
|
||||
- rpfilter
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-iprange
|
||||
$(call Package/iptables/Module, +kmod-ipt-iprange)
|
||||
TITLE:=IP range extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-iprange/description
|
||||
iptables extensions for matching ip ranges.
|
||||
|
||||
Matches:
|
||||
- iprange
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-cluster
|
||||
$(call Package/iptables/Module, +kmod-ipt-cluster)
|
||||
TITLE:=Match cluster extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-cluster/description
|
||||
iptables extensions for matching cluster.
|
||||
|
||||
Netfilter (IPv4/IPv6) module for matching cluster
|
||||
This option allows you to build work-load-sharing clusters of
|
||||
network servers/stateful firewalls without having a dedicated
|
||||
load-balancing router/server/switch. Basically, this match returns
|
||||
true when the packet must be handled by this cluster node. Thus,
|
||||
all nodes see all packets and this match decides which node handles
|
||||
what packets. The work-load sharing algorithm is based on source
|
||||
address hashing.
|
||||
|
||||
This module is usable for ipv4 and ipv6.
|
||||
|
||||
If you select it, it enables kmod-ipt-cluster.
|
||||
|
||||
see `iptables -m cluster --help` for more information.
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-clusterip
|
||||
$(call Package/iptables/Module, +kmod-ipt-clusterip)
|
||||
TITLE:=Clusterip extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-clusterip/description
|
||||
iptables extensions for CLUSTERIP.
|
||||
The CLUSTERIP target allows you to build load-balancing clusters of
|
||||
network servers without having a dedicated load-balancing
|
||||
router/server/switch.
|
||||
|
||||
If you select it, it enables kmod-ipt-clusterip.
|
||||
|
||||
see `iptables -j CLUSTERIP --help` for more information.
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-extra
|
||||
$(call Package/iptables/Module, +kmod-ipt-extra)
|
||||
TITLE:=Other extra iptables extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-extra/description
|
||||
Other extra iptables extensions.
|
||||
|
||||
Matches:
|
||||
- addrtype
|
||||
- condition
|
||||
- owner
|
||||
- pkttype
|
||||
- quota
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-physdev
|
||||
$(call Package/iptables/Module, +kmod-ipt-physdev)
|
||||
TITLE:=physdev iptables extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-physdev/description
|
||||
The iptables physdev match.
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-led
|
||||
$(call Package/iptables/Module, +kmod-ipt-led)
|
||||
TITLE:=LED trigger iptables extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-led/description
|
||||
iptables extension for triggering a LED.
|
||||
|
||||
Targets:
|
||||
- LED
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-tproxy
|
||||
$(call Package/iptables/Module, +kmod-ipt-tproxy)
|
||||
TITLE:=Transparent proxy iptables extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-tproxy/description
|
||||
Transparent proxy iptables extensions.
|
||||
|
||||
Matches:
|
||||
- socket
|
||||
|
||||
Targets:
|
||||
- TPROXY
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-tee
|
||||
$(call Package/iptables/Module, +kmod-ipt-tee)
|
||||
TITLE:=TEE iptables extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-tee/description
|
||||
TEE iptables extensions.
|
||||
|
||||
Targets:
|
||||
- TEE
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-u32
|
||||
$(call Package/iptables/Module, +kmod-ipt-u32)
|
||||
TITLE:=U32 iptables extensions
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-u32/description
|
||||
U32 iptables extensions.
|
||||
|
||||
Matches:
|
||||
- u32
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-checksum
|
||||
$(call Package/iptables/Module, +kmod-ipt-checksum)
|
||||
TITLE:=IP CHECKSUM target extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-checksum/description
|
||||
iptables extension for the CHECKSUM calculation target
|
||||
endef
|
||||
|
||||
define Package/ip6tables
|
||||
$(call Package/iptables/Default)
|
||||
DEPENDS:=@IPV6 +kmod-ip6tables +iptables
|
||||
CATEGORY:=Network
|
||||
TITLE:=IPv6 firewall administration tool
|
||||
MENU:=1
|
||||
endef
|
||||
|
||||
define Package/ip6tables-nft
|
||||
$(call Package/iptables/Default)
|
||||
DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-nft
|
||||
TITLE:=IP firewall administration tool nft
|
||||
endef
|
||||
|
||||
define Package/ip6tables-nft/description
|
||||
Extra ip6tables nftables nft binaries.
|
||||
iptables-nft
|
||||
iptables-nft-restore
|
||||
iptables-nft-save
|
||||
iptables-translate
|
||||
iptables-restore-translate
|
||||
endef
|
||||
|
||||
define Package/ip6tables-extra
|
||||
$(call Package/iptables/Default)
|
||||
DEPENDS:=ip6tables +kmod-ip6tables-extra
|
||||
TITLE:=IPv6 header matching modules
|
||||
endef
|
||||
|
||||
define Package/ip6tables-mod-extra/description
|
||||
iptables header matching modules for IPv6
|
||||
endef
|
||||
|
||||
define Package/ip6tables-mod-nat
|
||||
$(call Package/iptables/Default)
|
||||
DEPENDS:=ip6tables +kmod-ipt-nat6
|
||||
TITLE:=IPv6 NAT extensions
|
||||
endef
|
||||
|
||||
define Package/ip6tables-mod-nat/description
|
||||
iptables extensions for IPv6-NAT targets.
|
||||
endef
|
||||
|
||||
define Package/libiptc
|
||||
$(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
DEPENDS:=+libip4tc +libip6tc +libxtables
|
||||
ABI_VERSION:=0
|
||||
TITLE:=IPv4/IPv6 firewall - shared libiptc library (nf compatibility stub)
|
||||
endef
|
||||
|
||||
define Package/libip4tc
|
||||
$(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4 firewall - shared libiptc library
|
||||
ABI_VERSION:=2
|
||||
DEPENDS:=+libxtables
|
||||
endef
|
||||
|
||||
define Package/libip6tc
|
||||
$(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv6 firewall - shared libiptc library
|
||||
ABI_VERSION:=2
|
||||
DEPENDS:=+libxtables
|
||||
endef
|
||||
|
||||
define Package/libxtables
|
||||
$(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4/IPv6 firewall - shared xtables library
|
||||
ABI_VERSION:=12
|
||||
DEPENDS:= \
|
||||
+IPTABLES_CONNLABEL:libnetfilter-conntrack \
|
||||
+IPTABLES_NFTABLES:libnftnl
|
||||
endef
|
||||
|
||||
define Package/libxtables-nft
|
||||
$(call Package/iptables/Default)
|
||||
SECTION:=libs
|
||||
CATEGORY:=Libraries
|
||||
TITLE:=IPv4/IPv6 firewall - shared xtables nft library
|
||||
ABI_VERSION:=12
|
||||
DEPENDS:=libxtables
|
||||
endef
|
||||
|
||||
TARGET_CPPFLAGS := \
|
||||
-I$(PKG_BUILD_DIR)/include \
|
||||
-I$(LINUX_DIR)/user_headers/include \
|
||||
$(TARGET_CPPFLAGS)
|
||||
|
||||
TARGET_CFLAGS += \
|
||||
-I$(PKG_BUILD_DIR)/include \
|
||||
-I$(LINUX_DIR)/user_headers/include \
|
||||
-ffunction-sections -fdata-sections \
|
||||
-DNO_LEGACY
|
||||
|
||||
TARGET_LDFLAGS += \
|
||||
-Wl,--gc-sections
|
||||
|
||||
CONFIGURE_ARGS += \
|
||||
--enable-shared \
|
||||
--enable-static \
|
||||
--enable-devel \
|
||||
--with-kernel="$(LINUX_DIR)/user_headers" \
|
||||
--with-xtlibdir=/usr/lib/iptables \
|
||||
--with-xt-lock-name=/var/run/xtables.lock \
|
||||
$(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
|
||||
$(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
|
||||
$(if $(CONFIG_IPV6),,--disable-ipv6)
|
||||
|
||||
MAKE_FLAGS := \
|
||||
$(TARGET_CONFIGURE_OPTS) \
|
||||
COPT_FLAGS="$(TARGET_CFLAGS)" \
|
||||
KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
|
||||
KBUILD_OUTPUT="$(LINUX_DIR)" \
|
||||
BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
|
||||
|
||||
ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
|
||||
define Build/Configure/rebuild
|
||||
$(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
|
||||
rm -f $(PKG_BUILD_DIR)/.config_*
|
||||
rm -f $(PKG_BUILD_DIR)/.configured_*
|
||||
touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
|
||||
endef
|
||||
endif
|
||||
|
||||
define Build/Configure
|
||||
$(Build/Configure/rebuild)
|
||||
$(Build/Configure/Default)
|
||||
endef
|
||||
|
||||
define Build/InstallDev
|
||||
$(INSTALL_DIR) $(1)/usr/include
|
||||
$(INSTALL_DIR) $(1)/usr/include/iptables
|
||||
$(INSTALL_DIR) $(1)/usr/include/net/netfilter
|
||||
|
||||
# XXX: iptables header fixup, some headers are not installed by iptables anymore
|
||||
$(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
|
||||
$(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
|
||||
$(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
|
||||
$(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
|
||||
$(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
|
||||
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
|
||||
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
|
||||
|
||||
# XXX: needed by firewall3
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/iptables/install
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
|
||||
$(INSTALL_DIR) $(1)/usr/lib/iptables
|
||||
endef
|
||||
|
||||
define Package/iptables-nft/install
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/
|
||||
endef
|
||||
|
||||
define Package/ip6tables/install
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
|
||||
endef
|
||||
|
||||
define Package/ip6tables-nft/install
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-nft{,-restore,-save} $(1)/usr/sbin/
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/
|
||||
endef
|
||||
|
||||
define Package/libiptc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so.* $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libip4tc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libip6tc/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libxtables/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define Package/libxtables-nft/install
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/
|
||||
endef
|
||||
|
||||
define BuildPlugin
|
||||
define Package/$(1)/install
|
||||
$(INSTALL_DIR) $$(1)/usr/lib/iptables
|
||||
for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
|
||||
if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
|
||||
fi; \
|
||||
done
|
||||
$(3)
|
||||
endef
|
||||
|
||||
$$(eval $$(call BuildPackage,$(1)))
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,iptables))
|
||||
$(eval $(call BuildPackage,iptables-nft))
|
||||
$(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-physdev,$(IPT_PHYSDEV-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
|
||||
$(eval $(call BuildPackage,ip6tables))
|
||||
$(eval $(call BuildPackage,ip6tables-nft))
|
||||
$(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
|
||||
$(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
|
||||
$(eval $(call BuildPackage,libiptc))
|
||||
$(eval $(call BuildPackage,libip4tc))
|
||||
$(eval $(call BuildPackage,libip6tc))
|
||||
$(eval $(call BuildPackage,libxtables))
|
||||
$(eval $(call BuildPackage,libxtables-nft))
|
||||
@@ -0,0 +1,28 @@
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -903,12 +903,6 @@ static void xtables_check_options(const
|
||||
|
||||
void xtables_register_match(struct xtables_match *me)
|
||||
{
|
||||
- if (me->next) {
|
||||
- fprintf(stderr, "%s: match \"%s\" already registered\n",
|
||||
- xt_params->program_name, me->name);
|
||||
- exit(1);
|
||||
- }
|
||||
-
|
||||
if (me->version == NULL) {
|
||||
fprintf(stderr, "%s: match %s<%u> is missing a version\n",
|
||||
xt_params->program_name, me->name, me->revision);
|
||||
@@ -1096,12 +1090,6 @@ void xtables_register_matches(struct xta
|
||||
|
||||
void xtables_register_target(struct xtables_target *me)
|
||||
{
|
||||
- if (me->next) {
|
||||
- fprintf(stderr, "%s: target \"%s\" already registered\n",
|
||||
- xt_params->program_name, me->name);
|
||||
- exit(1);
|
||||
- }
|
||||
-
|
||||
if (me->version == NULL) {
|
||||
fprintf(stderr, "%s: target %s<%u> is missing a version\n",
|
||||
xt_params->program_name, me->name, me->revision);
|
||||
@@ -0,0 +1,18 @@
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -360,6 +360,7 @@ static char *get_modprobe(void)
|
||||
|
||||
int xtables_insmod(const char *modname, const char *modprobe, bool quiet)
|
||||
{
|
||||
+#if 0
|
||||
char *buf = NULL;
|
||||
char *argv[4];
|
||||
int status;
|
||||
@@ -394,6 +395,7 @@ int xtables_insmod(const char *modname,
|
||||
free(buf);
|
||||
if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
|
||||
return 0;
|
||||
+#endif
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
--- a/iptables/xtables-legacy-multi.c
|
||||
+++ b/iptables/xtables-legacy-multi.c
|
||||
@@ -32,8 +32,10 @@ static const struct subcommand multi_sub
|
||||
|
||||
|
||||
#endif
|
||||
+#ifdef ENABLE_XML
|
||||
{"iptables-xml", iptables_xml_main},
|
||||
{"xml", iptables_xml_main},
|
||||
+#endif
|
||||
#ifdef ENABLE_IPV6
|
||||
{"ip6tables", ip6tables_main},
|
||||
{"main6", ip6tables_main},
|
||||
@@ -0,0 +1,79 @@
|
||||
--- a/extensions/GNUmakefile.in
|
||||
+++ b/extensions/GNUmakefile.in
|
||||
@@ -50,11 +50,31 @@ pfb_build_mod := $(filter-out @blacklist
|
||||
pfa_build_mod := $(filter-out @blacklist_modules@ @blacklist_a_modules@,${pfa_build_mod})
|
||||
pf4_build_mod := $(filter-out @blacklist_modules@ @blacklist_4_modules@,${pf4_build_mod})
|
||||
pf6_build_mod := $(filter-out @blacklist_modules@ @blacklist_6_modules@,${pf6_build_mod})
|
||||
-pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod})
|
||||
-pfb_objs := $(patsubst %,libebt_%.o,${pfb_build_mod})
|
||||
-pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_mod})
|
||||
-pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod})
|
||||
-pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod})
|
||||
+ifdef BUILTIN_MODULES
|
||||
+pfx_build_static := $(filter $(BUILTIN_MODULES),${pfx_build_mod})
|
||||
+pfb_build_static := $(filter $(BUILTIN_MODULES),${pfb_build_mod})
|
||||
+pfa_build_static := $(filter $(BUILTIN_MODULES),${pfa_build_mod})
|
||||
+pf4_build_static := $(filter $(BUILTIN_MODULES),${pf4_build_mod})
|
||||
+pf6_build_static := $(filter $(BUILTIN_MODULES),${pf6_build_mod})
|
||||
+else
|
||||
+@ENABLE_STATIC_TRUE@ pfx_build_static := $(pfx_build_mod)
|
||||
+@ENABLE_STATIC_TRUE@ pfb_build_static := $(pfb_build_mod)
|
||||
+@ENABLE_STATIC_TRUE@ pfa_build_static := $(pfa_build_mod)
|
||||
+@ENABLE_STATIC_TRUE@ pf4_build_static := $(pf4_build_mod)
|
||||
+@ENABLE_STATIC_TRUE@ pf6_build_static := $(pf6_build_mod)
|
||||
+endif
|
||||
+
|
||||
+pfx_build_mod := $(filter-out $(pfx_build_static),$(pfx_build_mod))
|
||||
+pfb_build_mod := $(filter-out $(pfb_build_static),$(pfb_build_mod))
|
||||
+pfa_build_mod := $(filter-out $(pfa_build_static),$(pfa_build_mod))
|
||||
+pf4_build_mod := $(filter-out $(pf4_build_static),$(pf4_build_mod))
|
||||
+pf6_build_mod := $(filter-out $(pf6_build_static),$(pf6_build_mod))
|
||||
+
|
||||
+pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_static})
|
||||
+pfb_objs := $(patsubst %,libebt_%.o,${pfb_build_static})
|
||||
+pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_static})
|
||||
+pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static})
|
||||
+pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static})
|
||||
pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod})
|
||||
pfb_solibs := $(patsubst %,libebt_%.so,${pfb_build_mod})
|
||||
pfa_solibs := $(patsubst %,libarpt_%.so,${pfa_build_mod})
|
||||
@@ -68,14 +88,14 @@ pfx_symlink_files := $(patsubst %,libxt_
|
||||
#
|
||||
targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man
|
||||
targets_install :=
|
||||
-@ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext_ebt_objs := ${pfb_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext_arpt_objs := ${pfa_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs}
|
||||
-@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs}
|
||||
-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
|
||||
-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}
|
||||
-@ENABLE_STATIC_FALSE@ symlinks_install := ${pfx_symlink_files}
|
||||
+libext_objs := ${pfx_objs}
|
||||
+libext_ebt_objs := ${pfb_objs}
|
||||
+libext_arpt_objs := ${pfa_objs}
|
||||
+libext4_objs := ${pf4_objs}
|
||||
+libext6_objs := ${pf6_objs}
|
||||
+targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
|
||||
+targets_install := $(strip ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs})
|
||||
+symlinks_install := ${pfx_symlink_files}
|
||||
|
||||
.SECONDARY:
|
||||
|
||||
@@ -148,11 +168,11 @@ libext4.a: initext4.o ${libext4_objs}
|
||||
libext6.a: initext6.o ${libext6_objs}
|
||||
${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
|
||||
-initext_func := $(addprefix xt_,${pfx_build_mod})
|
||||
-initextb_func := $(addprefix ebt_,${pfb_build_mod})
|
||||
-initexta_func := $(addprefix arpt_,${pfa_build_mod})
|
||||
-initext4_func := $(addprefix ipt_,${pf4_build_mod})
|
||||
-initext6_func := $(addprefix ip6t_,${pf6_build_mod})
|
||||
+initext_func := $(addprefix xt_,${pfx_build_static})
|
||||
+initextb_func := $(addprefix ebt_,${pfb_build_static})
|
||||
+initexta_func := $(addprefix arpt_,${pfa_build_static})
|
||||
+initext4_func := $(addprefix ipt_,${pf4_build_static})
|
||||
+initext6_func := $(addprefix ip6t_,${pf6_build_static})
|
||||
|
||||
.initext.dd: FORCE
|
||||
@echo "${initext_func}" >$@.tmp; \
|
||||
102
package/network/utils/iptables/patches/600-shared-libext.patch
Normal file
102
package/network/utils/iptables/patches/600-shared-libext.patch
Normal file
@@ -0,0 +1,102 @@
|
||||
--- a/extensions/GNUmakefile.in
|
||||
+++ b/extensions/GNUmakefile.in
|
||||
@@ -86,7 +86,7 @@ pfx_symlink_files := $(patsubst %,libxt_
|
||||
#
|
||||
# Building blocks
|
||||
#
|
||||
-targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man
|
||||
+targets := libiptext.so libiptext4.so libiptext6.so libiptext_ebt.so libiptext_arpt.so matches.man targets.man
|
||||
targets_install :=
|
||||
libext_objs := ${pfx_objs}
|
||||
libext_ebt_objs := ${pfb_objs}
|
||||
@@ -119,7 +119,7 @@ clean:
|
||||
distclean: clean
|
||||
|
||||
init%.o: init%.c
|
||||
- ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=$*_init ${CFLAGS} -o $@ -c $<;
|
||||
+ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
|
||||
-include .*.d
|
||||
|
||||
@@ -151,22 +151,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
|
||||
# handling code in the Makefiles.
|
||||
#
|
||||
lib%.o: ${srcdir}/lib%.c
|
||||
- ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -D_INIT=lib$*_init ${CFLAGS} -o $@ -c $<;
|
||||
+ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
|
||||
|
||||
-libext.a: initext.o ${libext_objs}
|
||||
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
+libiptext.so: initext.o ${libext_objs}
|
||||
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
|
||||
|
||||
-libext_ebt.a: initextb.o ${libext_ebt_objs}
|
||||
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
+libiptext_ebt.so: initextb.o ${libext_ebt_objs}
|
||||
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
|
||||
|
||||
-libext_arpt.a: initexta.o ${libext_arpt_objs}
|
||||
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
+libiptext_arpt.so: initexta.o ${libext_arpt_objs}
|
||||
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
|
||||
|
||||
-libext4.a: initext4.o ${libext4_objs}
|
||||
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
+libiptext4.so: initext4.o ${libext4_objs}
|
||||
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
|
||||
|
||||
-libext6.a: initext6.o ${libext6_objs}
|
||||
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
|
||||
+libiptext6.so: initext6.o ${libext6_objs}
|
||||
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
|
||||
|
||||
initext_func := $(addprefix xt_,${pfx_build_static})
|
||||
initextb_func := $(addprefix ebt_,${pfb_build_static})
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -8,19 +8,22 @@ BUILT_SOURCES =
|
||||
|
||||
xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c
|
||||
xtables_legacy_multi_CFLAGS = ${AM_CFLAGS}
|
||||
-xtables_legacy_multi_LDADD = ../extensions/libext.a
|
||||
+xtables_legacy_multi_LDADD =
|
||||
+xtables_legacy_multi_LDFLAGS = -L../extensions/ -liptext
|
||||
if ENABLE_STATIC
|
||||
xtables_legacy_multi_CFLAGS += -DALL_INCLUSIVE
|
||||
endif
|
||||
if ENABLE_IPV4
|
||||
xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c
|
||||
xtables_legacy_multi_CFLAGS += -DENABLE_IPV4
|
||||
-xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a
|
||||
+xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la
|
||||
+xtables_legacy_multi_LDFLAGS += -liptext4
|
||||
endif
|
||||
if ENABLE_IPV6
|
||||
xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c
|
||||
xtables_legacy_multi_CFLAGS += -DENABLE_IPV6
|
||||
-xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
|
||||
+xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la
|
||||
+xtables_legacy_multi_LDFLAGS += -liptext6
|
||||
endif
|
||||
xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c
|
||||
xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
|
||||
@@ -30,7 +33,8 @@ if ENABLE_NFTABLES
|
||||
BUILT_SOURCES += xtables-config-parser.h
|
||||
xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c
|
||||
xtables_nft_multi_CFLAGS = ${AM_CFLAGS}
|
||||
-xtables_nft_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a
|
||||
+xtables_nft_multi_LDADD =
|
||||
+xtables_nft_multi_LDFLAGS = -L../extensions/ -liptext -liptext_ebt
|
||||
if ENABLE_STATIC
|
||||
xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE
|
||||
endif
|
||||
@@ -45,7 +49,8 @@ xtables_nft_multi_SOURCES += xtables-sav
|
||||
xtables-eb-standalone.c xtables-eb.c \
|
||||
xtables-eb-translate.c \
|
||||
xtables-translate.c
|
||||
-xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a
|
||||
+xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS}
|
||||
+xtables_nft_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt
|
||||
# yacc and lex generate dirty code
|
||||
xtables_nft_multi-xtables-config-parser.o xtables_nft_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls
|
||||
xtables_nft_multi_SOURCES += xshared.c
|
||||
@@ -0,0 +1,95 @@
|
||||
--- a/extensions/libxt_conntrack.c
|
||||
+++ b/extensions/libxt_conntrack.c
|
||||
@@ -1389,6 +1389,7 @@ static int conntrack3_mt6_xlate(struct x
|
||||
}
|
||||
|
||||
static struct xtables_match conntrack_mt_reg[] = {
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.version = XTABLES_VERSION,
|
||||
.name = "conntrack",
|
||||
@@ -1464,6 +1465,7 @@ static struct xtables_match conntrack_mt
|
||||
.alias = conntrack_print_name_alias,
|
||||
.x6_options = conntrack2_mt_opts,
|
||||
},
|
||||
+#endif
|
||||
{
|
||||
.version = XTABLES_VERSION,
|
||||
.name = "conntrack",
|
||||
@@ -1496,6 +1498,7 @@ static struct xtables_match conntrack_mt
|
||||
.x6_options = conntrack3_mt_opts,
|
||||
.xlate = conntrack3_mt6_xlate,
|
||||
},
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "state",
|
||||
@@ -1526,6 +1529,8 @@ static struct xtables_match conntrack_mt
|
||||
.x6_parse = state_ct23_parse,
|
||||
.x6_options = state_opts,
|
||||
},
|
||||
+#endif
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "state",
|
||||
@@ -1555,6 +1560,7 @@ static struct xtables_match conntrack_mt
|
||||
.x6_parse = state_parse,
|
||||
.x6_options = state_opts,
|
||||
},
|
||||
+#endif
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
--- a/extensions/libxt_CT.c
|
||||
+++ b/extensions/libxt_CT.c
|
||||
@@ -349,6 +349,7 @@ static void notrack_ct2_tg_init(struct x
|
||||
}
|
||||
|
||||
static struct xtables_target ct_target_reg[] = {
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "CT",
|
||||
@@ -374,6 +375,7 @@ static struct xtables_target ct_target_r
|
||||
.x6_parse = ct_parse_v1,
|
||||
.x6_options = ct_opts_v1,
|
||||
},
|
||||
+#endif
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "CT",
|
||||
@@ -388,6 +390,7 @@ static struct xtables_target ct_target_r
|
||||
.x6_parse = ct_parse_v1,
|
||||
.x6_options = ct_opts_v1,
|
||||
},
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.family = NFPROTO_UNSPEC,
|
||||
.name = "NOTRACK",
|
||||
@@ -425,6 +428,7 @@ static struct xtables_target ct_target_r
|
||||
.revision = 0,
|
||||
.version = XTABLES_VERSION,
|
||||
},
|
||||
+#endif
|
||||
};
|
||||
|
||||
void _init(void)
|
||||
--- a/extensions/libxt_multiport.c
|
||||
+++ b/extensions/libxt_multiport.c
|
||||
@@ -571,6 +571,7 @@ static int multiport_xlate6_v1(struct xt
|
||||
}
|
||||
|
||||
static struct xtables_match multiport_mt_reg[] = {
|
||||
+#ifndef NO_LEGACY
|
||||
{
|
||||
.family = NFPROTO_IPV4,
|
||||
.name = "multiport",
|
||||
@@ -601,6 +602,7 @@ static struct xtables_match multiport_mt
|
||||
.x6_options = multiport_opts,
|
||||
.xlate = multiport_xlate6,
|
||||
},
|
||||
+#endif
|
||||
{
|
||||
.family = NFPROTO_IPV4,
|
||||
.name = "multiport",
|
||||
@@ -0,0 +1,95 @@
|
||||
--- /dev/null
|
||||
+++ b/extensions/libxt_FLOWOFFLOAD.c
|
||||
@@ -0,0 +1,72 @@
|
||||
+#include <stdio.h>
|
||||
+#include <xtables.h>
|
||||
+#include <linux/netfilter/xt_FLOWOFFLOAD.h>
|
||||
+
|
||||
+enum {
|
||||
+ O_HW,
|
||||
+};
|
||||
+
|
||||
+static void offload_help(void)
|
||||
+{
|
||||
+ printf(
|
||||
+"FLOWOFFLOAD target options:\n"
|
||||
+" --hw Enable hardware offload\n"
|
||||
+ );
|
||||
+}
|
||||
+
|
||||
+static const struct xt_option_entry offload_opts[] = {
|
||||
+ {.name = "hw", .id = O_HW, .type = XTTYPE_NONE},
|
||||
+ XTOPT_TABLEEND,
|
||||
+};
|
||||
+
|
||||
+static void offload_parse(struct xt_option_call *cb)
|
||||
+{
|
||||
+ struct xt_flowoffload_target_info *info = cb->data;
|
||||
+
|
||||
+ xtables_option_parse(cb);
|
||||
+ switch (cb->entry->id) {
|
||||
+ case O_HW:
|
||||
+ info->flags |= XT_FLOWOFFLOAD_HW;
|
||||
+ break;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+static void offload_print(const void *ip, const struct xt_entry_target *target, int numeric)
|
||||
+{
|
||||
+ const struct xt_flowoffload_target_info *info =
|
||||
+ (const struct xt_flowoffload_target_info *)target->data;
|
||||
+
|
||||
+ printf(" FLOWOFFLOAD");
|
||||
+ if (info->flags & XT_FLOWOFFLOAD_HW)
|
||||
+ printf(" hw");
|
||||
+}
|
||||
+
|
||||
+static void offload_save(const void *ip, const struct xt_entry_target *target)
|
||||
+{
|
||||
+ const struct xt_flowoffload_target_info *info =
|
||||
+ (const struct xt_flowoffload_target_info *)target->data;
|
||||
+
|
||||
+ if (info->flags & XT_FLOWOFFLOAD_HW)
|
||||
+ printf(" --hw");
|
||||
+}
|
||||
+
|
||||
+static struct xtables_target offload_tg_reg[] = {
|
||||
+ {
|
||||
+ .family = NFPROTO_UNSPEC,
|
||||
+ .name = "FLOWOFFLOAD",
|
||||
+ .revision = 0,
|
||||
+ .version = XTABLES_VERSION,
|
||||
+ .size = XT_ALIGN(sizeof(struct xt_flowoffload_target_info)),
|
||||
+ .userspacesize = sizeof(struct xt_flowoffload_target_info),
|
||||
+ .help = offload_help,
|
||||
+ .print = offload_print,
|
||||
+ .save = offload_save,
|
||||
+ .x6_parse = offload_parse,
|
||||
+ .x6_options = offload_opts,
|
||||
+ },
|
||||
+};
|
||||
+
|
||||
+void _init(void)
|
||||
+{
|
||||
+ xtables_register_targets(offload_tg_reg, ARRAY_SIZE(offload_tg_reg));
|
||||
+}
|
||||
--- /dev/null
|
||||
+++ b/include/linux/netfilter/xt_FLOWOFFLOAD.h
|
||||
@@ -0,0 +1,17 @@
|
||||
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
||||
+#ifndef _XT_FLOWOFFLOAD_H
|
||||
+#define _XT_FLOWOFFLOAD_H
|
||||
+
|
||||
+#include <linux/types.h>
|
||||
+
|
||||
+enum {
|
||||
+ XT_FLOWOFFLOAD_HW = 1 << 0,
|
||||
+
|
||||
+ XT_FLOWOFFLOAD_MASK = XT_FLOWOFFLOAD_HW
|
||||
+};
|
||||
+
|
||||
+struct xt_flowoffload_target_info {
|
||||
+ __u32 flags;
|
||||
+};
|
||||
+
|
||||
+#endif /* _XT_FLOWOFFLOAD_H */
|
||||
Reference in New Issue
Block a user