domenico/openwrt-kernel5.4-nss-qsdk10.0
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
domenico
2025-06-24 13:14:22 +02:00
commit 4002f145fc
9002 changed files with 1731834 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

452
package/network/utils/iptables/patches/010-add-set-dscpmark-support.patch Normal file
View File

@@ -0,0 +1,452 @@
From 74267bacce0c43e5038b0377cb7c08f1ad9d50a3 Mon Sep 17 00:00:00 2001
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Date: Sat, 23 Mar 2019 10:21:03 +0000
Subject: [PATCH] iptables: connmark - add set-dscpmark option for openwrt
Naive user space front end to xt_connmark 'setdscp' option.
iptables -A QOS_MARK_eth0 -t mangle -j CONNMARK --set-dscpmark 0xfc000000/0x01000000
This version has a hack to support a backport to 4.14
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---
extensions/libxt_CONNMARK.c | 315 +++++++++++++++++++++++++-
include/linux/netfilter/xt_connmark.h | 10 +
2 files changed, 324 insertions(+), 1 deletion(-)
--- a/extensions/libxt_CONNMARK.c
+++ b/extensions/libxt_CONNMARK.c
@@ -22,6 +22,7 @@
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
+#include <strings.h>
#include <xtables.h>
#include <linux/netfilter/xt_CONNMARK.h>
@@ -49,6 +50,7 @@ enum {
O_CTMASK,
O_NFMASK,
O_MASK,
+ O_DSCP_MARK,
F_SET_MARK = 1 << O_SET_MARK,
F_SAVE_MARK = 1 << O_SAVE_MARK,
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
@@ -61,8 +63,10 @@ enum {
F_CTMASK = 1 << O_CTMASK,
F_NFMASK = 1 << O_NFMASK,
F_MASK = 1 << O_MASK,
+ F_DSCP_MARK = 1 << O_DSCP_MARK,
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
- F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
+ F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK |
+ F_DSCP_MARK,
};
static const char *const xt_connmark_shift_ops[] = {
@@ -114,6 +118,8 @@ static const struct xt_option_entry conn
.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
{.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
.excl = F_CTMASK | F_NFMASK},
+ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
XTOPT_TABLEEND,
};
#undef s
@@ -148,6 +154,38 @@ static const struct xt_option_entry conn
};
#undef s
+#define s struct xt_connmark_tginfo3
+static const struct xt_option_entry connmark_tg_opts_v3[] = {
+ {.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
+ {.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
+ {.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
+ .excl = F_OP_ANY},
+ {.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
+ .excl = F_OP_ANY},
+ {.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
+ .excl = F_OP_ANY},
+ {.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
+ .excl = F_OP_ANY},
+ {.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
+ .excl = F_OP_ANY},
+ {.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8,
+ .min = 0, .max = 32},
+ {.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8,
+ .min = 0, .max = 32},
+ {.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
+ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
+ {.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
+ .excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
+ {.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
+ .excl = F_CTMASK | F_NFMASK},
+ {.name = "set-dscpmark", .id = O_DSCP_MARK, .type = XTTYPE_MARKMASK32,
+ .excl = F_OP_ANY},
+ XTOPT_TABLEEND,
+};
+#undef s
+
static void connmark_tg_help(void)
{
printf(
@@ -175,6 +213,15 @@ static void connmark_tg_help_v2(void)
);
}
+static void connmark_tg_help_v3(void)
+{
+ connmark_tg_help_v2();
+ printf(
+" --set-dscpmark value/mask Save DSCP to conntrack mark value\n"
+);
+}
+
+
static void connmark_tg_init(struct xt_entry_target *target)
{
struct xt_connmark_tginfo1 *info = (void *)target->data;
@@ -199,6 +246,16 @@ static void connmark_tg_init_v2(struct x
info->shift_bits = 0;
}
+static void connmark_tg_init_v3(struct xt_entry_target *target)
+{
+ struct xt_connmark_tginfo3 *info;
+
+ connmark_tg_init_v2(target);
+ info = (void *)target->data;
+
+ info->func = 0;
+}
+
static void CONNMARK_parse(struct xt_option_call *cb)
{
struct xt_connmark_target_info *markinfo = cb->data;
@@ -253,6 +310,23 @@ static void connmark_tg_parse(struct xt_
info->ctmark = cb->val.u32;
info->ctmask = 0;
break;
+ case O_DSCP_MARK:
+/* we sneaky sneaky this. nfmask isn't used by the set mark functionality
+ * and by default is set to uint32max. We can use the top bit as a flag
+ * that we're in DSCP_MARK submode of SET_MARK, if set then it's normal
+ * if unset then we're in DSCP_MARK
+ */
+ info->mode = XT_CONNMARK_SET;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->nfmask = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((~0 & (info->ctmark >> info->nfmask)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
case O_SAVE_MARK:
info->mode = XT_CONNMARK_SAVE;
break;
@@ -320,6 +394,78 @@ static void connmark_tg_parse_v2(struct
}
}
+static void connmark_tg_parse_v3(struct xt_option_call *cb)
+{
+ struct xt_connmark_tginfo3 *info = cb->data;
+
+ xtables_option_parse(cb);
+ switch (cb->entry->id) {
+ case O_SET_XMARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_VALUE;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ break;
+ case O_SET_MARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_VALUE;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mark | cb->val.mask;
+ break;
+ case O_AND_MARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_VALUE;
+ info->ctmark = 0;
+ info->ctmask = ~cb->val.u32;
+ break;
+ case O_OR_MARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_VALUE;
+ info->ctmark = cb->val.u32;
+ info->ctmask = cb->val.u32;
+ break;
+ case O_XOR_MARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_VALUE;
+ info->ctmark = cb->val.u32;
+ info->ctmask = 0;
+ break;
+ case O_DSCP_MARK:
+ info->mode = XT_CONNMARK_SET;
+ info->func = XT_CONNMARK_DSCP;
+ info->ctmark = cb->val.mark;
+ info->ctmask = cb->val.mask;
+ info->shift_bits = info->ctmark ? ffs(info->ctmark) - 1 : 0;
+ /* need 6 contiguous bits */
+ if ((~0 & (info->ctmark >> info->shift_bits)) != 0x3f)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK set-dscpmark: need 6 contiguous dscpmask bits");
+ if (info->ctmark & info->ctmask)
+ xtables_error(PARAMETER_PROBLEM,
+ "CONNMARK set-dscpmark: dscpmask/statemask bits overlap");
+ break;
+ case O_SAVE_MARK:
+ info->mode = XT_CONNMARK_SAVE;
+ break;
+ case O_RESTORE_MARK:
+ info->mode = XT_CONNMARK_RESTORE;
+ break;
+ case O_MASK:
+ info->nfmask = info->ctmask = cb->val.u32;
+ break;
+ case O_LEFT_SHIFT_MARK:
+ info->shift_dir = D_SHIFT_LEFT;
+ info->shift_bits = cb->val.u8;
+ break;
+ case O_RIGHT_SHIFT_MARK:
+ info->shift_dir = D_SHIFT_RIGHT;
+ info->shift_bits = cb->val.u8;
+ break;
+ default:
+ break;
+ }
+}
+
static void connmark_tg_check(struct xt_fcheck_call *cb)
{
if (!(cb->xflags & F_OP_ANY))
@@ -463,6 +609,65 @@ connmark_tg_print_v2(const void *ip, con
}
}
+static void
+connmark_tg_print_v3(const void *ip, const struct xt_entry_target *target,
+ int numeric)
+{
+ const struct xt_connmark_tginfo3 *info = (const void *)target->data;
+ const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+ switch (info->mode) {
+ case XT_CONNMARK_SET:
+ if (info->func & XT_CONNMARK_DSCP) {
+ printf(" CONNMARK DSCP 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ }
+ if (info->func & XT_CONNMARK_VALUE) {
+ if (info->ctmark == 0)
+ printf(" CONNMARK and 0x%x",
+ (unsigned int)(uint32_t)~info->ctmask);
+ else if (info->ctmark == info->ctmask)
+ printf(" CONNMARK or 0x%x", info->ctmark);
+ else if (info->ctmask == 0)
+ printf(" CONNMARK xor 0x%x", info->ctmark);
+ else if (info->ctmask == 0xFFFFFFFFU)
+ printf(" CONNMARK set 0x%x", info->ctmark);
+ else
+ printf(" CONNMARK xset 0x%x/0x%x",
+ info->ctmark, info->ctmask);
+ }
+ break;
+ case XT_CONNMARK_SAVE:
+ if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
+ printf(" CONNMARK save");
+ else if (info->nfmask == info->ctmask)
+ printf(" CONNMARK save mask 0x%x", info->nfmask);
+ else
+ printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x",
+ info->nfmask, info->ctmask);
+ break;
+ case XT_CONNMARK_RESTORE:
+ if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX)
+ printf(" CONNMARK restore");
+ else if (info->ctmask == info->nfmask)
+ printf(" CONNMARK restore mask 0x%x", info->ctmask);
+ else
+ printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x",
+ info->ctmask, info->nfmask);
+ break;
+
+ default:
+ printf(" ERROR: UNKNOWN CONNMARK MODE");
+ break;
+ }
+
+ if (info->mode <= XT_CONNMARK_RESTORE &&
+ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+ info->shift_bits != 0) {
+ printf(" %s %u", shift_op, info->shift_bits);
+ }
+}
+
static void CONNMARK_save(const void *ip, const struct xt_entry_target *target)
{
const struct xt_connmark_target_info *markinfo =
@@ -548,6 +753,38 @@ connmark_tg_save_v2(const void *ip, cons
}
}
+static void
+connmark_tg_save_v3(const void *ip, const struct xt_entry_target *target)
+{
+ const struct xt_connmark_tginfo3 *info = (const void *)target->data;
+ const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+ switch (info->mode) {
+ case XT_CONNMARK_SET:
+ if (info->func & XT_CONNMARK_VALUE)
+ printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
+ if (info->func & XT_CONNMARK_DSCP)
+ printf(" --set-dscpmark 0x%x/0x%x", info->ctmark, info->ctmask);
+ break;
+ case XT_CONNMARK_SAVE:
+ printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
+ info->nfmask, info->ctmask);
+ break;
+ case XT_CONNMARK_RESTORE:
+ printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x",
+ info->nfmask, info->ctmask);
+ break;
+ default:
+ printf(" ERROR: UNKNOWN CONNMARK MODE");
+ break;
+ }
+ if (info->mode <= XT_CONNMARK_RESTORE &&
+ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+ info->shift_bits != 0) {
+ printf(" --%s %u", shift_op, info->shift_bits);
+ }
+}
+
static int connmark_tg_xlate(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params)
{
@@ -639,6 +876,66 @@ static int connmark_tg_xlate_v2(struct x
return 1;
}
+
+static int connmark_tg_xlate_v3(struct xt_xlate *xl,
+ const struct xt_xlate_tg_params *params)
+{
+ const struct xt_connmark_tginfo3 *info =
+ (const void *)params->target->data;
+ const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
+
+ switch (info->mode) {
+ case XT_CONNMARK_SET:
+ xt_xlate_add(xl, "ct mark set ");
+ if (info->func & XT_CONNMARK_VALUE) {
+ if (info->ctmask == 0xFFFFFFFFU)
+ xt_xlate_add(xl, "0x%x ", info->ctmark);
+ else if (info->ctmark == 0)
+ xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
+ else if (info->ctmark == info->ctmask)
+ xt_xlate_add(xl, "ct mark or 0x%x",
+ info->ctmark);
+ else if (info->ctmask == 0)
+ xt_xlate_add(xl, "ct mark xor 0x%x",
+ info->ctmark);
+ else
+ xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
+ info->ctmark, ~info->ctmask);
+ }
+ if (info->func & XT_CONNMARK_DSCP) {
+/* FIXME the nftables syntax would go here if only we knew what it was */
+ xt_xlate_add(xl, "ct mark set typeof(ct mark) ip dscp "
+ "<< %u or 0x%x", info->shift_bits,
+ info->ctmask);
+ }
+ break;
+ case XT_CONNMARK_SAVE:
+ xt_xlate_add(xl, "ct mark set mark");
+ if (!(info->nfmask == UINT32_MAX &&
+ info->ctmask == UINT32_MAX)) {
+ if (info->nfmask == info->ctmask)
+ xt_xlate_add(xl, " and 0x%x", info->nfmask);
+ }
+ break;
+ case XT_CONNMARK_RESTORE:
+ xt_xlate_add(xl, "meta mark set ct mark");
+ if (!(info->nfmask == UINT32_MAX &&
+ info->ctmask == UINT32_MAX)) {
+ if (info->nfmask == info->ctmask)
+ xt_xlate_add(xl, " and 0x%x", info->nfmask);
+ }
+ break;
+ }
+
+ if (info->mode <= XT_CONNMARK_RESTORE &&
+ !(info->mode == XT_CONNMARK_SET && info->func == XT_CONNMARK_DSCP) &&
+ info->shift_bits != 0) {
+ xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits);
+ }
+
+ return 1;
+}
+
static struct xtables_target connmark_tg_reg[] = {
{
.family = NFPROTO_UNSPEC,
@@ -687,6 +984,22 @@ static struct xtables_target connmark_tg
.x6_options = connmark_tg_opts_v2,
.xlate = connmark_tg_xlate_v2,
},
+ {
+ .version = XTABLES_VERSION,
+ .name = "CONNMARK",
+ .revision = 3,
+ .family = NFPROTO_UNSPEC,
+ .size = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo3)),
+ .help = connmark_tg_help_v3,
+ .init = connmark_tg_init_v3,
+ .print = connmark_tg_print_v3,
+ .save = connmark_tg_save_v3,
+ .x6_parse = connmark_tg_parse_v3,
+ .x6_fcheck = connmark_tg_check,
+ .x6_options = connmark_tg_opts_v3,
+ .xlate = connmark_tg_xlate_v3,
+ },
};
void _init(void)
--- a/include/linux/netfilter/xt_connmark.h
+++ b/include/linux/netfilter/xt_connmark.h
@@ -18,6 +18,11 @@ enum {
XT_CONNMARK_RESTORE
};
+enum {
+ XT_CONNMARK_VALUE = (1 << 0),
+ XT_CONNMARK_DSCP = (1 << 1)
+};
+
struct xt_connmark_tginfo1 {
__u32 ctmark, ctmask, nfmask;
__u8 mode;
@@ -28,6 +33,11 @@ struct xt_connmark_tginfo2 {
__u8 shift_dir, shift_bits, mode;
};
+struct xt_connmark_tginfo3 {
+ __u32 ctmark, ctmask, nfmask;
+ __u8 shift_dir, shift_bits, mode, func;
+};
+
struct xt_connmark_mtinfo1 {
__u32 mark, mask;
__u8 invert;

28
package/network/utils/iptables/patches/101-remove-check-already.patch Normal file
View File

@@ -0,0 +1,28 @@
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -968,12 +968,6 @@ void xtables_register_match(struct xtabl
struct xtables_match **pos;
bool seen_myself = false;
- if (me->next) {
- fprintf(stderr, "%s: match \"%s\" already registered\n",
- xt_params->program_name, me->name);
- exit(1);
- }
-
if (me->version == NULL) {
fprintf(stderr, "%s: match %s<%u> is missing a version\n",
xt_params->program_name, me->name, me->revision);
@@ -1152,12 +1146,6 @@ void xtables_register_target(struct xtab
struct xtables_target **pos;
bool seen_myself = false;
- if (me->next) {
- fprintf(stderr, "%s: target \"%s\" already registered\n",
- xt_params->program_name, me->name);
- exit(1);
- }
-
if (me->version == NULL) {
fprintf(stderr, "%s: target %s<%u> is missing a version\n",
xt_params->program_name, me->name, me->revision);

18
package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch Normal file
View File

@@ -0,0 +1,18 @@
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -403,6 +403,7 @@ static char *get_modprobe(void)
int xtables_insmod(const char *modname, const char *modprobe, bool quiet)
{
+#if 0
char *buf = NULL;
char *argv[4];
int status;
@@ -437,6 +438,7 @@ int xtables_insmod(const char *modname,
free(buf);
if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
return 0;
+#endif
return -1;
}

13
package/network/utils/iptables/patches/103-optional-xml.patch Normal file
View File

@@ -0,0 +1,13 @@
--- a/iptables/xtables-legacy-multi.c
+++ b/iptables/xtables-legacy-multi.c
@@ -32,8 +32,10 @@ static const struct subcommand multi_sub
#endif
+#ifdef ENABLE_XML
{"iptables-xml", iptables_xml_main},
{"xml", iptables_xml_main},
+#endif
#ifdef ENABLE_IPV6
{"ip6tables", ip6tables_main},
{"main6", ip6tables_main},

79
package/network/utils/iptables/patches/200-configurable_builtin.patch Normal file
View File

@@ -0,0 +1,79 @@
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
@@ -50,11 +50,31 @@ pfb_build_mod := $(filter-out @blacklist
pfa_build_mod := $(filter-out @blacklist_modules@ @blacklist_a_modules@,${pfa_build_mod})
pf4_build_mod := $(filter-out @blacklist_modules@ @blacklist_4_modules@,${pf4_build_mod})
pf6_build_mod := $(filter-out @blacklist_modules@ @blacklist_6_modules@,${pf6_build_mod})
-pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod})
-pfb_objs := $(patsubst %,libebt_%.o,${pfb_build_mod})
-pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_mod})
-pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod})
-pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod})
+ifdef BUILTIN_MODULES
+pfx_build_static := $(filter $(BUILTIN_MODULES),${pfx_build_mod})
+pfb_build_static := $(filter $(BUILTIN_MODULES),${pfb_build_mod})
+pfa_build_static := $(filter $(BUILTIN_MODULES),${pfa_build_mod})
+pf4_build_static := $(filter $(BUILTIN_MODULES),${pf4_build_mod})
+pf6_build_static := $(filter $(BUILTIN_MODULES),${pf6_build_mod})
+else
+@ENABLE_STATIC_TRUE@ pfx_build_static := $(pfx_build_mod)
+@ENABLE_STATIC_TRUE@ pfb_build_static := $(pfb_build_mod)
+@ENABLE_STATIC_TRUE@ pfa_build_static := $(pfa_build_mod)
+@ENABLE_STATIC_TRUE@ pf4_build_static := $(pf4_build_mod)
+@ENABLE_STATIC_TRUE@ pf6_build_static := $(pf6_build_mod)
+endif
+
+pfx_build_mod := $(filter-out $(pfx_build_static),$(pfx_build_mod))
+pfb_build_mod := $(filter-out $(pfb_build_static),$(pfb_build_mod))
+pfa_build_mod := $(filter-out $(pfa_build_static),$(pfa_build_mod))
+pf4_build_mod := $(filter-out $(pf4_build_static),$(pf4_build_mod))
+pf6_build_mod := $(filter-out $(pf6_build_static),$(pf6_build_mod))
+
+pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_static})
+pfb_objs := $(patsubst %,libebt_%.o,${pfb_build_static})
+pfa_objs := $(patsubst %,libarpt_%.o,${pfa_build_static})
+pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static})
+pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static})
pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod})
pfb_solibs := $(patsubst %,libebt_%.so,${pfb_build_mod})
pfa_solibs := $(patsubst %,libarpt_%.so,${pfa_build_mod})
@@ -68,14 +88,14 @@ pfx_symlink_files := $(patsubst %,libxt_
#
targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man
targets_install :=
-@ENABLE_STATIC_TRUE@ libext_objs := ${pfx_objs}
-@ENABLE_STATIC_TRUE@ libext_ebt_objs := ${pfb_objs}
-@ENABLE_STATIC_TRUE@ libext_arpt_objs := ${pfa_objs}
-@ENABLE_STATIC_TRUE@ libext4_objs := ${pf4_objs}
-@ENABLE_STATIC_TRUE@ libext6_objs := ${pf6_objs}
-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs}
-@ENABLE_STATIC_FALSE@ symlinks_install := ${pfx_symlink_files}
+libext_objs := ${pfx_objs}
+libext_ebt_objs := ${pfb_objs}
+libext_arpt_objs := ${pfa_objs}
+libext4_objs := ${pf4_objs}
+libext6_objs := ${pf6_objs}
+targets += ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs} ${pfx_symlink_files}
+targets_install := $(strip ${pfx_solibs} ${pfb_solibs} ${pf4_solibs} ${pf6_solibs} ${pfa_solibs})
+symlinks_install := ${pfx_symlink_files}
.SECONDARY:
@@ -161,11 +181,11 @@ libext4.a: initext4.o ${libext4_objs}
libext6.a: initext6.o ${libext6_objs}
${AM_VERBOSE_AR} ${AR} crs $@ $^;
-initext_func := $(addprefix xt_,${pfx_build_mod})
-initextb_func := $(addprefix ebt_,${pfb_build_mod})
-initexta_func := $(addprefix arpt_,${pfa_build_mod})
-initext4_func := $(addprefix ipt_,${pf4_build_mod})
-initext6_func := $(addprefix ip6t_,${pf6_build_mod})
+initext_func := $(addprefix xt_,${pfx_build_static})
+initextb_func := $(addprefix ebt_,${pfb_build_static})
+initexta_func := $(addprefix arpt_,${pfa_build_static})
+initext4_func := $(addprefix ipt_,${pf4_build_static})
+initext6_func := $(addprefix ip6t_,${pf6_build_static})
.initext.dd: FORCE
@echo "${initext_func}" >$@.tmp; \

102
package/network/utils/iptables/patches/600-shared-libext.patch Normal file
View File

@@ -0,0 +1,102 @@
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
@@ -86,7 +86,7 @@ pfx_symlink_files := $(patsubst %,libxt_
#
# Building blocks
#
-targets := libext.a libext4.a libext6.a libext_ebt.a libext_arpt.a matches.man targets.man
+targets := libiptext.so libiptext4.so libiptext6.so libiptext_ebt.so libiptext_arpt.so matches.man targets.man
targets_install :=
libext_objs := ${pfx_objs}
libext_ebt_objs := ${pfb_objs}
@@ -132,7 +132,7 @@ clean:
distclean: clean
init%.o: init%.c
- ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=$*_init ${CFLAGS} -o $@ -c $<;
+ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -D_INIT=$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
-include .*.d
@@ -164,22 +164,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
# handling code in the Makefiles.
#
lib%.o: ${srcdir}/lib%.c
- ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -D_INIT=lib$*_init ${CFLAGS} -o $@ -c $<;
+ ${AM_VERBOSE_CC} ${CC} ${AM_CPPFLAGS} ${AM_DEPFLAGS} ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -D_INIT=lib$*_init -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
-libext.a: initext.o ${libext_objs}
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
+libiptext.so: initext.o ${libext_objs}
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
-libext_ebt.a: initextb.o ${libext_ebt_objs}
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
+libiptext_ebt.so: initextb.o ${libext_ebt_objs}
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
-libext_arpt.a: initexta.o ${libext_arpt_objs}
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
+libiptext_arpt.so: initexta.o ${libext_arpt_objs}
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
-libext4.a: initext4.o ${libext4_objs}
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
+libiptext4.so: initext4.o ${libext4_objs}
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
-libext6.a: initext6.o ${libext6_objs}
- ${AM_VERBOSE_AR} ${AR} crs $@ $^;
+libiptext6.so: initext6.o ${libext6_objs}
+ ${AM_VERBOSE_CCLD} ${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $^ -L../libxtables/.libs -lxtables $(foreach obj,$^,${$(patsubst lib%.o,%,$(obj))_LIBADD});
initext_func := $(addprefix xt_,${pfx_build_static})
initextb_func := $(addprefix ebt_,${pfb_build_static})
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -7,19 +7,22 @@ BUILT_SOURCES =
xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c
xtables_legacy_multi_CFLAGS = ${AM_CFLAGS}
-xtables_legacy_multi_LDADD = ../extensions/libext.a
+xtables_legacy_multi_LDADD =
+xtables_legacy_multi_LDFLAGS = -L../extensions/ -liptext
if ENABLE_STATIC
xtables_legacy_multi_CFLAGS += -DALL_INCLUSIVE
endif
if ENABLE_IPV4
xtables_legacy_multi_SOURCES += iptables-standalone.c iptables.c
xtables_legacy_multi_CFLAGS += -DENABLE_IPV4
-xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a
+xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la
+xtables_legacy_multi_LDFLAGS += -liptext4
endif
if ENABLE_IPV6
xtables_legacy_multi_SOURCES += ip6tables-standalone.c ip6tables.c
xtables_legacy_multi_CFLAGS += -DENABLE_IPV6
-xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
+xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la
+xtables_legacy_multi_LDFLAGS += -liptext6
endif
xtables_legacy_multi_SOURCES += xshared.c iptables-restore.c iptables-save.c
xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
@@ -28,7 +31,8 @@ xtables_legacy_multi_LDADD += ../libxt
if ENABLE_NFTABLES
xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c
xtables_nft_multi_CFLAGS = ${AM_CFLAGS}
-xtables_nft_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a
+xtables_nft_multi_LDADD =
+xtables_nft_multi_LDFLAGS = -L../extensions/ -liptext -liptext_ebt
if ENABLE_STATIC
xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE
endif
@@ -42,7 +46,8 @@ xtables_nft_multi_SOURCES += xtables-sav
xtables-eb-standalone.c xtables-eb.c \
xtables-eb-translate.c \
xtables-translate.c
-xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a
+xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS}
+xtables_nft_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt
xtables_nft_multi_SOURCES += xshared.c
xtables_nft_multi_LDADD += ../libxtables/libxtables.la -lm
endif

95
package/network/utils/iptables/patches/700-disable-legacy-revisions.patch Normal file
View File

@@ -0,0 +1,95 @@
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1395,6 +1395,7 @@ static int conntrack3_mt6_xlate(struct x
}
static struct xtables_match conntrack_mt_reg[] = {
+#ifndef NO_LEGACY
{
.version = XTABLES_VERSION,
.name = "conntrack",
@@ -1470,6 +1471,7 @@ static struct xtables_match conntrack_mt
.alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
+#endif
{
.version = XTABLES_VERSION,
.name = "conntrack",
@@ -1502,6 +1504,7 @@ static struct xtables_match conntrack_mt
.x6_options = conntrack3_mt_opts,
.xlate = conntrack3_mt6_xlate,
},
+#ifndef NO_LEGACY
{
.family = NFPROTO_UNSPEC,
.name = "state",
@@ -1532,6 +1535,8 @@ static struct xtables_match conntrack_mt
.x6_parse = state_ct23_parse,
.x6_options = state_opts,
},
+#endif
+#ifndef NO_LEGACY
{
.family = NFPROTO_UNSPEC,
.name = "state",
@@ -1561,6 +1566,7 @@ static struct xtables_match conntrack_mt
.x6_parse = state_parse,
.x6_options = state_opts,
},
+#endif
};
void _init(void)
--- a/extensions/libxt_CT.c
+++ b/extensions/libxt_CT.c
@@ -363,6 +363,7 @@ static int xlate_ct1_tg(struct xt_xlate
}
static struct xtables_target ct_target_reg[] = {
+#ifndef NO_LEGACY
{
.family = NFPROTO_UNSPEC,
.name = "CT",
@@ -388,6 +389,7 @@ static struct xtables_target ct_target_r
.x6_parse = ct_parse_v1,
.x6_options = ct_opts_v1,
},
+#endif
{
.family = NFPROTO_UNSPEC,
.name = "CT",
@@ -403,6 +405,7 @@ static struct xtables_target ct_target_r
.x6_options = ct_opts_v1,
.xlate = xlate_ct1_tg,
},
+#ifndef NO_LEGACY
{
.family = NFPROTO_UNSPEC,
.name = "NOTRACK",
@@ -441,6 +444,7 @@ static struct xtables_target ct_target_r
.revision = 0,
.version = XTABLES_VERSION,
},
+#endif
};
void _init(void)
--- a/extensions/libxt_multiport.c
+++ b/extensions/libxt_multiport.c
@@ -571,6 +571,7 @@ static int multiport_xlate6_v1(struct xt
}
static struct xtables_match multiport_mt_reg[] = {
+#ifndef NO_LEGACY
{
.family = NFPROTO_IPV4,
.name = "multiport",
@@ -601,6 +602,7 @@ static struct xtables_match multiport_mt
.x6_options = multiport_opts,
.xlate = multiport_xlate6,
},
+#endif
{
.family = NFPROTO_IPV4,
.name = "multiport",

95
package/network/utils/iptables/patches/800-flowoffload_target.patch Normal file
View File

@@ -0,0 +1,95 @@
--- /dev/null
+++ b/extensions/libxt_FLOWOFFLOAD.c
@@ -0,0 +1,72 @@
+#include <stdio.h>
+#include <xtables.h>
+#include <linux/netfilter/xt_FLOWOFFLOAD.h>
+
+enum {
+ O_HW,
+};
+
+static void offload_help(void)
+{
+ printf(
+"FLOWOFFLOAD target options:\n"
+" --hw Enable hardware offload\n"
+ );
+}
+
+static const struct xt_option_entry offload_opts[] = {
+ {.name = "hw", .id = O_HW, .type = XTTYPE_NONE},
+ XTOPT_TABLEEND,
+};
+
+static void offload_parse(struct xt_option_call *cb)
+{
+ struct xt_flowoffload_target_info *info = cb->data;
+
+ xtables_option_parse(cb);
+ switch (cb->entry->id) {
+ case O_HW:
+ info->flags |= XT_FLOWOFFLOAD_HW;
+ break;
+ }
+}
+
+static void offload_print(const void *ip, const struct xt_entry_target *target, int numeric)
+{
+ const struct xt_flowoffload_target_info *info =
+ (const struct xt_flowoffload_target_info *)target->data;
+
+ printf(" FLOWOFFLOAD");
+ if (info->flags & XT_FLOWOFFLOAD_HW)
+ printf(" hw");
+}
+
+static void offload_save(const void *ip, const struct xt_entry_target *target)
+{
+ const struct xt_flowoffload_target_info *info =
+ (const struct xt_flowoffload_target_info *)target->data;
+
+ if (info->flags & XT_FLOWOFFLOAD_HW)
+ printf(" --hw");
+}
+
+static struct xtables_target offload_tg_reg[] = {
+ {
+ .family = NFPROTO_UNSPEC,
+ .name = "FLOWOFFLOAD",
+ .revision = 0,
+ .version = XTABLES_VERSION,
+ .size = XT_ALIGN(sizeof(struct xt_flowoffload_target_info)),
+ .userspacesize = sizeof(struct xt_flowoffload_target_info),
+ .help = offload_help,
+ .print = offload_print,
+ .save = offload_save,
+ .x6_parse = offload_parse,
+ .x6_options = offload_opts,
+ },
+};
+
+void _init(void)
+{
+ xtables_register_targets(offload_tg_reg, ARRAY_SIZE(offload_tg_reg));
+}
--- /dev/null
+++ b/include/linux/netfilter/xt_FLOWOFFLOAD.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _XT_FLOWOFFLOAD_H
+#define _XT_FLOWOFFLOAD_H
+
+#include <linux/types.h>
+
+enum {
+ XT_FLOWOFFLOAD_HW = 1 << 0,
+
+ XT_FLOWOFFLOAD_MASK = XT_FLOWOFFLOAD_HW
+};
+
+struct xt_flowoffload_target_info {
+ __u32 flags;
+};
+
+#endif /* _XT_FLOWOFFLOAD_H */