Merge pull request #199 from seragh/owrt-firewall-2016-11-06

firewall version bump to 2016-11-06 and xt_id removal

6 files changed, 4 insertions, 360 deletions

diff --git a/include/netfilter.mk b/include/netfilter.mk
index 0a921f5d1c..2882d25fd7 100644
--- a/include/netfilter.mk
+++ b/include/netfilter.mk
@@ -38,13 +38,12 @@ $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_FILTER, $(P_V4)iptabl
 $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_MANGLE, $(P_V4)iptable_mangle),))
 
 # userland only
-$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_id xt_set xt_SET)))
+$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_set xt_SET)))
 
 $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_LIMIT, $(P_XT)xt_limit))
 $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MAC, $(P_XT)xt_mac))
 $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MULTIPORT, $(P_XT)xt_multiport))
 $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_COMMENT, $(P_XT)xt_comment))
-$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_ID, $(P_XT)xt_id))
 
 #cluster
 $(eval $(call nf_add,IPT_CLUSTER,CONFIG_NETFILTER_XT_MATCH_CLUSTER, $(P_XT)xt_cluster))
diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile
index 73dae29468..f9fa9116b6 100644
--- a/package/network/config/firewall/Makefile
+++ b/package/network/config/firewall/Makefile
@@ -8,15 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=firewall
-PKG_VERSION:=2016-01-29
-PKG_RELEASE:=$(PKG_SOURCE_VERSION)
+PKG_VERSION:=2016-11-06
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(OPENWRT_GIT)/project/firewall3.git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=8957be6c026858fe414aef69281d8aa06f7ea122
+PKG_SOURCE_VERSION:=bd40ba4584141ce34f3d5c42841abafccad06bdd
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz
-PKG_MAINTAINER:=Jo-Philipp Wich <jow@openwrt.org>
 PKG_LICENSE:=ISC
 
 PKG_CONFIG_DEPENDS := CONFIG_IPV6
diff --git a/package/network/utils/iptables/patches/500-add-xt_id-match.patch b/package/network/utils/iptables/patches/500-add-xt_id-match.patch
deleted file mode 100644
index 0964f0175f..0000000000
--- a/package/network/utils/iptables/patches/500-add-xt_id-match.patch
+++ /dev/null
@@ -1,69 +0,0 @@
---- /dev/null
-+++ b/extensions/libxt_id.c
-@@ -0,0 +1,55 @@
-+/* Shared library add-on to iptables to add id match support. */
-+
-+#include <stdio.h>
-+#include <xtables.h>
-+#include <linux/netfilter/xt_id.h>
-+
-+enum {
-+	O_ID = 0,
-+};
-+
-+static const struct xt_option_entry id_opts[] = {
-+	{
-+		.name  = "id",
-+		.id    = O_ID,
-+		.type  = XTTYPE_UINT32,
-+		.flags = XTOPT_MAND | XTOPT_PUT,
-+		XTOPT_POINTER(struct xt_id_info, id)
-+	},
-+	XTOPT_TABLEEND,
-+};
-+
-+static void
-+id_print(const void *ip, const struct xt_entry_match *match, int numeric)
-+{
-+	struct xt_id_info *idinfo = (void *)match->data;
-+
-+	printf(" ID:%08lx", idinfo->id);
-+}
-+
-+
-+/* Saves the union ipt_matchinfo in parsable form to stdout. */
-+static void
-+id_save(const void *ip, const struct xt_entry_match *match)
-+{
-+	struct xt_id_info *idinfo = (void *)match->data;
-+
-+	printf(" --id 0x%lx", idinfo->id);
-+}
-+
-+static struct xtables_match id_match = {
-+	.family		= NFPROTO_UNSPEC,
-+	.name		= "id",
-+	.version	= XTABLES_VERSION,
-+	.size		= XT_ALIGN(sizeof(struct xt_id_info)),
-+	.userspacesize	= XT_ALIGN(sizeof(struct xt_id_info)),
-+	.print		= id_print,
-+	.save 		= id_save,
-+	.x6_parse	= xtables_option_parse,
-+	.x6_options	= id_opts,
-+};
-+
-+void _init(void)
-+{
-+	xtables_register_match(&id_match);
-+}
---- /dev/null
-+++ b/include/linux/netfilter/xt_id.h
-@@ -0,0 +1,8 @@
-+#ifndef _XT_ID_H
-+#define _XT_ID_H
-+
-+struct xt_id_info {
-+	__u32 id;
-+};
-+
-+#endif /* XT_ID_H */
diff --git a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch
deleted file mode 100644
index 45f59a2a69..0000000000
--- a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch
+++ /dev/null
@@ -1,95 +0,0 @@
---- a/include/uapi/linux/netfilter/Kbuild
-+++ b/include/uapi/linux/netfilter/Kbuild
-@@ -55,6 +55,7 @@ header-y += xt_ecn.h
- header-y += xt_esp.h
- header-y += xt_hashlimit.h
- header-y += xt_helper.h
-+header-y += xt_id.h
- header-y += xt_ipcomp.h
- header-y += xt_iprange.h
- header-y += xt_ipvs.h
---- /dev/null
-+++ b/include/uapi/linux/netfilter/xt_id.h
-@@ -0,0 +1,8 @@
-+#ifndef _XT_ID_H
-+#define _XT_ID_H
-+
-+struct xt_id_info {
-+	u32 id;
-+};
-+
-+#endif /* XT_ID_H */
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -1157,6 +1157,13 @@ config NETFILTER_XT_MATCH_IPCOMP
- 
- 	  To compile it as a module, choose M here.  If unsure, say N.
- 
-+config NETFILTER_XT_MATCH_ID
-+	tristate '"id" match support'
-+	depends on NETFILTER_ADVANCED
-+	---help---
-+	This option adds a `id' dummy-match, which allows you to put
-+	numeric IDs into your iptables ruleset.
-+
- config NETFILTER_XT_MATCH_IPRANGE
- 	tristate '"iprange" address range match support'
- 	depends on NETFILTER_ADVANCED
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -143,6 +143,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
---- /dev/null
-+++ b/net/netfilter/xt_id.c
-@@ -0,0 +1,45 @@
-+/*
-+ * Implements a dummy match to allow attaching IDs to rules
-+ *
-+ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/netfilter/xt_id.h>
-+
-+MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
-+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_id");
-+MODULE_ALIAS("ip6t_id");
-+
-+static bool
-+id_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+{
-+	/* We always match */
-+	return true;
-+}
-+
-+static struct xt_match id_mt_reg __read_mostly = {
-+	.name      = "id",
-+	.revision  = 0,
-+	.family    = NFPROTO_UNSPEC,
-+	.match     = id_mt,
-+	.matchsize = sizeof(struct xt_id_info),
-+	.me        = THIS_MODULE,
-+};
-+
-+static int __init id_mt_init(void)
-+{
-+	return xt_register_match(&id_mt_reg);
-+}
-+
-+static void __exit id_mt_exit(void)
-+{
-+	xt_unregister_match(&id_mt_reg);
-+}
-+
-+module_init(id_mt_init);
-+module_exit(id_mt_exit);
diff --git a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch
deleted file mode 100644
index ba21d78b40..0000000000
--- a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch
+++ /dev/null
@@ -1,95 +0,0 @@
---- a/include/uapi/linux/netfilter/Kbuild
-+++ b/include/uapi/linux/netfilter/Kbuild
-@@ -55,6 +55,7 @@ header-y += xt_ecn.h
- header-y += xt_esp.h
- header-y += xt_hashlimit.h
- header-y += xt_helper.h
-+header-y += xt_id.h
- header-y += xt_ipcomp.h
- header-y += xt_iprange.h
- header-y += xt_ipvs.h
---- /dev/null
-+++ b/include/uapi/linux/netfilter/xt_id.h
-@@ -0,0 +1,8 @@
-+#ifndef _XT_ID_H
-+#define _XT_ID_H
-+
-+struct xt_id_info {
-+	u32 id;
-+};
-+
-+#endif /* XT_ID_H */
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -1164,6 +1164,13 @@ config NETFILTER_XT_MATCH_IPCOMP
- 
- 	  To compile it as a module, choose M here.  If unsure, say N.
- 
-+config NETFILTER_XT_MATCH_ID
-+	tristate '"id" match support'
-+	depends on NETFILTER_ADVANCED
-+	---help---
-+	This option adds a `id' dummy-match, which allows you to put
-+	numeric IDs into your iptables ruleset.
-+
- config NETFILTER_XT_MATCH_IPRANGE
- 	tristate '"iprange" address range match support'
- 	depends on NETFILTER_ADVANCED
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -145,6 +145,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
---- /dev/null
-+++ b/net/netfilter/xt_id.c
-@@ -0,0 +1,45 @@
-+/*
-+ * Implements a dummy match to allow attaching IDs to rules
-+ *
-+ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/netfilter/xt_id.h>
-+
-+MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
-+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_id");
-+MODULE_ALIAS("ip6t_id");
-+
-+static bool
-+id_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+{
-+	/* We always match */
-+	return true;
-+}
-+
-+static struct xt_match id_mt_reg __read_mostly = {
-+	.name      = "id",
-+	.revision  = 0,
-+	.family    = NFPROTO_UNSPEC,
-+	.match     = id_mt,
-+	.matchsize = sizeof(struct xt_id_info),
-+	.me        = THIS_MODULE,
-+};
-+
-+static int __init id_mt_init(void)
-+{
-+	return xt_register_match(&id_mt_reg);
-+}
-+
-+static void __exit id_mt_exit(void)
-+{
-+	xt_unregister_match(&id_mt_reg);
-+}
-+
-+module_init(id_mt_init);
-+module_exit(id_mt_exit);
diff --git a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch
deleted file mode 100644
index 8ee29a791b..0000000000
--- a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch
+++ /dev/null
@@ -1,95 +0,0 @@
---- a/include/uapi/linux/netfilter/Kbuild
-+++ b/include/uapi/linux/netfilter/Kbuild
-@@ -55,6 +55,7 @@ header-y += xt_ecn.h
- header-y += xt_esp.h
- header-y += xt_hashlimit.h
- header-y += xt_helper.h
-+header-y += xt_id.h
- header-y += xt_ipcomp.h
- header-y += xt_iprange.h
- header-y += xt_ipvs.h
---- /dev/null
-+++ b/include/uapi/linux/netfilter/xt_id.h
-@@ -0,0 +1,8 @@
-+#ifndef _XT_ID_H
-+#define _XT_ID_H
-+
-+struct xt_id_info {
-+	u32 id;
-+};
-+
-+#endif /* XT_ID_H */
---- a/net/netfilter/Kconfig
-+++ b/net/netfilter/Kconfig
-@@ -1180,6 +1180,13 @@ config NETFILTER_XT_MATCH_IPCOMP
- 
- 	  To compile it as a module, choose M here.  If unsure, say N.
- 
-+config NETFILTER_XT_MATCH_ID
-+	tristate '"id" match support'
-+	depends on NETFILTER_ADVANCED
-+	---help---
-+	This option adds a `id' dummy-match, which allows you to put
-+	numeric IDs into your iptables ruleset.
-+
- config NETFILTER_XT_MATCH_IPRANGE
- 	tristate '"iprange" address range match support'
- 	depends on NETFILTER_ADVANCED
---- a/net/netfilter/Makefile
-+++ b/net/netfilter/Makefile
-@@ -144,6 +144,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
- obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
---- /dev/null
-+++ b/net/netfilter/xt_id.c
-@@ -0,0 +1,45 @@
-+/*
-+ * Implements a dummy match to allow attaching IDs to rules
-+ *
-+ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/skbuff.h>
-+#include <linux/netfilter/x_tables.h>
-+#include <linux/netfilter/xt_id.h>
-+
-+MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
-+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("ipt_id");
-+MODULE_ALIAS("ip6t_id");
-+
-+static bool
-+id_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+{
-+	/* We always match */
-+	return true;
-+}
-+
-+static struct xt_match id_mt_reg __read_mostly = {
-+	.name      = "id",
-+	.revision  = 0,
-+	.family    = NFPROTO_UNSPEC,
-+	.match     = id_mt,
-+	.matchsize = sizeof(struct xt_id_info),
-+	.me        = THIS_MODULE,
-+};
-+
-+static int __init id_mt_init(void)
-+{
-+	return xt_register_match(&id_mt_reg);
-+}
-+
-+static void __exit id_mt_exit(void)
-+{
-+	xt_unregister_match(&id_mt_reg);
-+}
-+
-+module_init(id_mt_init);
-+module_exit(id_mt_exit);