From fc04815ddc385551d05c5f4317341de1a8873305 Mon Sep 17 00:00:00 2001 From: Ralph Sennhauser Date: Mon, 7 Nov 2016 14:08:28 +0100 Subject: firewall: bump to 2016-11-06 This version fixes loading of extensions for users of musl as it no longer relies on undefined behaviour wrt dlclose. There is also a fix which allows to build firewall without patched kernel headers when using musl. Another major feature is support for iptables-1.6.0 and vanilla iptables in general. Last but not least firewall no longer depends on the "in-house" iptables extension xt_id and uses xt_comment instead for tracking its own rules. For other changes consult the commit log. Signed-off-by: Ralph Sennhauser --- package/network/config/firewall/Makefile | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile index 73dae29468..f9fa9116b6 100644 --- a/package/network/config/firewall/Makefile +++ b/package/network/config/firewall/Makefile @@ -8,15 +8,14 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall -PKG_VERSION:=2016-01-29 -PKG_RELEASE:=$(PKG_SOURCE_VERSION) +PKG_VERSION:=2016-11-06 +PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(OPENWRT_GIT)/project/firewall3.git PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) -PKG_SOURCE_VERSION:=8957be6c026858fe414aef69281d8aa06f7ea122 +PKG_SOURCE_VERSION:=bd40ba4584141ce34f3d5c42841abafccad06bdd PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.gz -PKG_MAINTAINER:=Jo-Philipp Wich PKG_LICENSE:=ISC PKG_CONFIG_DEPENDS := CONFIG_IPV6 -- cgit v1.2.3 From dc5d9e714a15b8130f0d2a79f54d4f7132f39a28 Mon Sep 17 00:00:00 2001 From: Ralph Sennhauser Date: Mon, 7 Nov 2016 13:09:50 +0100 Subject: iptables: kernel: drop custom extension xt_id This extension was added specifically for use by firewall3. Since firewall-2016-11-06 no longer uses it remove it before it finds other creative uses. Should there already be such a use-case outside of OpenWrt I suggest to package this extension properly a la xtables-addons instead. Signed-off-by: Ralph Sennhauser --- include/netfilter.mk | 3 +- .../iptables/patches/500-add-xt_id-match.patch | 69 ---------------- .../615-netfilter_add_xt_id_match.patch | 95 ---------------------- .../615-netfilter_add_xt_id_match.patch | 95 ---------------------- .../615-netfilter_add_xt_id_match.patch | 95 ---------------------- 5 files changed, 1 insertion(+), 356 deletions(-) delete mode 100644 package/network/utils/iptables/patches/500-add-xt_id-match.patch delete mode 100644 target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch delete mode 100644 target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch delete mode 100644 target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch diff --git a/include/netfilter.mk b/include/netfilter.mk index 0a921f5d1c..2882d25fd7 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -38,13 +38,12 @@ $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_FILTER, $(P_V4)iptabl $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_MANGLE, $(P_V4)iptable_mangle),)) # userland only -$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_id xt_set xt_SET))) +$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_set xt_SET))) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_LIMIT, $(P_XT)xt_limit)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MAC, $(P_XT)xt_mac)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MULTIPORT, $(P_XT)xt_multiport)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_COMMENT, $(P_XT)xt_comment)) -$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_ID, $(P_XT)xt_id)) #cluster $(eval $(call nf_add,IPT_CLUSTER,CONFIG_NETFILTER_XT_MATCH_CLUSTER, $(P_XT)xt_cluster)) diff --git a/package/network/utils/iptables/patches/500-add-xt_id-match.patch b/package/network/utils/iptables/patches/500-add-xt_id-match.patch deleted file mode 100644 index 0964f0175f..0000000000 --- a/package/network/utils/iptables/patches/500-add-xt_id-match.patch +++ /dev/null @@ -1,69 +0,0 @@ ---- /dev/null -+++ b/extensions/libxt_id.c -@@ -0,0 +1,55 @@ -+/* Shared library add-on to iptables to add id match support. */ -+ -+#include -+#include -+#include -+ -+enum { -+ O_ID = 0, -+}; -+ -+static const struct xt_option_entry id_opts[] = { -+ { -+ .name = "id", -+ .id = O_ID, -+ .type = XTTYPE_UINT32, -+ .flags = XTOPT_MAND | XTOPT_PUT, -+ XTOPT_POINTER(struct xt_id_info, id) -+ }, -+ XTOPT_TABLEEND, -+}; -+ -+static void -+id_print(const void *ip, const struct xt_entry_match *match, int numeric) -+{ -+ struct xt_id_info *idinfo = (void *)match->data; -+ -+ printf(" ID:%08lx", idinfo->id); -+} -+ -+ -+/* Saves the union ipt_matchinfo in parsable form to stdout. */ -+static void -+id_save(const void *ip, const struct xt_entry_match *match) -+{ -+ struct xt_id_info *idinfo = (void *)match->data; -+ -+ printf(" --id 0x%lx", idinfo->id); -+} -+ -+static struct xtables_match id_match = { -+ .family = NFPROTO_UNSPEC, -+ .name = "id", -+ .version = XTABLES_VERSION, -+ .size = XT_ALIGN(sizeof(struct xt_id_info)), -+ .userspacesize = XT_ALIGN(sizeof(struct xt_id_info)), -+ .print = id_print, -+ .save = id_save, -+ .x6_parse = xtables_option_parse, -+ .x6_options = id_opts, -+}; -+ -+void _init(void) -+{ -+ xtables_register_match(&id_match); -+} ---- /dev/null -+++ b/include/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ __u32 id; -+}; -+ -+#endif /* XT_ID_H */ diff --git a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index 45f59a2a69..0000000000 --- a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1157,6 +1157,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -143,6 +143,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit); diff --git a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index ba21d78b40..0000000000 --- a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1164,6 +1164,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -145,6 +145,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit); diff --git a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index 8ee29a791b..0000000000 --- a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1180,6 +1180,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -144,6 +144,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit); -- cgit v1.2.3