aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
diff options
context:
space:
mode:
authorAnsuel Smith <ansuelsmth@gmail.com>2018-11-11 17:32:03 +0100
committerHans Dedecker <dedeckeh@gmail.com>2018-12-08 10:54:09 +0100
commit1286c55302696381e67cc25043710ced7e8682e2 (patch)
treedae8976d314a51223b010d0d901cf615da83476e /package/network
parent02494fa35ca07f01598e8bddb14303486ba69ba4 (diff)
downloadupstream-1286c55302696381e67cc25043710ced7e8682e2.tar.gz
upstream-1286c55302696381e67cc25043710ced7e8682e2.tar.bz2
upstream-1286c55302696381e67cc25043710ced7e8682e2.zip
iptables: bump to 1.8.2
Drop 030-extensions-libxt_bpf-Fix-build-with-old-kernel-versi.patch as pushed upstream Added patches : 001-extensions_format-security_fixes_in_libip.patch 002-include_fix_build_with_kernel_headers_before_4_2.patch 101-remove-register-check.patch The first and the second patch are upsteam fixes for compilation errors. The third patch remove check if one target lib is already registred; this is caused by shared libs that are loaded before the iptables execution. Iptables changelog: bba6bc6 (tag: v1.8.2) configure: bump versions for 1.8.2 release 61d6c38 xtables: add 'printf' attribute to xlate_add 5edb249 libxtables: xlate: init buffer to zero 9afd2a6 tests: shell: fix expected arptables-save output 6387941 arptables: fix --version info d703c1f arptables: ignore --table argument. d5754e3 arptables: make uni/multicast mac masks static 1b63e66 arptables: add test cases 5aecb2d arptables: pre-init hlen and ethertype 9677ed1 arptables: fix src/dst mac handling ab0b6d5 arptables: fix target ip offset c0c75ce arptables: fix -s/-d handling for negation and mask 3ac65af arptables: add basic test infra for arptables-nft e31564f arptables: fix rule deletion/compare 2345ff6 arptables: remove code that is also commented-out in original arptables 50c2397 arptables-save: add -c option, like xtables-save d9a518e arptables: use ->save for arptables-save, like xtables 5a52e6a extensions: test protocol and interface negation 85d7df9 xtables: Fix error return code in nft_chain_user_rename() 3ccb443 xtables: Clarify error message when deleting by index 95db364 xtables: Fix typo in do_command() error message 5f508b7 ebtables: use extrapositioned negation consistently 583b27e ebtables-save: add -c option, using xtables-style counters e6723ab nft: add NFT_TABLE_* enumeration 21ec111 nft: replace nft_chain_dump() by nft_chain_list_get() 05947c8 iptables-nft: fix -f fragment option 7bd9feb libxtables: add and use mac print helpers a10eb88 extensions: libebt_ip: fix tos negation 9b127b7 extensions: libebt_ip6: fix ip6-dport negation c59ba1b xtables-nft: make -Z option work 1bf4a13 nft: add missing error string a9f9377 iptables-tests: add % to run iptables commands b81c8da iptables-tests: do not append xtables-multi to external commands edf2b7c ebtables-nft: add arpreply target 2d1372e ebtables: add redirect test case c3e8dbd ebtables: add test cases cd90cef ebtables: relax -t table restriction, add snat/dnat test cases fd95f1f ebtables: fix -j CONTINUE handling for add/delete fb747f8 tests: add basic ebtables test support d4bc5a3 iptables-nft: fix bogus handling of zero saddr/daddr 9ff9915 iptables-test: fix netns test 8c918db xtables: Fix for matching rules with wildcard interfaces b2fc2a3 extensions: limit: unbreak build without libnftnl 682f39a xtables: Fix for spurious errors from iptables-translate 90f7dc3 (tag: v1.8.1) configure: bump versions for 1.8.1 release 0123183 iptables-test: add -N option to exercise netns removal path abae556 libxtables: expose new etherdb lookup function through libxtables API c2d9ed9 libxtables: prefix exported new functions for etherdb lookups 5a44360 Revert "extensions: libxt_quota: Allow setting the remaining quota" 2673faf xtables: Remove target_maxnamelen field 8ca3436 extensions: cgroup: fix option parsing for v2 0a8f2bc extensions: libxt_quota: Allow setting the remaining quota b373a91 nft-shared: Use xtables_calloc() 5a40961 arptables: Use the shared nft_ipv46_parse_target() 9f07503 Combine parse_target() and command_jump() implementations 7373297 Combine command_match() implementations a76ba54 libiptc: NULL-terminate errorname a3716cc libxtables: Check extension real_name length 0195b64 iptables: Gitignore xtables-{legacy, nft}-multi scripts 671e40a xtables: Drop pointless check 7c9a152 arptables: Fix incorrect strcmp() in nft_arp_rule_find() 11e91a4 xtables: Don't read garbage in nft_ipv4_parse_payload() d95c1e8 libxtables: Use posix_spawn() instead of vfork() 7e50eba Fix a few cases of pointless assignments f40ce2d extensions: libebt_ip{, 6}: Drop pointless error checking 47fb86c nft-arp: Drop ineffective conditional 80aae9b iptables: Use print_ifaces() from xtables 8da04ff Share print_ipv{4,6}_addr() from xtables b686594 iptables-apply: Replace signal numbers by names f175dee iptables-apply: Quote strings passed to echo 52aa150 nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query() 61ebf3f libxtables: Don't read garbage in xtables_strtoui() ab639f2 libxtables: Avoid calling memcpy() with NULL source 22ef371 libiptc: Simplify alloc_handle() function signature 6b7145f libxt_time: Drop initialization of variable 'year' 749d3c2 libxt_ipvs: Avoid potential buffer overrun 8e798e0 libxt_conntrack: Avoid potential buffer overrun 74eb239 libxt_conntrack: Version 0 does not support XT_CONNTRACK_DIRECTION d0c1f1b libxt_LED: Avoid string overrun while parsing led-trigger-id 23ef6f0 xtables: Remove unused variable in nft_is_table_compatible() 4e499d5 ip{, 6}tables-restore: Fix for uninitialized array 'curtable' 1788f54 Mark fall through cases in switch() statements 31f1434 libxtables: Integrate getethertype.c from xtables core 7ae4fb1 xtables: Fix for wrong assert() in __nft_table_flush() 8c786a3 nfnl_osf: Drop pointless check in xt_osf_strchr() 6fc7762 libxt_string: Fix array out of bounds check 2a68be1 xtables-save: Ignore uninteresting tables f9efc8c extensions: add cgroup revision 2 9b8cb16 extensions: REJECT: Merge reject tables 56d7ab4 libxt_string: Avoid potential array out of bounds access bfd41c8 ebtables: Fix for potential array boundary overstep e6f9867 libiptc: Avoid side-effect in memset() calls 4144571 libxtables: Fix potential array overrun in xtables_option_parse() 9242b5d xtables: Accept --wait in iptables-nft-restore c9f4f04 xtables: Don't check all rules for being compatible 15606f2 doc: Improve layout of u32 instructions 7345037 xtables-restore: Fix flushing referenced custom chains 7df11d1 xtables: Drop use of IP6T_F_PROTO b6a06c1 xtables: Align return codes with legacy iptables 3bb497c xtables: Fix for deleting rules with comment 0800d9b ip6tables-translate: Fix libip6t_mh.txlate test 4cf650c ebtables-translate: Fix for libebt_limit.txlate 783e9c2 xtables: Add missing deinitialization 9771d06 ebtables: Review match/target lookup once more 85ed1ab extensions: libebt_mark: Drop mark_supplied check 6a46ca0 xtables: Add a few missing exit calls acde6be ebtables-translate: Fix segfault while parsing extension options 2c4e4d2 ebtables: trivial: Leverage C99-style initializers a bit more 9f5b28a xlate-test: Fix for calling wrong command name 1a878a7 extensions: AUDIT: Provide translation 5ee03e6 xtables: Use meta l4proto for -p match 37b68b2 xtables: Fix for segfault when registering hashlimit extension 92f7b04 xtables: Fix for segfault in iptables-nft 294f9ef ebtables: Fix entries count in chain listing 6f29aa8 xtables: Make 'iptables -S nonexisting' return non-zero 7bccf30 ebtables: Fix for listing of non-existent chains 3d9a13d xtables: Fix for no output in iptables-nft -S a33c6fd arptables: Drop extensions/libxt_mangle.c 02b8097 ebtables: Merge libebt_limit.c into libxt_limit.c 5de8dcf xtables: Use native nftables limit expression 514de48 ebtables: Remove flags misinterpretations 528cbf9 xtables: Fix for wrong counter format in -S output 9ca32c4 xtables: Don't pass full invflags to add_compat() e055aeb xtables: Improve xtables-monitor first impression b925733 tests: Fix skipping for recent nft-only tests 277f374 xtables: Spelling fixes in xtables-monitor a9d9f64 xtables: Fix potential segfault in nft_rule_append() fbf0bf7 tests: Add ebtables-{save,restore} testcases f1d8508 tests: Add arptables-{save,restore} testcases 63c3dae xtables: Implement arptables-{save,restore} aa7fb04 ebtables: Review match/target lookup 3f123dc ebtables-restore: Use xtables_restore_parse() 295d5a8 xtables-restore: Make COMMIT support configurable 1679b2c xtables-restore: Improve user-defined chain detection 2ce9f65 xtables: Match verbose ip{,6}tables output with legacy cd79556 xtables: Reserve space for 'opt' column in ip6tables output 0357254 xtables: Print error when listing non-existent chains 206033e xtables: Fix for no output on first iptables-nft invocation a0698de xtables: Do not count rules as chain references d11b6b8 arptables: Fix jumps into user-defined chains 3f27955 arptables: Fix opcode printing in numeric output f988fe4 xtables: Fix symlinks/names for ebtables-{save, restore} 3319c61 ebtables: Support --init-table command 3ec8aac arptables: Print policy only for base chains 83bc189 arptables: Fix for trailing spaces in output aaed1b6 arptables: Fix memleaks in do_commandarp() d67d85d ebtables: Print non-standard target parameters 2e478e9 ebtables: Fix match_list insertion a192f03 ebtables: Fix for wrong program name in error messages a2ed880 xshared: Consolidate argv construction routines 1cc0918 xshared: Consolidate parse_counters() 78b9d43 Consolidate DEBUGP macros 14ad525 xtables: Fix program name in xtables_error() f7bbdb0 xtables: Use correct built-in chain count ae574b2 xtables: Fix compilation with NLDEBUG defined 82d278c xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobs c2895ea xtables: Free chains in NFT_COMPAT_CHAIN_USER_DEL jobs 89d3443 xtables: Fix for nft_rule_flush() returning garbage c259447 xtables: Allocate rule cache just once ed30b93 nft: don't print rule counters unless verbose 31e4b59 iptables-restore: free the table lock when skipping a table f8e29a1 xtables: avoid bogus 'is incompatible' warning 6ea7579 nft: decode meta l4proto 922508e xtables: implement ebtables-{save,restore} 25ef908 xtables: introduce nft_init_eb() de8574a xtables: parameter to add_argv() may be const 6f60f22 xtables: pass format to nft_rule_save() f3b772c xtables: introduce save_chain callback fa1681f xtables: rename {print,save}_rule functions 444d581 xtables: get rid of nft_ipv{4,6}_save_counters() 34e1e23 xtables: eliminate nft_ipv{4,6}_rule_find() de782e8 xtables: merge nft_ipv{4,6}_parse_target() ae8eece xtables: get rid of nft_ipv{4,6}_print_header() 2687794 xtables: arp: make rule_to_cs callback private 1bf73c4 xtables: Use new callbacks in nft_rule_print_save() 1866625 xtables: introduce rule_to_cs/clear_cs callbacks 0589457 xtables: simplify struct nft_xt_ctx d9c6a5d xtables: merge {ip,arp}tables_command_state structs 87b5b9e iptables: replace memset by c99-style initializers 907da5c xtables: fix crash if nft_rule_list_get() fails 565a223 xtables: Support nft suffix for arptables and ebtables c468f01 tests: check iptables retval, not echo 47d1484 iptables: tests: add test for iptables-save and iptables-restore e4e0704 extensions: don't bother to build libebt/libarp extensions if nft backend was disabled 17c66a5 iptables: tests: shell: Add README 6c2118c (tag: v1.8.0) configure: bump version and libnftnl dependency 7b66fc2 man: clarify translate tools do not modify any state f7fec51 xtables-monitor: add --version option b470b8e xtables-legacy: fix argv0 name for ip6tables-legacy 2028e54 xtables: display legacy/nf_tables flavor in error messages, too fd8d7d7 ebtables-nft: add stp match f15639b tests: add script that mimics firewalld startup 27f7db2 tests: fix variable name to multi-binary 2a89ec5 tests: add a few simple tests for list/new/delete 37d9d5b ebtables-nft: make -L, -X CHAINNAME work 816bd1f ebtables-nft: remove exec_style b81708f ebtables-nft: don't crash on ebtables -X de02a75 doc: fix some spellos and the dash escape dcf4529 tests: add firewalld default ruleset from fedora 27 f23abd5 tests: add another ipv4 only ruleset ed9cfe1 tests: add initial save/restore test cases 9933dc5 tests: adapt test suite to run with legacy+nftables based binaries be70918 xtables: rename xt-multi binaries to -nft, -legacy d49ba50 xtables-restore: init table before processing policies 344c6eb doc: Fix spelling error in hashlimit section e063873 tests: make duplicate test work d26c538 xtables: add xtables-monitor db84371 xtables: translate nft meta trace set 1 to -j TRACE 20eac2a xtables: warn in case old-style (set/getsockopt) tables exist c9f5e18 xtables: add nf_tables vs. legacy postfix to version strings e5fed16 iptables8.in: Update coreteam names 672accf include: update kernel netfilter header files 856a875 xtables: silence two compiler warnings ae6e159 xtables: remove dead code inherited from ebtables 107b7eb configure: add -Wlogical-op warning to cflags bc7f49d ebtables-translate: remove --change-counters code 38b4166 iptables: tests: shell: add shell test-suite 1e6427a xtables-compat: skip invalid tables cb368b6 xtables: more error printing fixes b1b828f xtables: homogenize error message 4caa559 xtables: initialize basechains for rule flush command too 9b89622 xtables: rework rule cache logic 01e25e2 xtables: add chain cache 8d190e9 xtables: initialize basechains only once on ruleset restore 0a86351 xtables-compat: ignore '+' interface name 125d1ce xtables-compat: append all errors into single line 437746c xtables: extended error reporting d1c79cd xtables: allocate struct xt_comment_info for comments 4e20209 xtables: use libnftnl batch API 49709e2 xtables-compat: remove nft_is_ruleset_compatible 03e1377 xtables: allow dumping of chains in specific table 94fd83d xtables: inconsistent error reporting for -X and no empty chain c4f1622 ebtables-compat: add arp match extension 24ce746 ebtables-compat: add redirect match extension 84c04e3 ebtables-compat: add nat match extensions 14ec998 xtables-compat: ebtables: prefer snprintf to strncpy 5e2b473 xtables-compat: extend generic tests for masks and wildcards 1a696c9 libxtables: store all requested match types bb436ce xtables-compat: ip6table-save: fix save of ip6 address masks 6454d7d ebtables-translate: suppress redundant protocols 07f4ca9 xtables-compat: ebtables: allow checking for zero-mac 0ca2d2a xtables-compat: ebtables: add helpers to print interface and mac addresses 3d9f300 xtables-compat: ebtables: remove interface masks from ebt_entry struct 20e2758 xtables-compat: ebtables: fix logical interface negation 2682bb0 xtables-compat: ebtables: add and use helper to parse all interface names 564862d xtables-compat: ebtables: split match/target print from nft_bridge_print_firewall 0ae81d0 xtables-compat: ebtables: kill ebtables_command_state 651cfee xtables-compat: pass correct table skeleton 652b98e xtables-compat: fix wildcard detection 49f4993 extensions: libip6t_srh.t: Add test cases for psid, nsid, and lsid 429143b extensions: libxt_CONNMARK: incorrect translation after v2 db7b4e0 extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark 155e1c0 extensions: libip6t_srh: support matching previous, next and last SID f4ffda1 extensions: libipt_DNAT: tests added for shifted portmap range 6a9ffb1 xtables-compat-restore: flush table and its content with no -n 07ae37c xtables-compat: fix bogus error with -X and no user-defined chains df3d92b xtables-compat-restore: flush user-defined chains with -n ca16584 xtables-compat-restore: flush rules and delete user-defined chains ac1e85a extensions: libipt_DNAT: use size of nf_nat_range2 for rev2 e25d99a xtables-compat: pass larger socket buffer 838746e xtables-compat: xtables-save: don't return 1 2211679 xtables-compat: ebtables: support concurrent option a77a7d8 iptables-test: fix bug with rateest de87405 xtables-compat: fix ipv4 frag (-f) c7b2fd6 xtables-compat: also check tg2->userspacesize 5685938 xtables-compat: avoid unneeded bitwise ops b9d7b49 xtables-compat: restore: sync options with iptables-restore c0ef861 extensions: add xlate test for ipables -f d79a7f1 xtables-compat: output -s,d first during save, just like iptables d1eb4d5 iptables-compat: chains are purge out already from table flush 09f0d47 iptables-compat: do not fail on restore if user chain exists 8798eb8 iptables-compat: remove non-batching routines b633ef9 xtables.conf: fix hook skeletons 7af2178 xtables-compat: fall back to comment match in case name is too long e9aeecf xlate-test: use locally installed xlate tools 0ab58e3 xtables-compat: ebtables: handle mac masks properly 734ad40 xtables-compat: nft-arp: fix warning wrt. sprintf-out-of-bounds fb7ae9f xtables-compat: truncate comments to 254 bytes 36976c4 extensions: libipt_DNAT: support shifted portmap ranges d7ac61b iptables-test: add nft switch and test binaries from git 992e17d xtables-compat: only fetch revisions for ip/ip6 12a52ff xtables: Fix rules print/save after iptables update 1197c5e xtables: Register all match/target revisions supported by us and kernel e3bb24c xtables: Check match/target size vs XT_ALIGN(size) at register time 3b2530c xtables: Do not register matches/targets with incompatible revision d3f1437 xtables: Introduce and use common function to print val[/mask] arguments 29b1d97 xtables: Introduce and use common function to parse val[/mask] arguments 56aadc0 extensions: Initialize linear mapping of symbols in _init() of extension 79c2da9 extensions: ULOG: remove test a0956ce ebtables-translate: turn off useless compat queries 9840869 nft: arptables: remove obsolete forward hook definition 7a37d14 iptables-compat: statify nft_restart() a3aac1d iptables-compat: handle netlink dump EINTR errors a567dc3 ebtables-compat: add 'vlan' match extension 7564bba ebtables-compat: add 'pkttype' match extension 4d40904 ebtables-translate: update table name on -t 5c8ce9c ebtables-compat: add 'ip6' match extension 8a85a14 libebt_ip: fix translations for tos and icmp b6f0bec libebt_ip: add icmp support f38ed1e xt-translate: quote interface names in translated output 71a6e37 icmp: split icmp type printing to header file e67c088 ebtables-translate: add initial test cases 207dd5e xt-compat: add ebtables-translate d988274 xlate-translate: split common parts into helper 1650806 xtables-eb: export 3 functions 6b2041c nft-bridge: add eb-translate backend functions 3063c37 nft-bridge: fix mac address printing 394a400 nft: fix crash when getprotobynumber() returns 0 6a1dbdf ebtables-compat: support intra-positioned negations 3e94f0a nft-bridge: add forward declaration for struct nftnl_rule 5024efe libebt_limit: print 'minute' and 'seconds', not 'min' and 'secs' ce3c780 nft: make nft_init self-contained cb151d5 xtables-translate: rm duplicate includes 69c089b xt-compat: constify a few struct members 03ecffe ebtables-compat: add initial translations 57af67d iptables: constify option struct 88231c4 ebtables-compat: load mark target 6b4e167 ebtables-compat: don't make failing extension load fatal 24110b5 libxt_comment: silence truncation warning 98fc8ce xtables-compat: only validate the xtables builtin tables 9d9b724 xtables-compat: skip unsupported tables 59d15cf xtables-compat: also validate priorities and hook points match expected values eb35854 xtables-compat: fix snprintf truncation warnings fc04c8a extensions: CLUSTERIP: do not allow --local-node 0 eb2c052 extensions: CLUSTERIP: add tests ca3c397 iptables: add xtables-translate.8 manpage 5beb158 extensions: libxt_bpf: Fix build with old kernel versions 147a891 extenstions: ecn: add tcp ecn/cwr translation ed928a8 extensions: add tests for comp match options 632ace7 xtables-compat-multi.c: Allow symlink of ebtables d7ccc68 iptables: add xtables-compat.8 manpage 043da5b extensions: connmark: remove non-working translation a93b502 extensions: prefer plain 'set' over 'set mark and' 577b7e2 xtables-compat-restore: use correct hook priorities Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Diffstat (limited to 'package/network')
-rw-r--r--package/network/utils/iptables/Makefile66
-rw-r--r--package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch52
-rw-r--r--package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch48
-rw-r--r--package/network/utils/iptables/patches/030-extensions-libxt_bpf-Fix-build-with-old-kernel-versi.patch40
-rw-r--r--package/network/utils/iptables/patches/101-remove-check-already.patch28
-rw-r--r--package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch (renamed from package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch)4
-rw-r--r--package/network/utils/iptables/patches/103-optional-xml.patch (renamed from package/network/utils/iptables/patches/050-optional-xml.patch)10
-rw-r--r--package/network/utils/iptables/patches/600-shared-libext.patch62
-rw-r--r--package/network/utils/iptables/patches/700-disable-legacy-revisions.patch10
9 files changed, 204 insertions, 116 deletions
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index 4c5a581268..54fffc9d1e 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -9,13 +9,13 @@ include $(TOPDIR)/rules.mk
include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=iptables
-PKG_VERSION:=1.6.2
-PKG_RELEASE:=3
+PKG_VERSION:=1.8.2
+PKG_RELEASE:=1
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://git.netfilter.org/iptables
-PKG_SOURCE_VERSION:=c16bdec15137b241586310d0e61bc88cc3726004
-PKG_MIRROR_HASH:=72e4bec94a56dd600097846c773e1074ff705e38f800ef221db646c064371a53
+PKG_SOURCE_VERSION:=bba6bc692b0e6137e13881a1f398c134822e9f83
+PKG_MIRROR_HASH:=23a61d2a23fc0d587029690ef2564625d78fba4b2d90117edaf5b9eaf55bb7f9
PKG_FIXUP:=autoreconf
PKG_FLAGS:=nonshared
@@ -106,17 +106,17 @@ IP firewall administration tool.
endef
-define Package/iptables-compat
+define Package/iptables-nft
$(call Package/iptables/Default)
- TITLE:=IP firewall administration tool compat
- DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-compat
+ TITLE:=IP firewall administration tool nft
+ DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-nft
endef
-define Package/iptables-compat/description
-Extra iptables nftables compat binaries.
- iptables-compat
- iptables-compat-restore
- iptables-compat-save
+define Package/iptables-nft/description
+Extra iptables nftables nft binaries.
+ iptables-nft
+ iptables-nft-restore
+ iptables-nft-save
iptables-translate
iptables-restore-translate
endef
@@ -453,17 +453,17 @@ $(call Package/iptables/Default)
MENU:=1
endef
-define Package/ip6tables-compat
+define Package/ip6tables-nft
$(call Package/iptables/Default)
- DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-compat
- TITLE:=IP firewall administration tool compat
+ DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-nft
+ TITLE:=IP firewall administration tool nft
endef
-define Package/ip6tables-compat/description
-Extra ip6tables nftables compat binaries.
- iptables-compat
- iptables-compat-restore
- iptables-compat-save
+define Package/ip6tables-nft/description
+Extra ip6tables nftables nft binaries.
+ iptables-nft
+ iptables-nft-restore
+ iptables-nft-save
iptables-translate
iptables-restore-translate
endef
@@ -494,7 +494,7 @@ $(call Package/iptables/Default)
CATEGORY:=Libraries
DEPENDS:=+libip4tc +libip6tc +libxtables
ABI_VERSION:=$(PKG_VERSION)
- TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
+ TITLE:=IPv4/IPv6 firewall - shared libiptc library (nf compatibility stub)
endef
define Package/libip4tc
@@ -526,11 +526,11 @@ define Package/libxtables
+IPTABLES_NFTABLES:libnftnl
endef
-define Package/libxtables-compat
+define Package/libxtables-nft
$(call Package/iptables/Default)
SECTION:=libs
CATEGORY:=Libraries
- TITLE:=IPv4/IPv6 firewall - shared xtables compat library
+ TITLE:=IPv4/IPv6 firewall - shared xtables nft library
ABI_VERSION:=$(PKG_VERSION)
DEPENDS:=libxtables
endef
@@ -607,15 +607,15 @@ endef
define Package/iptables/install
$(INSTALL_DIR) $(1)/usr/sbin
- $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
+ $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
$(INSTALL_DIR) $(1)/usr/lib/iptables
endef
-define Package/iptables-compat/install
+define Package/iptables-nft/install
$(INSTALL_DIR) $(1)/usr/sbin
- $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-compat-multi $(1)/usr/sbin/
- $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-compat{,-restore,-save} $(1)/usr/sbin/
+ $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/
+ $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/
endef
@@ -624,9 +624,9 @@ define Package/ip6tables/install
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
endef
-define Package/ip6tables-compat/install
+define Package/ip6tables-nft/install
$(INSTALL_DIR) $(1)/usr/sbin
- $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-compat{,-restore,-save} $(1)/usr/sbin/
+ $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-nft{,-restore,-save} $(1)/usr/sbin/
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/
endef
@@ -653,7 +653,7 @@ define Package/libxtables/install
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
endef
-define Package/libxtables-compat/install
+define Package/libxtables-nft/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/
endef
@@ -673,7 +673,7 @@ define BuildPlugin
endef
$(eval $(call BuildPackage,iptables))
-$(eval $(call BuildPackage,iptables-compat))
+$(eval $(call BuildPackage,iptables-nft))
$(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
$(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
$(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
@@ -697,11 +697,11 @@ $(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
$(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
$(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
$(eval $(call BuildPackage,ip6tables))
-$(eval $(call BuildPackage,ip6tables-compat))
+$(eval $(call BuildPackage,ip6tables-nft))
$(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
$(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
$(eval $(call BuildPackage,libiptc))
$(eval $(call BuildPackage,libip4tc))
$(eval $(call BuildPackage,libip6tc))
$(eval $(call BuildPackage,libxtables))
-$(eval $(call BuildPackage,libxtables-compat))
+$(eval $(call BuildPackage,libxtables-nft))
diff --git a/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch b/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch
new file mode 100644
index 0000000000..9bd85ec139
--- /dev/null
+++ b/package/network/utils/iptables/patches/001-extensions_format-security_fixes_in_libip.patch
@@ -0,0 +1,52 @@
+From 907e429d7548157016cd51aba4adc5d0c7d9f816 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
+Date: Wed, 14 Nov 2018 07:35:28 +0100
+Subject: extensions: format-security fixes in libip[6]t_icmp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
+introduced support for gcc feature to check format string against passed
+argument. This commit adds missing bits to extenstions's libipt_icmp.c
+and libip6t_icmp6.c that were causing build to fail.
+
+Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
+Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ extensions/libip6t_icmp6.c | 4 ++--
+ extensions/libipt_icmp.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/extensions/libip6t_icmp6.c
++++ b/extensions/libip6t_icmp6.c
+@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(str
+ type_name = icmp6_type_xlate(icmptype);
+
+ if (type_name) {
+- xt_xlate_add(xl, type_name);
++ xt_xlate_add(xl, "%s", type_name);
+ } else {
+ for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
+ if (icmpv6_codes[i].type == icmptype &&
+@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(str
+ break;
+
+ if (i != ARRAY_SIZE(icmpv6_codes))
+- xt_xlate_add(xl, icmpv6_codes[i].name);
++ xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
+ else
+ return 0;
+ }
+--- a/extensions/libipt_icmp.c
++++ b/extensions/libipt_icmp.c
+@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(str
+ if (icmp_codes[i].type == icmptype &&
+ icmp_codes[i].code_min == code_min &&
+ icmp_codes[i].code_max == code_max) {
+- xt_xlate_add(xl, icmp_codes[i].name);
++ xt_xlate_add(xl, "%s", icmp_codes[i].name);
+ return 1;
+ }
+ }
diff --git a/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch b/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch
new file mode 100644
index 0000000000..13737cf7cd
--- /dev/null
+++ b/package/network/utils/iptables/patches/002-include_fix_build_with_kernel_headers_before_4_2.patch
@@ -0,0 +1,48 @@
+From 8d9d7e4b9ef4c6e6abab2cf35c747d7ca36824bd Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Fri, 16 Nov 2018 09:30:33 +0200
+Subject: include: fix build with kernel headers before 4.2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 672accf1530 (include: update kernel netfilter header files)
+updated linux/netfilter.h and brought with it the update from kernel
+commit a263653ed798 (netfilter: don't pull include/linux/netfilter.h
+from netns headers). This triggers conflict of headers that is fixed in
+kernel commit 279c6c7fa64f (api: fix compatibility of linux/in.h with
+netinet/in.h) included in kernel version 4.2. For earlier kernel headers
+we need a workaround that prevents the headers conflict.
+
+Fixes the following build failure:
+
+In file included from .../sysroot/usr/include/netinet/ip.h:25:0,
+ from ../include/libiptc/ipt_kernel_headers.h:8,
+ from ../include/libiptc/libiptc.h:6,
+ from libip4tc.c:29:
+.../sysroot/usr/include/linux/in.h:26:3: error: redeclaration of enumerator ‘IPPROTO_IP’
+ IPPROTO_IP = 0, /* Dummy protocol for TCP */
+ ^
+.../sysroot/usr/include/netinet/in.h:33:5: note: previous definition of ‘IPPROTO_IP’ was here
+ IPPROTO_IP = 0, /* Dummy protocol for TCP. */
+ ^~~~~~~~~~
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+---
+ include/linux/netfilter.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -3,8 +3,10 @@
+
+ #include <linux/types.h>
+
++#ifndef _NETINET_IN_H
+ #include <linux/in.h>
+ #include <linux/in6.h>
++#endif
+ #include <limits.h>
+
+ /* Responses from hook functions. */
diff --git a/package/network/utils/iptables/patches/030-extensions-libxt_bpf-Fix-build-with-old-kernel-versi.patch b/package/network/utils/iptables/patches/030-extensions-libxt_bpf-Fix-build-with-old-kernel-versi.patch
deleted file mode 100644
index c825eee3a9..0000000000
--- a/package/network/utils/iptables/patches/030-extensions-libxt_bpf-Fix-build-with-old-kernel-versi.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From a12326ad330c4f7cd8d2b6ae1c4fbcd952c378dc Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Mon, 26 Feb 2018 17:39:09 +0100
-Subject: [PATCH] extensions: libxt_bpf: Fix build with old kernel versions
-
-In kernel 3.18 the union bpf_attr does not have a pathname attribute and
-BPF_OBJ_GET is also not defined in these versions.
-This was added in Linux commit b2197755b263 ("bpf: add support for
-persistent maps/progs"). Check for the BPF_FS_MAGIC define which was
-also added in this Linux commit and only activate this code in case we
-find that define.
-
-This fixes a build problem with Linux 3.18.
-Netfilter bug: #1231
-
-Fixes: f17f9ace8a8 ("extensions: libxt_bpf: support ebpf pinned objects")
-Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
----
- extensions/libxt_bpf.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/extensions/libxt_bpf.c
-+++ b/extensions/libxt_bpf.c
-@@ -22,6 +22,7 @@
- #include <linux/bpf.h>
- #endif
-
-+#include <linux/magic.h>
- #include <linux/unistd.h>
-
- #define BCODE_FILE_MAX_LEN_B 1024
-@@ -62,7 +63,7 @@ static const struct xt_option_entry bpf_
-
- static int bpf_obj_get(const char *filepath)
- {
--#if defined HAVE_LINUX_BPF_H && defined __NR_bpf
-+#if defined HAVE_LINUX_BPF_H && defined __NR_bpf && defined BPF_FS_MAGIC
- union bpf_attr attr;
-
- memset(&attr, 0, sizeof(attr));
diff --git a/package/network/utils/iptables/patches/101-remove-check-already.patch b/package/network/utils/iptables/patches/101-remove-check-already.patch
new file mode 100644
index 0000000000..f8d1bf44b6
--- /dev/null
+++ b/package/network/utils/iptables/patches/101-remove-check-already.patch
@@ -0,0 +1,28 @@
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -887,12 +887,6 @@ static void xtables_check_options(const
+
+ void xtables_register_match(struct xtables_match *me)
+ {
+- if (me->next) {
+- fprintf(stderr, "%s: match \"%s\" already registered\n",
+- xt_params->program_name, me->name);
+- exit(1);
+- }
+-
+ if (me->version == NULL) {
+ fprintf(stderr, "%s: match %s<%u> is missing a version\n",
+ xt_params->program_name, me->name, me->revision);
+@@ -1080,12 +1074,6 @@ void xtables_register_matches(struct xta
+
+ void xtables_register_target(struct xtables_target *me)
+ {
+- if (me->next) {
+- fprintf(stderr, "%s: target \"%s\" already registered\n",
+- xt_params->program_name, me->name);
+- exit(1);
+- }
+-
+ if (me->version == NULL) {
+ fprintf(stderr, "%s: target %s<%u> is missing a version\n",
+ xt_params->program_name, me->name, me->revision);
diff --git a/package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
index 4add4ea5f3..0866118440 100644
--- a/package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch
+++ b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
@@ -1,6 +1,6 @@
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
-@@ -355,6 +355,7 @@ static char *get_modprobe(void)
+@@ -360,6 +360,7 @@ static char *get_modprobe(void)
int xtables_insmod(const char *modname, const char *modprobe, bool quiet)
{
@@ -8,7 +8,7 @@
char *buf = NULL;
char *argv[4];
int status;
-@@ -395,6 +396,7 @@ int xtables_insmod(const char *modname,
+@@ -394,6 +395,7 @@ int xtables_insmod(const char *modname,
free(buf);
if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
return 0;
diff --git a/package/network/utils/iptables/patches/050-optional-xml.patch b/package/network/utils/iptables/patches/103-optional-xml.patch
index b782bbf13a..2396037fdd 100644
--- a/package/network/utils/iptables/patches/050-optional-xml.patch
+++ b/package/network/utils/iptables/patches/103-optional-xml.patch
@@ -1,8 +1,8 @@
---- a/iptables/xtables-multi.c
-+++ b/iptables/xtables-multi.c
-@@ -26,8 +26,10 @@ static const struct subcommand multi_sub
- {"iptables-restore", iptables_restore_main},
- {"restore4", iptables_restore_main},
+--- a/iptables/xtables-legacy-multi.c
++++ b/iptables/xtables-legacy-multi.c
+@@ -31,8 +31,10 @@ static const struct subcommand multi_sub
+
+
#endif
+#ifdef ENABLE_XML
{"iptables-xml", iptables_xml_main},
diff --git a/package/network/utils/iptables/patches/600-shared-libext.patch b/package/network/utils/iptables/patches/600-shared-libext.patch
index 6e08416f0e..e88c288be6 100644
--- a/package/network/utils/iptables/patches/600-shared-libext.patch
+++ b/package/network/utils/iptables/patches/600-shared-libext.patch
@@ -56,49 +56,49 @@
+++ b/iptables/Makefile.am
@@ -8,7 +8,8 @@ BUILT_SOURCES =
- xtables_multi_SOURCES = xtables-multi.c iptables-xml.c
- xtables_multi_CFLAGS = ${AM_CFLAGS}
--xtables_multi_LDADD = ../extensions/libext.a
-+xtables_multi_LDADD =
-+xtables_multi_LDFLAGS = -L../extensions/ -liptext
+ xtables_legacy_multi_SOURCES = xtables-legacy-multi.c iptables-xml.c
+ xtables_legacy_multi_CFLAGS = ${AM_CFLAGS}
+-xtables_legacy_multi_LDADD = ../extensions/libext.a
++xtables_legacy_multi_LDADD =
++xtables_legacy_multi_LDFLAGS = -L../extensions/ -liptext
if ENABLE_STATIC
- xtables_multi_CFLAGS += -DALL_INCLUSIVE
+ xtables_legacy_multi_CFLAGS += -DALL_INCLUSIVE
endif
@@ -16,13 +17,15 @@ if ENABLE_IPV4
- xtables_multi_SOURCES += iptables-save.c iptables-restore.c \
+ xtables_legacy_multi_SOURCES += iptables-save.c iptables-restore.c \
iptables-standalone.c iptables.c
- xtables_multi_CFLAGS += -DENABLE_IPV4
--xtables_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a
-+xtables_multi_LDADD += ../libiptc/libip4tc.la
-+xtables_multi_LDFLAGS += -liptext4
+ xtables_legacy_multi_CFLAGS += -DENABLE_IPV4
+-xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la ../extensions/libext4.a
++xtables_legacy_multi_LDADD += ../libiptc/libip4tc.la
++xtables_legacy_multi_LDFLAGS += -liptext4
endif
if ENABLE_IPV6
- xtables_multi_SOURCES += ip6tables-save.c ip6tables-restore.c \
+ xtables_legacy_multi_SOURCES += ip6tables-save.c ip6tables-restore.c \
ip6tables-standalone.c ip6tables.c
- xtables_multi_CFLAGS += -DENABLE_IPV6
--xtables_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
-+xtables_multi_LDADD += ../libiptc/libip6tc.la
-+xtables_multi_LDFLAGS += -liptext6
+ xtables_legacy_multi_CFLAGS += -DENABLE_IPV6
+-xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
++xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la
++xtables_legacy_multi_LDFLAGS += -liptext6
endif
- xtables_multi_SOURCES += xshared.c
- xtables_multi_LDADD += ../libxtables/libxtables.la -lm
+ xtables_legacy_multi_SOURCES += xshared.c
+ xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
@@ -32,7 +35,8 @@ if ENABLE_NFTABLES
BUILT_SOURCES += xtables-config-parser.h
- xtables_compat_multi_SOURCES = xtables-compat-multi.c iptables-xml.c
- xtables_compat_multi_CFLAGS = ${AM_CFLAGS}
--xtables_compat_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a
-+xtables_compat_multi_LDADD =
-+xtables_compat_multi_LDFLAGS = -L../extensions/ -liptext -liptext_ebt
+ xtables_nft_multi_SOURCES = xtables-nft-multi.c iptables-xml.c
+ xtables_nft_multi_CFLAGS = ${AM_CFLAGS}
+-xtables_nft_multi_LDADD = ../extensions/libext.a ../extensions/libext_ebt.a
++xtables_nft_multi_LDADD =
++xtables_nft_multi_LDFLAGS = -L../extensions/ -liptext -liptext_ebt
if ENABLE_STATIC
- xtables_compat_multi_CFLAGS += -DALL_INCLUSIVE
+ xtables_nft_multi_CFLAGS += -DALL_INCLUSIVE
endif
-@@ -45,7 +49,8 @@ xtables_compat_multi_SOURCES += xtables-
- getethertype.c nft-bridge.c \
+@@ -47,7 +51,8 @@ xtables_nft_multi_SOURCES += xtables-sav
xtables-eb-standalone.c xtables-eb.c \
+ xtables-eb-translate.c \
xtables-translate.c
--xtables_compat_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a
-+xtables_compat_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS}
-+xtables_compat_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt
+-xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS} ../extensions/libext4.a ../extensions/libext6.a ../extensions/libext_ebt.a ../extensions/libext_arpt.a
++xtables_nft_multi_LDADD += ${libmnl_LIBS} ${libnftnl_LIBS} ${libnetfilter_conntrack_LIBS}
++xtables_nft_multi_LDFLAGS += -liptext4 -liptext6 -liptext_arpt
# yacc and lex generate dirty code
- xtables_compat_multi-xtables-config-parser.o xtables_compat_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls
- xtables_compat_multi_SOURCES += xshared.c
+ xtables_nft_multi-xtables-config-parser.o xtables_nft_multi-xtables-config-syntax.o: AM_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations -Wno-implicit-function-declaration -Wno-nested-externs -Wno-undef -Wno-redundant-decls
+ xtables_nft_multi_SOURCES += xshared.c
diff --git a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
index 6800ca5ece..328f3af18d 100644
--- a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
+++ b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
@@ -1,6 +1,6 @@
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
-@@ -1397,6 +1397,7 @@ static int conntrack3_mt6_xlate(struct x
+@@ -1389,6 +1389,7 @@ static int conntrack3_mt6_xlate(struct x
}
static struct xtables_match conntrack_mt_reg[] = {
@@ -8,7 +8,7 @@
{
.version = XTABLES_VERSION,
.name = "conntrack",
-@@ -1472,6 +1473,7 @@ static struct xtables_match conntrack_mt
+@@ -1464,6 +1465,7 @@ static struct xtables_match conntrack_mt
.alias = conntrack_print_name_alias,
.x6_options = conntrack2_mt_opts,
},
@@ -16,7 +16,7 @@
{
.version = XTABLES_VERSION,
.name = "conntrack",
-@@ -1504,6 +1506,7 @@ static struct xtables_match conntrack_mt
+@@ -1496,6 +1498,7 @@ static struct xtables_match conntrack_mt
.x6_options = conntrack3_mt_opts,
.xlate = conntrack3_mt6_xlate,
},
@@ -24,7 +24,7 @@
{
.family = NFPROTO_UNSPEC,
.name = "state",
-@@ -1534,6 +1537,8 @@ static struct xtables_match conntrack_mt
+@@ -1526,6 +1529,8 @@ static struct xtables_match conntrack_mt
.x6_parse = state_ct23_parse,
.x6_options = state_opts,
},
@@ -33,7 +33,7 @@
{
.family = NFPROTO_UNSPEC,
.name = "state",
-@@ -1563,6 +1568,7 @@ static struct xtables_match conntrack_mt
+@@ -1555,6 +1560,7 @@ static struct xtables_match conntrack_mt
.x6_parse = state_parse,
.x6_options = state_opts,
},