diff options
Diffstat (limited to 'package/network/utils/iptables')
12 files changed, 569 insertions, 94 deletions
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile index 42d9af14b07..45a2b49070e 100644 --- a/package/network/utils/iptables/Makefile +++ b/package/network/utils/iptables/Makefile @@ -9,17 +9,18 @@ include $(TOPDIR)/rules.mk include $(INCLUDE_DIR)/kernel.mk PKG_NAME:=iptables -PKG_VERSION:=1.8.7 -PKG_RELEASE:=1 +PKG_VERSION:=1.8.8 +PKG_RELEASE:=2 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_HASH:=c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0 +PKG_HASH:=71c75889dc710676631553eb1511da0177bbaaf1b551265b912d236c3f51859f PKG_FIXUP:=autoreconf PKG_FLAGS:=nonshared PKG_INSTALL:=1 +PKG_BUILD_FLAGS:=gc-sections no-lto PKG_BUILD_PARALLEL:=1 PKG_LICENSE:=GPL-2.0 PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables @@ -41,31 +42,27 @@ endef define Package/iptables/Module $(call Package/iptables/Default) - DEPENDS:=iptables $(1) + DEPENDS:=+libxtables $(1) endef -define Package/iptables +define Package/xtables-legacy $(call Package/iptables/Default) TITLE:=IP firewall administration tool - MENU:=1 - DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables + DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 +libxtables endef -define Package/iptables/config - config IPTABLES_CONNLABEL - bool "Enable Connlabel support" - default n - help - This enable connlabel support in iptables. - - config IPTABLES_NFTABLES - bool "Enable Nftables support" - default n - help - This enable nftables support in iptables. +define Package/iptables-zz-legacy +$(call Package/iptables/Default) + TITLE:=IP firewall administration tool + DEPENDS+= +xtables-legacy + PROVIDES:=iptables iptables-legacy + ALTERNATIVES:=\ + 200:/usr/sbin/iptables:/usr/sbin/xtables-legacy-multi \ + 200:/usr/sbin/iptables-restore:/usr/sbin/xtables-legacy-multi \ + 200:/usr/sbin/iptables-save:/usr/sbin/xtables-legacy-multi endef -define Package/iptables/description +define Package/iptables-zz-legacy/description IP firewall administration tool. Matches: @@ -105,10 +102,43 @@ IP firewall administration tool. endef +define Package/xtables-nft +$(call Package/iptables/Default) + TITLE:=IP firewall administration tool nft + DEPENDS:=+libnftnl +libiptext +IPV6:libiptext6 +libiptext-nft +kmod-nft-compat +endef + +define Package/arptables-nft +$(call Package/iptables/Default) + DEPENDS:=+kmod-nft-arp +xtables-nft +kmod-arptables + TITLE:=ARP firewall administration tool nft + PROVIDES:=arptables + ALTERNATIVES:=\ + 300:/usr/sbin/arptables:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/arptables-restore:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/arptables-save:/usr/sbin/xtables-nft-multi +endef + +define Package/ebtables-nft +$(call Package/iptables/Default) + DEPENDS:=+kmod-nft-bridge +xtables-nft +kmod-ebtables + TITLE:=Bridge firewall administration tool nft + PROVIDES:=ebtables + ALTERNATIVES:=\ + 300:/usr/sbin/ebtables:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/ebtables-restore:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/ebtables-save:/usr/sbin/xtables-nft-multi +endef + define Package/iptables-nft $(call Package/iptables/Default) TITLE:=IP firewall administration tool nft - DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-nft + DEPENDS:=+kmod-ipt-core +xtables-nft + PROVIDES:=iptables + ALTERNATIVES:=\ + 300:/usr/sbin/iptables:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/iptables-restore:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/iptables-save:/usr/sbin/xtables-nft-multi endef define Package/iptables-nft/description @@ -121,7 +151,7 @@ Extra iptables nftables nft binaries. endef define Package/iptables-mod-conntrack-extra -$(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw) +$(call Package/iptables/Module, +kmod-ipt-conntrack-extra) TITLE:=Extra connection tracking extensions endef @@ -222,19 +252,6 @@ iptables extensions for extra NAT targets. - NETMAP endef -define Package/iptables-mod-ulog -$(call Package/iptables/Module, +kmod-ipt-ulog) - TITLE:=user-space packet logging -endef - -define Package/iptables-mod-ulog/description -iptables extensions for user-space packet logging. - - Targets: - - ULOG - -endef - define Package/iptables-mod-nflog $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog) TITLE:=Netfilter NFLOG target @@ -393,6 +410,19 @@ iptables extension for triggering a LED. endef +define Package/iptables-mod-socket +$(call Package/iptables/Module, +kmod-ipt-socket) + TITLE:=Socket match iptables extensions +endef + +define Package/iptables-mod-socket/description +Socket match iptables extensions. + + Matches: + - socket + +endef + define Package/iptables-mod-tproxy $(call Package/iptables/Module, +kmod-ipt-tproxy) TITLE:=Transparent proxy iptables extensions @@ -401,9 +431,6 @@ endef define Package/iptables-mod-tproxy/description Transparent proxy iptables extensions. - Matches: - - socket - Targets: - TPROXY @@ -444,42 +471,51 @@ define Package/iptables-mod-checksum/description iptables extension for the CHECKSUM calculation target endef -define Package/ip6tables +define Package/ip6tables-zz-legacy $(call Package/iptables/Default) - DEPENDS:=@IPV6 +kmod-ip6tables +iptables + DEPENDS:=@IPV6 +kmod-ip6tables +xtables-legacy CATEGORY:=Network TITLE:=IPv6 firewall administration tool - MENU:=1 + PROVIDES:=ip6tables ip6tables-legacy + ALTERNATIVES:=\ + 200:/usr/sbin/ip6tables:/usr/sbin/xtables-legacy-multi \ + 200:/usr/sbin/ip6tables-restore:/usr/sbin/xtables-legacy-multi \ + 200:/usr/sbin/ip6tables-save:/usr/sbin/xtables-legacy-multi endef define Package/ip6tables-nft $(call Package/iptables/Default) - DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-nft + DEPENDS:=@IPV6 +kmod-ip6tables +xtables-nft TITLE:=IP firewall administration tool nft + PROVIDES:=ip6tables + ALTERNATIVES:=\ + 300:/usr/sbin/ip6tables:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/ip6tables-restore:/usr/sbin/xtables-nft-multi \ + 300:/usr/sbin/ip6tables-save:/usr/sbin/xtables-nft-multi endef define Package/ip6tables-nft/description Extra ip6tables nftables nft binaries. - iptables-nft - iptables-nft-restore - iptables-nft-save - iptables-translate - iptables-restore-translate + ip6tables-nft + ip6tables-nft-restore + ip6tables-nft-save + ip6tables-translate + ip6tables-restore-translate endef define Package/ip6tables-extra $(call Package/iptables/Default) - DEPENDS:=ip6tables +kmod-ip6tables-extra + DEPENDS:=+libxtables +kmod-ip6tables-extra TITLE:=IPv6 header matching modules endef -define Package/ip6tables-mod-extra/description +define Package/ip6tables-extra/description iptables header matching modules for IPv6 endef define Package/ip6tables-mod-nat $(call Package/iptables/Default) - DEPENDS:=ip6tables +kmod-ipt-nat6 + DEPENDS:=+libxtables +kmod-ipt-nat6 TITLE:=IPv6 NAT extensions endef @@ -493,7 +529,6 @@ $(call Package/iptables/Default) CATEGORY:=Libraries TITLE:=IPv4 firewall - shared libiptc library ABI_VERSION:=2 - DEPENDS:=+libxtables endef define Package/libip6tc @@ -502,27 +537,51 @@ $(call Package/iptables/Default) CATEGORY:=Libraries TITLE:=IPv6 firewall - shared libiptc library ABI_VERSION:=2 - DEPENDS:=+libxtables endef -define Package/libxtables +define Package/libiptext $(call Package/iptables/Default) SECTION:=libs CATEGORY:=Libraries - TITLE:=IPv4/IPv6 firewall - shared xtables library - ABI_VERSION:=12 - DEPENDS:= \ - +IPTABLES_CONNLABEL:libnetfilter-conntrack \ - +IPTABLES_NFTABLES:libnftnl + TITLE:=IPv4 firewall - shared libiptext library + ABI_VERSION:=0 + DEPENDS:=+libxtables +endef + +define Package/libiptext6 + $(call Package/iptables/Default) + SECTION:=libs + CATEGORY:=Libraries + TITLE:=IPv6 firewall - shared libiptext library + ABI_VERSION:=0 + DEPENDS:=+libxtables +endef + +define Package/libiptext-nft + $(call Package/iptables/Default) + SECTION:=libs + CATEGORY:=Libraries + TITLE:=IPv4/IPv6 firewall - shared libiptext nft library + ABI_VERSION:=0 + DEPENDS:=+libxtables endef -define Package/libxtables-nft +define Package/libxtables $(call Package/iptables/Default) SECTION:=libs CATEGORY:=Libraries - TITLE:=IPv4/IPv6 firewall - shared xtables nft library + TITLE:=IPv4/IPv6 firewall - shared xtables library + MENU:=1 ABI_VERSION:=12 - DEPENDS:=libxtables + DEPENDS:=+IPTABLES_CONNLABEL:libnetfilter-conntrack +endef + +define Package/libxtables/config + config IPTABLES_CONNLABEL + bool "Enable Connlabel support" + default n + help + This enable connlabel support in iptables. endef TARGET_CPPFLAGS := \ @@ -533,12 +592,8 @@ TARGET_CPPFLAGS := \ TARGET_CFLAGS += \ -I$(PKG_BUILD_DIR)/include \ -I$(LINUX_DIR)/user_headers/include \ - -ffunction-sections -fdata-sections \ -DNO_LEGACY -TARGET_LDFLAGS += \ - -Wl,--gc-sections - CONFIGURE_ARGS += \ --enable-shared \ --enable-static \ @@ -547,7 +602,6 @@ CONFIGURE_ARGS += \ --with-xtlibdir=/usr/lib/iptables \ --with-xt-lock-name=/var/run/xtables.lock \ $(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \ - $(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \ $(if $(CONFIG_IPV6),,--disable-ipv6) MAKE_FLAGS := \ @@ -580,7 +634,6 @@ define Build/InstallDev $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/ $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/ $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/ - $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/ $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/ $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/ @@ -595,23 +648,45 @@ define Build/InstallDev $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/ endef -define Package/iptables/install +define Package/xtables-legacy/install $(INSTALL_DIR) $(1)/usr/sbin $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/ - $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/ +endef + +define Package/iptables-zz-legacy/install + $(INSTALL_DIR) $(1)/usr/sbin + $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-legacy{,-restore,-save} $(1)/usr/sbin/ $(INSTALL_DIR) $(1)/usr/lib/iptables endef -define Package/iptables-nft/install +define Package/xtables-nft/install $(INSTALL_DIR) $(1)/usr/sbin $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/ +endef + +define Package/arptables-nft/install + $(INSTALL_DIR) $(1)/usr/sbin + $(CP) $(PKG_INSTALL_DIR)/usr/sbin/arptables-nft{,-restore,-save} $(1)/usr/sbin/ + $(INSTALL_DIR) $(1)/usr/lib/iptables + $(CP) $(PKG_BUILD_DIR)/extensions/libarpt_*.so $(1)/usr/lib/iptables/ +endef + +define Package/ebtables-nft/install + $(INSTALL_DIR) $(1)/usr/sbin + $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ebtables-nft{,-restore,-save} $(1)/usr/sbin/ + $(INSTALL_DIR) $(1)/usr/lib/iptables + $(CP) $(PKG_BUILD_DIR)/extensions/libebt_*.so $(1)/usr/lib/iptables/ +endef + +define Package/iptables-nft/install + $(INSTALL_DIR) $(1)/usr/sbin $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/ $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/ endef -define Package/ip6tables/install +define Package/ip6tables-zz-legacy/install $(INSTALL_DIR) $(1)/usr/sbin - $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/ + $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-legacy{,-restore,-save} $(1)/usr/sbin/ endef define Package/ip6tables-nft/install @@ -623,26 +698,34 @@ endef define Package/libip4tc/install $(INSTALL_DIR) $(1)/usr/lib $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/ - $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/ endef define Package/libip6tc/install $(INSTALL_DIR) $(1)/usr/lib $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/ - $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/ endef -define Package/libxtables/install +define Package/libiptext/install $(INSTALL_DIR) $(1)/usr/lib - $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/ $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/ + $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/ +endef + +define Package/libiptext6/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/ endef -define Package/libxtables-nft/install +define Package/libiptext-nft/install $(INSTALL_DIR) $(1)/usr/lib $(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/ endef +define Package/libxtables/install + $(INSTALL_DIR) $(1)/usr/lib + $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/ +endef + define BuildPlugin define Package/$(1)/install $(INSTALL_DIR) $$(1)/usr/lib/iptables @@ -658,11 +741,17 @@ define BuildPlugin endef $(eval $(call BuildPackage,libxtables)) -$(eval $(call BuildPackage,libxtables-nft)) $(eval $(call BuildPackage,libip4tc)) $(eval $(call BuildPackage,libip6tc)) -$(eval $(call BuildPackage,iptables)) +$(eval $(call BuildPackage,libiptext)) +$(eval $(call BuildPackage,libiptext6)) +$(eval $(call BuildPackage,libiptext-nft)) +$(eval $(call BuildPackage,xtables-legacy)) +$(eval $(call BuildPackage,xtables-nft)) +$(eval $(call BuildPackage,arptables-nft)) +$(eval $(call BuildPackage,ebtables-nft)) $(eval $(call BuildPackage,iptables-nft)) +$(eval $(call BuildPackage,iptables-zz-legacy)) $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m))) $(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m))) $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m))) @@ -674,10 +763,10 @@ $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m))) $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m))) $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m))) $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m))) -$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m))) $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m))) $(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m))) $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m))) +$(eval $(call BuildPlugin,iptables-mod-socket,$(IPT_SOCKET-m))) $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m))) $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m))) $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m))) @@ -685,8 +774,8 @@ $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m))) $(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m))) $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m))) $(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m))) -$(eval $(call BuildPackage,ip6tables)) $(eval $(call BuildPackage,ip6tables-nft)) +$(eval $(call BuildPackage,ip6tables-zz-legacy)) $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m))) $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m))) diff --git a/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch b/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch new file mode 100644 index 00000000000..e4b0cd92dea --- /dev/null +++ b/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch @@ -0,0 +1,144 @@ +From f319389525b066b7dc6d389c88f16a0df3b8f189 Mon Sep 17 00:00:00 2001 +From: Nick Hainke <vincent@systemli.org> +Date: Mon, 16 May 2022 18:16:41 +0200 +Subject: treewide: use uint* instead of u_int* + +Gcc complains about missing types. Some commits introduced u_int* instead +of uint*. Use uint treewide. + +Fixes errors in the form of: +In file included from xtables-legacy-multi.c:5: +xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? + 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, + | ^~~~~~~~~ + | uint16_t +make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 + +Avoid libipq API breakage by adjusting libipq.h include accordingly. For +arpt_mangle.h kernel uAPI header, apply same change as in kernel commit +e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). + +Signed-off-by: Nick Hainke <vincent@systemli.org> +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + extensions/libxt_conntrack.c | 2 +- + include/libipq/libipq.h | 8 ++++---- + include/libiptc/libxtc.h | 2 +- + include/linux/netfilter_arp/arpt_mangle.h | 2 +- + iptables/xshared.c | 2 +- + iptables/xshared.h | 2 +- + libipq/ipq_create_handle.3 | 2 +- + libipq/ipq_set_mode.3 | 2 +- + 8 files changed, 11 insertions(+), 11 deletions(-) + +--- a/extensions/libxt_conntrack.c ++++ b/extensions/libxt_conntrack.c +@@ -778,7 +778,7 @@ matchinfo_print(const void *ip, const st + + static void + conntrack_dump_ports(const char *prefix, const char *opt, +- u_int16_t port_low, u_int16_t port_high) ++ uint16_t port_low, uint16_t port_high) + { + if (port_high == 0 || port_low == port_high) + printf(" %s%s %u", prefix, opt, port_low); +--- a/include/libipq/libipq.h ++++ b/include/libipq/libipq.h +@@ -24,7 +24,7 @@ + #include <errno.h> + #include <unistd.h> + #include <fcntl.h> +-#include <sys/types.h> ++#include <stdint.h> + #include <sys/socket.h> + #include <sys/uio.h> + #include <asm/types.h> +@@ -48,19 +48,19 @@ typedef unsigned long ipq_id_t; + struct ipq_handle + { + int fd; +- u_int8_t blocking; ++ uint8_t blocking; + struct sockaddr_nl local; + struct sockaddr_nl peer; + }; + +-struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol); ++struct ipq_handle *ipq_create_handle(uint32_t flags, uint32_t protocol); + + int ipq_destroy_handle(struct ipq_handle *h); + + ssize_t ipq_read(const struct ipq_handle *h, + unsigned char *buf, size_t len, int timeout); + +-int ipq_set_mode(const struct ipq_handle *h, u_int8_t mode, size_t len); ++int ipq_set_mode(const struct ipq_handle *h, uint8_t mode, size_t len); + + ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf); + +--- a/include/libiptc/libxtc.h ++++ b/include/libiptc/libxtc.h +@@ -10,7 +10,7 @@ extern "C" { + #endif + + #ifndef XT_MIN_ALIGN +-/* xt_entry has pointers and u_int64_t's in it, so if you align to ++/* xt_entry has pointers and uint64_t's in it, so if you align to + it, you'll also align to any crazy matches and targets someone + might write */ + #define XT_MIN_ALIGN (__alignof__(struct xt_entry)) +--- a/include/linux/netfilter_arp/arpt_mangle.h ++++ b/include/linux/netfilter_arp/arpt_mangle.h +@@ -13,7 +13,7 @@ struct arpt_mangle + union { + struct in_addr tgt_ip; + } u_t; +- u_int8_t flags; ++ __u8 flags; + int target; + }; + +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1025,7 +1025,7 @@ static const int inverse_for_options[NUM + }; + + void +-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, ++set_option(unsigned int *options, unsigned int option, uint16_t *invflg, + bool invert) + { + if (*options & option) +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,7 @@ struct xtables_target; + #define IPT_INV_ARPHRD 0x0800 + + void +-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, ++set_option(unsigned int *options, unsigned int option, uint16_t *invflg, + bool invert); + + /** +--- a/libipq/ipq_create_handle.3 ++++ b/libipq/ipq_create_handle.3 +@@ -24,7 +24,7 @@ ipq_create_handle, ipq_destroy_handle \( + .br + .B #include <libipq.h> + .sp +-.BI "struct ipq_handle *ipq_create_handle(u_int32_t " flags ", u_int32_t " protocol ");" ++.BI "struct ipq_handle *ipq_create_handle(uint32_t " flags ", uint32_t " protocol ");" + .br + .BI "int ipq_destroy_handle(struct ipq_handle *" h ); + .SH DESCRIPTION +--- a/libipq/ipq_set_mode.3 ++++ b/libipq/ipq_set_mode.3 +@@ -24,7 +24,7 @@ ipq_set_mode \(em set the ip_queue queui + .br + .B #include <libipq.h> + .sp +-.BI "int ipq_set_mode(const struct ipq_handle *" h ", u_int8_t " mode ", size_t " range ); ++.BI "int ipq_set_mode(const struct ipq_handle *" h ", uint8_t " mode ", size_t " range ); + .SH DESCRIPTION + The + .B ipq_set_mode diff --git a/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch b/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch new file mode 100644 index 00000000000..6c8e3deb5c3 --- /dev/null +++ b/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch @@ -0,0 +1,60 @@ +From 0e7cf0ad306cdf95dc3c28d15a254532206a888e Mon Sep 17 00:00:00 2001 +From: Phil Sutter <phil@nwl.cc> +Date: Wed, 18 May 2022 16:04:09 +0200 +Subject: Revert "fix build for missing ETH_ALEN definition" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke +compiling against musl libc. Might be a bug in the latter, but for the +time being try to please both by avoiding the include and instead +defining ETH_ALEN if unset. + +While being at it, move netinet/ether.h include up. + +Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") +Signed-off-by: Phil Sutter <phil@nwl.cc> +Reviewed-by: Maciej Żenczykowski <maze@google.com> +--- + libxtables/xtables.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -28,6 +28,7 @@ + #include <stdlib.h> + #include <string.h> + #include <unistd.h> ++#include <netinet/ether.h> + #include <sys/socket.h> + #include <sys/stat.h> + #include <sys/statfs.h> +@@ -45,7 +46,6 @@ + + #include <xtables.h> + #include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */ +-#include <linux/if_ether.h> /* ETH_ALEN */ + #include <linux/netfilter_ipv4/ip_tables.h> + #include <linux/netfilter_ipv6/ip6_tables.h> + #include <libiptc/libxtc.h> +@@ -72,6 +72,10 @@ + #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" + #endif + ++#ifndef ETH_ALEN ++#define ETH_ALEN 6 ++#endif ++ + /* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the + * current line of the input file, in order to give a more precise error + * message. ip6?tables itself doesn't need this, so it is initialized to the +@@ -2245,8 +2249,6 @@ void xtables_print_num(uint64_t number, + printf(FMT("%4lluT ","%lluT "), (unsigned long long)number); + } + +-#include <netinet/ether.h> +- + static const unsigned char mac_type_unicast[ETH_ALEN] = {}; + static const unsigned char msk_type_unicast[ETH_ALEN] = {1}; + static const unsigned char mac_type_multicast[ETH_ALEN] = {1}; diff --git a/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch b/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch new file mode 100644 index 00000000000..f7e5e34c731 --- /dev/null +++ b/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch @@ -0,0 +1,23 @@ +From b72eb12ea5a61df0655ad99d5048994e916be83a Mon Sep 17 00:00:00 2001 +From: Phil Sutter <phil@nwl.cc> +Date: Fri, 13 May 2022 16:51:58 +0200 +Subject: [PATCH] xshared: Fix build for -Werror=format-security + +Gcc complains about the omitted format string. + +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + iptables/xshared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct + return; + + if (args->family != NFPROTO_ARP) +- xtables_error(PARAMETER_PROBLEM, msg); ++ xtables_error(PARAMETER_PROBLEM, "%s", msg); + + fprintf(stderr, "%s", msg); + } diff --git a/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch b/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch new file mode 100644 index 00000000000..acfca96e0fe --- /dev/null +++ b/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch @@ -0,0 +1,28 @@ +From 0ebf52fc951b2a4d98a166afb34af4f364bbeece Mon Sep 17 00:00:00 2001 +From: Ben Brown <ben@demerara.io> +Date: Wed, 25 May 2022 16:26:13 +0100 +Subject: build: Fix error during out of tree build + +Fixes the following error: + + ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory + 52 | #include <libiptc/linux_list.h> + +Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") +Signed-off-by: Ben Brown <ben@demerara.io> +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + libxtables/Makefile.am | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/libxtables/Makefile.am ++++ b/libxtables/Makefile.am +@@ -1,7 +1,7 @@ + # -*- Makefile -*- + + AM_CFLAGS = ${regular_CFLAGS} +-AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables ${kinclude_CPPFLAGS} ++AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables -I${top_srcdir} ${kinclude_CPPFLAGS} + + lib_LTLIBRARIES = libxtables.la + libxtables_la_SOURCES = xtables.c xtoptions.c getethertype.c diff --git a/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch b/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch new file mode 100644 index 00000000000..559b93eea43 --- /dev/null +++ b/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch @@ -0,0 +1,82 @@ +From ef108943f69a6e20533d58823740d3f0534ea8ec Mon Sep 17 00:00:00 2001 +From: Phil Sutter <phil@nwl.cc> +Date: Wed, 1 Jun 2022 19:15:06 +0200 +Subject: libxtables: Unexport init_extensions*() declarations + +The functions are used for static builds to initialize extensions after +libxtables init. Regular library users should not need them, but the +empty declarations introduced in #else case (and therefore present in +user's env) may clash with existing symbol names. + +Avoid problems and guard the whole block declaring the function +prototypes and mangling extensions' _init functions by XTABLES_INTERNAL. + +Reported-by: Nick Hainke <vincent@systemli.org> +Fixes: 6c689b639cf8e ("Simplify static build extension loading") +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + include/xtables.h | 44 ++++++++++++++++++++++---------------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -585,27 +585,6 @@ static inline void xtables_print_mark_ma + xtables_print_val_mask(mark, mask, NULL); + } + +-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) +-# ifdef _INIT +-# undef _init +-# define _init _INIT +-# endif +- extern void init_extensions(void); +- extern void init_extensions4(void); +- extern void init_extensions6(void); +- extern void init_extensionsa(void); +- extern void init_extensionsb(void); +-#else +-# define _init __attribute__((constructor)) _INIT +-# define EMPTY_FUNC_DEF(x) static inline void x(void) {} +- EMPTY_FUNC_DEF(init_extensions) +- EMPTY_FUNC_DEF(init_extensions4) +- EMPTY_FUNC_DEF(init_extensions6) +- EMPTY_FUNC_DEF(init_extensionsa) +- EMPTY_FUNC_DEF(init_extensionsb) +-# undef EMPTY_FUNC_DEF +-#endif +- + extern const struct xtables_pprot xtables_chain_protos[]; + extern uint16_t xtables_parse_protocol(const char *s); + +@@ -663,9 +642,30 @@ void xtables_announce_chain(const char * + # define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x))) + # endif + ++#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) ++# ifdef _INIT ++# undef _init ++# define _init _INIT ++# endif ++ extern void init_extensions(void); ++ extern void init_extensions4(void); ++ extern void init_extensions6(void); ++ extern void init_extensionsa(void); ++ extern void init_extensionsb(void); ++#else ++# define _init __attribute__((constructor)) _INIT ++# define EMPTY_FUNC_DEF(x) static inline void x(void) {} ++ EMPTY_FUNC_DEF(init_extensions) ++ EMPTY_FUNC_DEF(init_extensions4) ++ EMPTY_FUNC_DEF(init_extensions6) ++ EMPTY_FUNC_DEF(init_extensionsa) ++ EMPTY_FUNC_DEF(init_extensionsb) ++# undef EMPTY_FUNC_DEF ++#endif ++ + extern void _init(void); + +-#endif ++#endif /* XTABLES_INTERNAL */ + + #ifdef __cplusplus + } /* extern "C" */ diff --git a/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch b/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch new file mode 100644 index 00000000000..cfcb6c77f38 --- /dev/null +++ b/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch @@ -0,0 +1,40 @@ +From da5b32fb4656ab69fe1156eb7e36c7c961839e8a Mon Sep 17 00:00:00 2001 +From: Phil Sutter <phil@nwl.cc> +Date: Wed, 8 Jun 2022 13:45:13 +0200 +Subject: [PATCH] extensions: string: Review parse_string() function + +* Compare against sizeof(info->pattern) which is more clear than having + to know that this buffer is of size XT_STRING_MAX_PATTERN_SIZE + +* Invert the check and error early to reduce indenting + +* Pass info->patlen to memcpy() to avoid reading past end of 's' + +Signed-off-by: Phil Sutter <phil@nwl.cc> +--- + extensions/libxt_string.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/extensions/libxt_string.c ++++ b/extensions/libxt_string.c +@@ -78,14 +78,13 @@ static void string_init(struct xt_entry_ + + static void + parse_string(const char *s, struct xt_string_info *info) +-{ ++{ + /* xt_string does not need \0 at the end of the pattern */ +- if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) { +- memcpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE); +- info->patlen = strnlen(s, XT_STRING_MAX_PATTERN_SIZE); +- return; +- } +- xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s); ++ if (strlen(s) > sizeof(info->pattern)) ++ xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s); ++ ++ info->patlen = strnlen(s, sizeof(info->pattern)); ++ memcpy(info->pattern, s, info->patlen); + } + + static void diff --git a/package/network/utils/iptables/patches/101-remove-check-already.patch b/package/network/utils/iptables/patches/101-remove-check-already.patch index 16afafec2d5..bd49224c70b 100644 --- a/package/network/utils/iptables/patches/101-remove-check-already.patch +++ b/package/network/utils/iptables/patches/101-remove-check-already.patch @@ -1,6 +1,6 @@ --- a/libxtables/xtables.c +++ b/libxtables/xtables.c -@@ -968,12 +968,6 @@ void xtables_register_match(struct xtabl +@@ -1093,12 +1093,6 @@ void xtables_register_match(struct xtabl struct xtables_match **pos; bool seen_myself = false; @@ -13,7 +13,7 @@ if (me->version == NULL) { fprintf(stderr, "%s: match %s<%u> is missing a version\n", xt_params->program_name, me->name, me->revision); -@@ -1152,12 +1146,6 @@ void xtables_register_target(struct xtab +@@ -1277,12 +1271,6 @@ void xtables_register_target(struct xtab struct xtables_target **pos; bool seen_myself = false; diff --git a/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch index b8e19c781a1..710f481cac8 100644 --- a/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch +++ b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch @@ -1,6 +1,15 @@ --- a/libxtables/xtables.c +++ b/libxtables/xtables.c -@@ -403,6 +403,7 @@ static char *get_modprobe(void) +@@ -476,7 +476,7 @@ char *xtables_strdup(const char *s) + return dup; + } + +-static char *get_modprobe(void) ++__attribute__((unused)) static char *get_modprobe(void) + { + int procfile; + char *ret; +@@ -511,6 +511,7 @@ static char *get_modprobe(void) int xtables_insmod(const char *modname, const char *modprobe, bool quiet) { @@ -8,7 +17,7 @@ char *buf = NULL; char *argv[4]; int status; -@@ -437,6 +438,7 @@ int xtables_insmod(const char *modname, +@@ -545,6 +546,7 @@ int xtables_insmod(const char *modname, free(buf); if (WIFEXITED(status) && WEXITSTATUS(status) == 0) return 0; diff --git a/package/network/utils/iptables/patches/200-configurable_builtin.patch b/package/network/utils/iptables/patches/200-configurable_builtin.patch index 6d7b5b5822c..75c29e1e9ca 100644 --- a/package/network/utils/iptables/patches/200-configurable_builtin.patch +++ b/package/network/utils/iptables/patches/200-configurable_builtin.patch @@ -60,7 +60,7 @@ .SECONDARY: -@@ -161,11 +181,11 @@ libext4.a: initext4.o ${libext4_objs} +@@ -163,11 +183,11 @@ libext4.a: initext4.o ${libext4_objs} libext6.a: initext6.o ${libext6_objs} ${AM_VERBOSE_AR} ${AR} crs $@ $^; diff --git a/package/network/utils/iptables/patches/600-shared-libext.patch b/package/network/utils/iptables/patches/600-shared-libext.patch index 819f628f9ef..838b1ffa660 100644 --- a/package/network/utils/iptables/patches/600-shared-libext.patch +++ b/package/network/utils/iptables/patches/600-shared-libext.patch @@ -18,7 +18,7 @@ -include .*.d -@@ -164,22 +164,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn +@@ -166,22 +166,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn # handling code in the Makefiles. # lib%.o: ${srcdir}/lib%.c diff --git a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch index cc451ef9593..09db3900066 100644 --- a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch +++ b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch @@ -1,6 +1,6 @@ --- a/extensions/libxt_conntrack.c +++ b/extensions/libxt_conntrack.c -@@ -1395,6 +1395,7 @@ static int conntrack3_mt6_xlate(struct x +@@ -1399,6 +1399,7 @@ static int conntrack3_mt6_xlate(struct x } static struct xtables_match conntrack_mt_reg[] = { @@ -8,7 +8,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1470,6 +1471,7 @@ static struct xtables_match conntrack_mt +@@ -1474,6 +1475,7 @@ static struct xtables_match conntrack_mt .alias = conntrack_print_name_alias, .x6_options = conntrack2_mt_opts, }, @@ -16,7 +16,7 @@ { .version = XTABLES_VERSION, .name = "conntrack", -@@ -1502,6 +1504,7 @@ static struct xtables_match conntrack_mt +@@ -1506,6 +1508,7 @@ static struct xtables_match conntrack_mt .x6_options = conntrack3_mt_opts, .xlate = conntrack3_mt6_xlate, }, @@ -24,7 +24,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1532,6 +1535,8 @@ static struct xtables_match conntrack_mt +@@ -1536,6 +1539,8 @@ static struct xtables_match conntrack_mt .x6_parse = state_ct23_parse, .x6_options = state_opts, }, @@ -33,7 +33,7 @@ { .family = NFPROTO_UNSPEC, .name = "state", -@@ -1561,6 +1566,7 @@ static struct xtables_match conntrack_mt +@@ -1565,6 +1570,7 @@ static struct xtables_match conntrack_mt .x6_parse = state_parse, .x6_options = state_opts, }, @@ -77,7 +77,7 @@ void _init(void) --- a/extensions/libxt_multiport.c +++ b/extensions/libxt_multiport.c -@@ -571,6 +571,7 @@ static int multiport_xlate6_v1(struct xt +@@ -591,6 +591,7 @@ static int multiport_xlate6_v1(struct xt } static struct xtables_match multiport_mt_reg[] = { @@ -85,7 +85,7 @@ { .family = NFPROTO_IPV4, .name = "multiport", -@@ -601,6 +602,7 @@ static struct xtables_match multiport_mt +@@ -621,6 +622,7 @@ static struct xtables_match multiport_mt .x6_options = multiport_opts, .xlate = multiport_xlate6, }, |