aboutsummaryrefslogtreecommitdiffstats
path: root/include/netfilter.mk
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: remove no-op kconfig symbolsRui Salvaterra2021-05-011-6/+0
| | | | | | | | | | | | | | These have long been obsolete. For reference, here's the Linux version where each symbol has been dropped: CONFIG_IP6_NF_QUEUE - 3.5 CONFIG_IP6_NF_TARGET_LOG - 3.4 CONFIG_IP_NF_MATCH_DSCP - 2.6.19 CONFIG_NF_CONNTRACK_IPV4 - 4.19 CONFIG_NF_CONNTRACK_IPV6 - 4.19 CONFIG_NF_CONNTRACK_RTCACHE - out-of-tree, superseded by flow offloading Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* x86/64: Iptables seems to lack support for cgroup v2Supriya Mane2021-03-191-0/+1
| | | | | | | | FS#3574 Adding cgroup support enables adding rules on processes to limit resources in terms of iptable policies Signed-off-by: Supriya Mane <sm.supriya@globaledgesoft.com>
* build: use SPDX license tagsPaul Spooren2021-02-051-5/+2
| | | | | | | | | The license folder is a core part of OpenWrt and all GPL-2.0 licensed. Use SPDX license tags to allow machines to check licenses. Signed-off-by: Paul Spooren <mail@aparcar.org> [rebase, keep some Copyright lines, sharpen commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* netfilter: Add queue support for nftablesBrett Mastbergen2020-11-121-0/+1
| | | | | | | | | This change adds the configuration option to build and include the nft_queue kernel module, which allows traffic to be queued up to userspace from an nftables rule Tested-by: Sébastien Delafond sdelafond@gmail.com Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
* kernel: remove obsolete kernel version switches for 4.19Adrian Schmutzler2020-10-301-13/+2
| | | | | | | This removes switches dependent on kernel version 4.19 as well as several packages/modules selected only for that version. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* Revert "kmod-nft-reject: Fix for "nft_reject_ipv4.ko missing" warning"Daniel Golle2020-10-301-1/+1
| | | | | | | | | This reverts commit 7f94e2afcf090f751c9f7f7ea46e8ef8d93ee84b. Package kmod-nft-core is missing dependencies for the following libraries: nft_reject.ko Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* kmod-nft-reject: Fix for "nft_reject_ipv4.ko missing" warningPhilip Prindeville2020-10-301-1/+1
| | | | | | | | | | Seeing the following: ERROR: module '/home/philipp/lede/build_dir/target-x86_64_musl/linux-x86_64/linux-5.4.33/net/ipv4/netfilter/nft_reject_ipv4.ko' is missing. modules/netfilter.mk:1068: recipe for target '/home/philipp/lede/bin/targets/x86/64/packages/kmod-nft-core_5.4.33-1_x86_64.ipk' failed make[3]: *** [/home/philipp/lede/bin/targets/x86/64/packages/kmod-nft-core_5.4.33-1_x86_64.ipk] Error 1 Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* netfilter.mk: remove now obsolete kmod nf_nat_redirectYousong Zhou2020-10-241-1/+0
| | | | | | Now that the minimal kernel version maintained here is 4.19 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: add version conditional around nf_nat_redirect modYousong Zhou2020-10-241-1/+1
| | | | | | | | | | | | | | | | | | | Kernel commit 1ac89d20150e ("netfilter: nat: merge nf_nat_redirect into nf_nat") made the redirect module part of the nat core and changed the CONFIG_NF_NAT_REDIRECT option to a boolean, without prompt, affecting kernel 4.18 onwards. CONFIG_NF_NAT_REDIRECT now can only be selected by CONFIG_NFT_REDIR or NETFILTER_XT_TARGET_REDIRECT Fixes: FS#2476 Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2476 Fixes: FS#2990 (partial) Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2990 Signed-off-by: Tony Ambardar <itugrok@yahoo.com> [note that the option has no prompt and can only be selected by other kconfig options] Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: add version conditional around CONFIG_NF_NAT_PROTO_GREYousong Zhou2020-10-241-1/+1
| | | | | | | It was removed in upstream linux commit faec18db ("netfilter: nat: remove l4proto->manip_pkt"). This happened since linux 5.0 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: add version conditional for CONFIG_NF_CT_PROTO_GRETony Ambardar2020-10-241-1/+1
| | | | | | | | | | | | | | | | | Kernel commit 22fc4c4c9fd6 ("netfilter: conntrack: gre: switch module to be built-in") moved the CT GRE code into the core nf_conntrack.ko module and changed the CONFIG_NF_CT_PROTO_GRE option to boolean for kernel 5.1 and onwards. CONFIG_NF_CT_PROTO_GRE at the moment has no prompt and can only be selected by NF_CONNTRACK_PPTP Fixes: FS#2990 (partial) Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2990 Signed-off-by: Tony Ambardar <itugrok@yahoo.com> [note that the option now can not be enabled on its own] Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: add version conditional for nf_nat_ipv4,6Yousong Zhou2020-10-241-2/+2
| | | | | | | The upstream linux commit is 3bf195ae ("netfilter: nat: merge nf_nat_ipv4,6 into nat core"). It was included since linux 5.1 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: use CONFIG_NETFILTER_XT_TARGET_REDIRECTYousong Zhou2020-10-241-1/+1
| | | | | | | | CONFIG_IP_NF_TARGET_REDIRECT is a compat option since upstream commit 2cbc78a2 ("netfilter: combine ipt_REDIRECT and ip6t_REDIRECT"). That happened since linux 3.10 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter.mk: use CONFIG_NETFILTER_XT_TARGET_MASQUERADEYousong Zhou2020-10-241-1/+1
| | | | | | | | | | | CONFIG_IP_NF_TARGET_MASQUERADE and its counterpart CONFIG_IP6_NF_TARGET_MASQUERADE are "backwards-compat option for the user's convenience" Related commit d22c1755 ("netfilter: fix NAT packaging with kernels 5.2+") Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter: ship nft_chain_nat on 5.1+ kernelsJo-Philipp Wich2020-10-021-5/+6
| | | | | | | | | | | | | | The former nft_chain_nat_ipv4 and nft_chain_nat_ipv6 modules have been merged into a common nft_chain_nat module starting with Linux 5.1. Ensure that this common module is shipped along with kmod-nft-nat on recent kernels. While we're at it, also apply version constraints to other nft modules that have been merged into the core with newer kernels. Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2815#comment8016 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* kernel: remove obsolete kernel version switches for 4.14Adrian Schmutzler2020-09-021-16/+4
| | | | | | | | | | This removes switches dependent on kernel version 4.14 as well as several packages/modules selected only for that version. This also removes sched-cake-virtual, which is not required anymore now that we have only one variant of cake. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* kernel: netfilter.mk: fix kmod-ipt-nat6 installation on 5.4DENG Qingfang2020-04-201-1/+0
| | | | | | | | | | xt_MASQUERADE.ko is picked up by both kmod-ipt-nat and kmod-ipt-nat6, causing conflict As kmod-ipt-nat6 already depends on kmod-ipt-nat, remove xt_MASQUERADE from it Fixes: FS#2924 Fixes: 0fad8af85158 ("kernel: Include xt_MASQUERADE for kernel 5.2 and later") Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn>
* kernel: Include xt_MASQUERADE for kernel 5.2 and laterKoen Vandeputte2020-02-281-1/+2
| | | | | | Instead of ip6t_MASQUERADE, include xt_MASQUERADE on kernel >= 5.2. Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* netfilter: package required kmods for nftablesJo-Philipp Wich2020-01-141-13/+15
| | | | | | | | | | | | | Package new kmods "nf_tables_set" and "nft_objref" which got introduced with kernel 4.18 and restrict the old "nft_set_rbtree" and "nft_set_hash" modules to sub-4.18 versions. Also reorder the nftables related netfilter.mk entries alphabetically while touching this code section. Fixes: FS#2699 Ref: https://bugs.openwrt.org/index.php?do=details&task_id=2699#comment7450 Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter: add back nft_hashDavid Bauer2020-01-121-0/+1
| | | | | | | | | | | nft_hash hash falsely removed in commit 97940f876616 ("kernel: remove obsolete kernel version switches"). Add the module back, as otherwise the build fails. Fixes: 97940f876616 ("kernel: remove obsolete kernel version switches") Signed-off-by: David Bauer <mail@david-bauer.net>
* kernel: remove obsolete kernel version switchesAdrian Schmutzler2020-01-121-14/+12
| | | | | | | | | After kernel 4.9 has been removed, this removes all (now obsolete) kernel version switches that deal with versions before 4.14. Package kmod-crypto-iv is empty now and thus removed entirely. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* netfilter: fix NAT packaging with kernels 5.2+Rafał Miłecki2019-10-281-1/+2
| | | | | | | It's related to the upstream kernel commit adf82accc5f5 ("netfilter: x_tables: merge ip and ipv6 masquerade modules"). Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* netfilter: Add fib support for nftablesBrett Mastbergen2018-12-161-0/+5
| | | | Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
* kernel: netfilter: chain filters merged into nf_tables.koHauke Mehrtens2018-12-151-5/+5
| | | | | | | | | | | | | | | | | | In mainline kernel commit 02c7b25e5f5 ("netfilter: nf_tables: build-in filter chain type") all chain filters were merged into one file and into one kernel module to save some memory. The code protected by these configuration options CONFIG_NF_TABLES_BRIDGE, CONFIG_NF_TABLES_IPV4, CONFIG_NF_TABLES_ARP, CONFIG_NF_TABLES_IPV6, CONFIG_NF_TABLES_NETDEV and CONFIG_NF_TABLES_INET was merged into the nft_chain_filter.c file which is now always compiled into the nf_tables.ko file. This only happened in kernel 4.19 and OpenWrt has to select these as modules in older kennel versions. Mark them as build-in in the kernel 4.19 specific kernel configuration file which will then not be overwritten by the package specific settings which try to make them modular again. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: netfilter: Adapt merge ipv4/ipv6 masquerade codeHauke Mehrtens2018-12-151-2/+2
| | | | | | | | | | | | | | | | In kernel commit 0168e8b361 ("netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module") the CONFIG_NF_NAT_MASQUERADE_IPV4 and CONFIG_NF_NAT_MASQUERADE_IPV6 kernel configuration option were changed to bool and the code will not be compiled as a own module any more, but it will be integrated into nf_nat_ipv4.ko or nf_nat_ipv6.ko to save some memory. Activate these options as bool in the generic kernel 4.19 configuration only, to always build them into the nf_nat_ipv*.ko modules. The kmod file will still try to select them as module, but the generic configuration will not be overwritten. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: netfilter: Add nf_conncount.koHauke Mehrtens2018-12-151-0/+1
| | | | | | | Some kernel modules from kmod-ipt-conntrack-extra depend on nf_conncount.ko, which was added in kernel 4.16, add it to the kmod. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: netfilter: Add nf_tproxy_ipv{4,6} and nf_socket_ipv{4,6}Hauke Mehrtens2018-12-151-0/+4
| | | | | | | | | | The nf_socket.ko module was split in commit 8db4c5be88f ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c") into a common, n IPv4 and an IPv6 part. The nf_tproxy.ko module was split in commit 45ca4e0cf27 ("netfilter: Libify xt_TPROXY") into a common, an IPv4 and an IPv6 part. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: netfilter: Add nf_defrag_ipv6.ko to NF_CONNTRACK on 4.19Hauke Mehrtens2018-12-151-1/+2
| | | | | | | | | | | In kernel commit a0ae2562c6c ("netfilter: conntrack: remove l3proto abstraction") The modules nf_conntrack_ipv4.ko, nf_conntrack_ipv6.ko and nf_conntrack.ko were squashed together into one module. This module now depends on nf_defrag_ipv6 when IPv6 support was activated. This is part of the main netfilter packages, so add nf_defrag_ipv6.ko also to the default netfilter packages on kernel 4.19 and later. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* Revert "netfilter: separate IPv6 relevant kernel modules from IPv4"Jo-Philipp Wich2018-08-061-9/+5
| | | | | | | | | This reverts commit 42a3c6465a230a4e03f2a185f4db5ac57b89f673. The change was apparently never build-tested with all kmods enabled. I took a brief look but found no simple way to untangle this, so revert it. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter: separate IPv6 relevant kernel modules from IPv4Rosy Song2018-08-061-5/+9
| | | | Signed-off-by: Rosy Song <rosysong@rosinson.com>
* netfilter: add bpf match supportAlin Nastac2018-06-261-0/+1
| | | | | | | | | Add xt_bpf modules to {kmod-ipt,iptables-mod}-filter. Match using Linux Socket Filter. Expects a BPF program in decimal format. This is the format generated by the nfbpf_compile utility. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* iptables: split physdev match out as a separate packageMatthias Schiffer2018-04-091-1/+4
| | | | | | | Split physdev match out of ipt-extra to allow installing ipt-extra without pulling in br-netfilter. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* netfilter: add a xt_FLOWOFFLOAD target for NAT/routing offload supportFelix Fietkau2018-02-211-0/+3
| | | | | | | | | | This makes it possible to add an iptables rule that offloads routing/NAT packet processing to a software fast path. This fast path is much quicker than running packets through the regular tables/chains. Requires Linux 4.14 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iptables: Support building connlabel moduleKristian Evensen2018-02-131-0/+4
| | | | | | | | | | It is currently possible to enable connlabel-support in iptables. However, in order for connlabel to work properly, the kernel module must also be present. This patch adds support for building the connlabel-module, and selects it by default when connlabel-support is enabled. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
* netfilter: add packages for arp and bridge tables of nftablesMatthias Schiffer2018-01-311-2/+10
| | | | Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* netfilter: clean up dependencies of kernel modulesMatthias Schiffer2018-01-311-3/+5
| | | | | | | | | The nf_reject_ipv4 and nf_reject_ipv6 modules are moved into separate packages, as they are a common dependency of ip(6)tables and nftables. This avoids a dependency of nftables on kmod-nf-ipt(6). Also, fewer iptables modules depend on nf-conntrack(6) now. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* netfilter, iptables: add optional CHECKSUM moduleDenis Osvald2017-11-061-0/+4
| | | | Signed-off-by: Denis Osvald <denis.osvald@sartura.hr>
* iptables: Fix target TRACE issueMartin Wetterwald2017-10-271-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | The package kmod-ipt-debug builds the module xt_TRACE, which allows users to use '-j TRACE' as target in the chain PREROUTING of the table raw in iptables. The kernel compilation flag NETFILTER_XT_TARGET_TRACE is also enabled so that this feature which is implemented deep inside the linux IP stack (for example in sk_buff) is compiled. But a strace of iptables -t raw -I PREROUTING -p icmp -j TRACE reveals that an attempt is made to read /usr/lib/iptables/libxt_TRACE.so, which fails as this dynamic library is not present on the system. I created the package iptables-mod-trace which takes care of that, and target TRACE now works! https://dev.openwrt.org/ticket/16694 https://dev.openwrt.org/ticket/19661 Signed-off-by: Martin Wetterwald <martin.wetterwald@corp.ovh.com> [Jo-Philipp Wich: also remove trace extension from builtin extension list and depend on kmod-ipt-raw since its required for rules] Signed-off-by: Jo-Philipp Wich <jo@mein.io> Tested-by: Enrico Mioso <mrkiko.rs@gmail.com>
* netfilter: add iptables-mod-rpfilter packageAlin Nastac2017-07-111-0/+2
| | | | | | | | | Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* netfilter.mk: prepare for linux 4.9 supportFelix Fietkau2017-01-271-2/+6
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: netfilter: split out iptable_raw into a separate packageFelix Fietkau2016-12-141-2/+0
| | | | | | | | This will avoid loading it in the default configuration, which reduces image size a bit, and (more importantly) improves performance by avoiding some unnecessary netfilter hooks Signed-off-by: Felix Fietkau <nbd@nbd.name>
* netfilter: drop proprietary xt_id matchJo-Philipp Wich2016-12-141-2/+1
| | | | | | | | The xt_id match was used by the firewall3 package to track its own rules but the approach has been changed to use xt_comment instead now, so we can drop this nonstandard extension. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter: fix file conflicts between kmod-ipt- and kmod-nft- packagesMatthias Schiffer2016-09-301-8/+5
| | | | | | | | The nf_reject_* and nf_nat_masquerade_* modules are moved into the corresponding kmod-nf- packages. Appropriate dependencies are added to the kmod-nft- packages. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* include/netfilter.mk: fix kmod-ipt-tee build with 4.3/4.4Felix Fietkau2015-12-131-0/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 47890
* netfilter.mk: fix redirect module locations for 3.19+Jonas Gorski2015-06-221-3/+3
| | | | | | | | | | | | ntf_redir_ipvX is part of NAT support, so they should be in the appropriate nft-nat kmods. Since they depend on nf_nat_redirect, nf_nat_redirect should be part of nf-nat, not ipt-nat. Fixes nft-core gaining a missing dependency on nf_nat_redirect.ko. Signed-off-by: Jonas Gorski <jogo@openwrt.org> SVN-Revision: 46109
* netfilter.mk: remove obsolete ip_nat_ftp related lineFelix Fietkau2015-04-201-1/+0
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45516
* netfilter.mk: move IRC conntrack/nat helpers to kmod-nf-nathelper-extraFelix Fietkau2015-04-201-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45515
* kernel: finally remove layer7 filter supportFelix Fietkau2015-04-131-1/+0
| | | | | | | | | | | it has been non-functional for years and caused numerous memleaks and crashes for people that tried to enable it. it has no maintained upstream source, and it does not look like it's going to be fixed any time soon Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45423
* netfilter.mk: remove bogus NAT related kernel module entries (#19451)Felix Fietkau2015-04-111-3/+0
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45382
* netfilter.mk: drop obsolete kernel version dependenciesFelix Fietkau2015-04-111-36/+36
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45381
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-11 04:50:52 +0000