aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel/linux/modules/netfilter.mk
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: Add fib support for nftablesBrett Mastbergen2018-12-161-0/+12
| | | | Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com>
* kernel: netfilter: chain filters merged into nf_tables.koHauke Mehrtens2018-12-151-1/+1
| | | | | | | | | | | | | | | | | | In mainline kernel commit 02c7b25e5f5 ("netfilter: nf_tables: build-in filter chain type") all chain filters were merged into one file and into one kernel module to save some memory. The code protected by these configuration options CONFIG_NF_TABLES_BRIDGE, CONFIG_NF_TABLES_IPV4, CONFIG_NF_TABLES_ARP, CONFIG_NF_TABLES_IPV6, CONFIG_NF_TABLES_NETDEV and CONFIG_NF_TABLES_INET was merged into the nft_chain_filter.c file which is now always compiled into the nf_tables.ko file. This only happened in kernel 4.19 and OpenWrt has to select these as modules in older kennel versions. Mark them as build-in in the kernel 4.19 specific kernel configuration file which will then not be overwritten by the package specific settings which try to make them modular again. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: extract asn1_decoder.koHauke Mehrtens2018-12-151-1/+1
| | | | | | | The asn1_decoder.ko module is needed by the kmod-nf-nathelper-extra package in kernel 4.19, extract it and add the missing dependencies. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* kernel: nf-nathelper-extra depends on ipt-rawSteven Honson2018-11-261-1/+1
| | | | | | | | | | | | | | | | The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. As automatic helper assignment is disabled in recent Linux kernels, explicit rules must be added to the raw table for each helper. While commit f50a524 in the firewall3 project added a set of default rules and other additional related functionality, both this and the alternative manual methods of defining these rules require kmod-ipt-raw. Signed-off-by: Steven Honson <steven@honson.id.au>
* kernel: Remove dependencies on old kernelsRosen Penev2018-11-011-1/+1
| | | | | | Kernels 4.1 and 4.4 are not part of the tree anymore. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* netfilter: add missing dependency for kernel 4.14Koen Vandeputte2018-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since kernel 4.14.75 commit ("netfilter: xt_cluster: add dependency on conntrack module") a dependency is required on kmod-nf-conntrack. It seems this was already present for kmod-ipt-clusterip but not yet for kmod-ipt-cluster Add it fixing a build error when including kmod-ipt-cluster: Package kmod-ipt-cluster is missing dependencies for the following libraries: nf_conntrack.ko modules/netfilter.mk:665: recipe for target '/mnt/ramdisk/koen/firmware/builds/openwrt/bin/targets/cns3xxx/generic/packages/kmod-ipt-cluster_4.14.75-1_arm_mpcore_vfp.ipk' failed make[3]: *** [/mnt/ramdisk/koen/firmware/builds/openwrt/bin/targets/cns3xxx/generic/packages/kmod-ipt-cluster_4.14.75-1_arm_mpcore_vfp.ipk] Error 1 make[3]: Leaving directory '/mnt/ramdisk/koen/firmware/builds/openwrt/package/kernel/linux' Command exited with non-zero status 2 time: package/kernel/linux/compile#1.80#0.05#2.07 package/Makefile:107: recipe for target 'package/kernel/linux/compile' failed make[2]: *** [package/kernel/linux/compile] Error 2 make[2]: Leaving directory '/mnt/ramdisk/koen/firmware/builds/openwrt' package/Makefile:103: recipe for target '/mnt/ramdisk/koen/firmware/builds/openwrt/staging_dir/target-arm_mpcore+vfp_musl_eabi/stamp/.package_compile' failed make[1]: *** [/mnt/ramdisk/koen/firmware/builds/openwrt/staging_dir/target-arm_mpcore+vfp_musl_eabi/stamp/.package_compile] Error 2 make[1]: Leaving directory '/mnt/ramdisk/koen/firmware/builds/openwrt' /mnt/ramdisk/koen/firmware/builds/openwrt/include/toplevel.mk:216: recipe for target 'world' failed make: *** [world] Error 2 Fixes: f983956a8b72 ("kernel: bump 4.14 to 4.14.75") Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com> [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.14.75&id=b969656b46626a674232c0eadf92a394b89df07c
* kernel: netfilter: add IPVS kernel module supportMauro Mozzarelli2018-09-241-0/+92
| | | | | | | | | | | | | | | | IPVS (IP Virtual Server) implements transport-layer load balancing inside the Linux kernel, so called Layer-4 switching. IPVS running on a host acts as a load balancer at the front of a cluster of real servers, it can direct requests for TCP/UDP based services to the real servers, and makes services of the real servers to appear as a virtual service on a single IP address. This change adds the following kmod packages - kmod-nf-ipvs - kmod-nf-ipvs-ftp - kmod-nf-ipvs-sip Signed-off-by: Mauro Mozzarelli <mauro@ezplanet.org> Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* Revert "netfilter: separate IPv6 relevant kernel modules from IPv4"Jo-Philipp Wich2018-08-061-58/+5
| | | | | | | | | This reverts commit 42a3c6465a230a4e03f2a185f4db5ac57b89f673. The change was apparently never build-tested with all kmods enabled. I took a brief look but found no simple way to untangle this, so revert it. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter: separate IPv6 relevant kernel modules from IPv4Rosy Song2018-08-061-5/+58
| | | | Signed-off-by: Rosy Song <rosysong@rosinson.com>
* include: add netdev family support for nftablesRosy Song2018-07-301-0/+20
| | | | Signed-off-by: Rosy Song <rosysong@rosinson.com>
* netfilter: add bpf match supportAlin Nastac2018-06-261-0/+1
| | | | | | | | | Add xt_bpf modules to {kmod-ipt,iptables-mod}-filter. Match using Linux Socket Filter. Expects a BPF program in decimal format. This is the format generated by the nfbpf_compile utility. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* base-files: move netfilter sysctl defaults to specific kmod packagesMatthias Schiffer2018-04-131-0/+10
| | | | | | | Avoid warnings when applying settings for uninstalled kmods. See also FS#1073. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* iptables: split physdev match out as a separate packageMatthias Schiffer2018-04-091-2/+16
| | | | | | | Split physdev match out of ipt-extra to allow installing ipt-extra without pulling in br-netfilter. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: kmod-ebtables: do not depend on kmod-br-netfilterMatthias Schiffer2018-04-091-1/+1
| | | | | | | While ebtables can be combined with br-netfilter, there is no good reason to make it a dependency. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: unhide kmod-br-netfilterMatthias Schiffer2018-04-091-1/+0
| | | | | | | kmod-br-netfilter is not only a support module, but can be useful on its own, using the net.bridge.bridge-nf-call-* sysctls. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: change dependency of kmod-ebtables-* on kmod-ebtables to selectingMatthias Schiffer2018-04-091-1/+1
| | | | | | | | Non-selecting dependencies easily lead to Kconfig failures due to recursive dependencies. We hit such an issue in Gluon; the easiest fix is to make the dependency selecting. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: add hardware offload patch for flow tables supportFelix Fietkau2018-04-051-2/+3
| | | | | | Supports offloading through VLAN, bridge and PPPoE devices as well Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: remove nf_flow_table hardware offload patch (it is not ready yet)Felix Fietkau2018-02-251-3/+2
| | | | | | | It also does not have any users yet. It will be addde back when the core API issues have been sorted out Signed-off-by: Felix Fietkau <nbd@nbd.name>
* netfilter: add a xt_FLOWOFFLOAD target for NAT/routing offload supportFelix Fietkau2018-02-211-1/+12
| | | | | | | | | | This makes it possible to add an iptables rule that offloads routing/NAT packet processing to a software fast path. This fast path is much quicker than running packets through the regular tables/chains. Requires Linux 4.14 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* kernel: backport netfilter NAT offload support to 4.14Felix Fietkau2018-02-211-0/+37
| | | | | | | | | This only works with nftables for now, iptables support will be added later. Includes a number of related upstream nftables improvements to simplify backporting follow-up changes Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iptables: Support building connlabel moduleKristian Evensen2018-02-131-0/+15
| | | | | | | | | | It is currently possible to enable connlabel-support in iptables. However, in order for connlabel to work properly, the kernel module must also be present. This patch adds support for building the connlabel-module, and selects it by default when connlabel-support is enabled. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
* netfilter: add missing dependency to kmod-ipt-tproxyMatthias Schiffer2018-01-311-1/+1
| | | | | Fixes: e7e025426a "netfilter: clean up dependencies of kernel modules" Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* netfilter: add packages for arp and bridge tables of nftablesMatthias Schiffer2018-01-311-2/+26
| | | | Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* netfilter: clean up dependencies of kernel modulesMatthias Schiffer2018-01-311-15/+38
| | | | | | | | | The nf_reject_ipv4 and nf_reject_ipv6 modules are moved into separate packages, as they are a common dependency of ip(6)tables and nftables. This avoids a dependency of nftables on kmod-nf-ipt(6). Also, fewer iptables modules depend on nf-conntrack(6) now. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* iptables: make kmod-ipt-debug part of default ALL buildYousong Zhou2018-01-261-2/+1
| | | | | | | | | The iptables TRACE target is only available in raw table that's why the dependency was moved from iptables-mod-trace into kmod-ipt-debug Fixes FS#1219 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* netfilter: enable CONFIG_NF_CONNTRACK_MARK from kmod-nf-conntrackJo-Philipp Wich2018-01-161-0/+1
| | | | | | | | Unconditionally enable connmark support and tie it to the conntrack core module to allow removing this kernel configuration dependency from the xtables-addons package. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* netfilter, iptables: add optional CHECKSUM moduleDenis Osvald2017-11-061-0/+17
| | | | Signed-off-by: Denis Osvald <denis.osvald@sartura.hr>
* kernel: netfilter: fix nf-nathelper(-extra) descriptionUwe Arnold2017-07-251-2/+2
| | | | | | | | | The tftp and irc netfilter modules are provided by nf-nathelper-extra and not by nf-nathelper. Signed-off-by: Uwe Arnold <donvipre@gmail.com> [move the irc module as well] Signed-off-by: Mathias Kresin <dev@kresin.me>
* netfilter: add iptables-mod-rpfilter packageAlin Nastac2017-07-111-0/+18
| | | | | | | | | Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* kernel: remove kmod packages for bridge, stp, llc and 8021qFelix Fietkau2017-02-091-2/+2
| | | | | | | Remove CONFIG_VLAN_8021Q overrides for two targets These features are built into the kernel image for all targets Signed-off-by: Felix Fietkau <nbd@nbd.name>
* netfilter: re-enable TEE support for kernel 4.4Koen Vandeputte2017-01-271-1/+1
| | | | | | | | | It got disabled in commit 4454a3fb6375cf1adf17f63a54cd7660bc40caa7 but works nicely these days. Tested on cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
* kernel: netfilter: split out iptable_raw into a separate packageFelix Fietkau2016-12-141-0/+22
| | | | | | | | This will avoid loading it in the default configuration, which reduces image size a bit, and (more importantly) improves performance by avoiding some unnecessary netfilter hooks Signed-off-by: Felix Fietkau <nbd@nbd.name>
* netfilter: remove nf_tproxy_core referencesMathias Kresin2016-10-111-2/+1
| | | | | | | | | | nf_tproxy_core was removed during 3.12 development with kernel commit fd158d79d33d3c8b693e3e2d8c0e3068d529c2dc. The code was moved to xt_TPROXY.c. Fixes FS#212 Signed-off-by: Mathias Kresin <dev@kresin.me>
* netfilter: fix file conflicts between kmod-ipt- and kmod-nft- packagesMatthias Schiffer2016-09-301-2/+2
| | | | | | | | The nf_reject_* and nf_nat_masquerade_* modules are moved into the corresponding kmod-nf- packages. Appropriate dependencies are added to the kmod-nft- packages. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: remove duplicate br-netfilter file and Kconfig symbol from kmod-ebtablesMatthias Schiffer2016-09-241-5/+2
| | | | | | | br_netfilter.ko and the corresponding Kconfig symbol are already provided by kmod-br-netfilter, which is a dependency of kmod-ebtables. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* kernel: modularize bridge netfilter support a bit further to get rid of some ↵Felix Fietkau2016-08-031-4/+19
| | | | | | kernel bloat Signed-off-by: Felix Fietkau <nbd@nbd.name>
* conntrack: enable support for netfilter conntrack zonesAlin Năstac2016-05-241-0/+1
| | | | | | | Storage of such zones is provided by a nf_ct_ext struct, hence conntrack memory foot print will not be increased if zones are not used. Signed-off-by: Alin Năstac <alin.nastac@gmail.com>
* Revert "kernel: Linux IP Virtual Server kernel modules (netfilter.mk patch)"Jo-Philipp Wich2016-03-111-54/+0
| | | | | | This reverts commit 845d82da156781135b027ecf75ff67e2253e06dd. SVN-Revision: 49005
* kernel: Linux IP Virtual Server kernel modules (netfilter.mk patch)John Crispin2016-03-101-0/+54
| | | | | | | | | | | | IPVS (IP Virtual Server) implements transport-layer load balancing inside the Linux kernel so called Layer-4 switching. IPVS running on a host acts as a load balancer at the front of a cluster of real servers, it can direct requests for TCP/UDP based services to the real servers, and makes services of the real servers to appear as a virtual service on a single IP address. Signed-off-by: Mauro Mozzarelli <mauro@ezplanet.net> SVN-Revision: 48982
* package: kernel: update dependencies for 4.4Jonas Gorski2015-12-021-1/+1
| | | | | | | | | Update dependencies for linux 4.4 and mark as broken where source code needs updating. Signed-off-by: Jonas Gorski <jogo@openwrt.org> SVN-Revision: 47700
* package: Remove dependencies to kmod-ipv6Steven Barth2015-09-211-3/+3
| | | | | | | | | Since r46834, IPv6 support is builtin if selected. Therefor, dependencies on kmod-ipv6 can no longer be fulfilled, since it is not a module anymore. Signed-off-by: Arjen de Korte <arjen+openwrt@de-korte.org> SVN-Revision: 47022
* nf-conntrack: enable netlink eventsSteven Barth2015-07-021-1/+1
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46160
* package/kernel: remove reference to 3.12 kernel versionNicolas Thill2015-05-241-1/+0
| | | | | | Signed-off-by: Nicolas Thill <nico@openwrt.org> SVN-Revision: 45742
* kernel: finally remove layer7 filter supportFelix Fietkau2015-04-131-1/+0
| | | | | | | | | | | it has been non-functional for years and caused numerous memleaks and crashes for people that tried to enable it. it has no maintained upstream source, and it does not look like it's going to be fixed any time soon Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45423
* kernel: remove kernel module checks/dependencies for 3.14Felix Fietkau2015-04-111-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45377
* kernel: fix ipset related build error (#19231)Felix Fietkau2015-03-201-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 44912
* netfilter: clean up compatibility code for old kernelsFelix Fietkau2015-03-201-17/+0
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 44904
* kernel: remove obsolete kernel version dependenciesFelix Fietkau2015-03-191-1/+0
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 44892
* ipset: use in-tree kernel modules to fix crash issuesFelix Fietkau2015-03-191-0/+48
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 44883
* netfilter: Enable compiling iptables match clusterFelix Fietkau2014-11-031-0/+48
| | | | | | | | | | | | | | | | | | This patch adds the userspace and kernelspace for - match NETFILTER_XT_MATCH_CLUSTER This match can be used to deploy gateway and back-end load-sharing clusters. - target IP_NF_TARGET_CLUSTERIP This module allows you to configure a simple cluster of nodes that share a certain IP and MAC address without an explicit load balancer in front of them. Connections are statically distributed between the nodes in this cluster. This is used i.e. by strongswan-ha. Signed-off-by: Christian Scheele <cs@embedd.com> SVN-Revision: 43174
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 21:48:34 +0000