mtk-20170518/include/netfilter.mk, branch v17.01.5

iptables: Fix target TRACE issue

2018-01-26T07:32:46+00:00

The package kmod-ipt-debug builds the module xt_TRACE, which allows
users to use '-j TRACE' as target in the chain PREROUTING of the table
raw in iptables.

The kernel compilation flag NETFILTER_XT_TARGET_TRACE is also enabled so
that this feature which is implemented deep inside the linux IP stack
(for example in sk_buff) is compiled.

But a strace of iptables -t raw -I PREROUTING -p icmp -j TRACE reveals
that an attempt is made to read /usr/lib/iptables/libxt_TRACE.so, which
fails as this dynamic library is not present on the system.

I created the package iptables-mod-trace which takes care of that, and
target TRACE now works!

https://dev.openwrt.org/ticket/16694
https://dev.openwrt.org/ticket/19661

Signed-off-by: Martin Wetterwald 
[Jo-Philipp Wich: also remove trace extension from builtin extension list
                  and depend on kmod-ipt-raw since its required for rules]
Signed-off-by: Jo-Philipp Wich 
Tested-by: Enrico Mioso

netfilter: add iptables-mod-rpfilter package

2017-12-13T15:23:38+00:00

Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw
-I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to
become full when a packet flood with randomly selected source IP addresses
is received from the lan side.

Signed-off-by: Alin Nastac 
(cherry picked from commit d8748e537f11ab5f2b5e2ed25d94baa5ce353984)

kernel: netfilter: split out iptable_raw into a separate package

2016-12-14T11:13:14+00:00

This will avoid loading it in the default configuration, which reduces
image size a bit, and (more importantly) improves performance by
avoiding some unnecessary netfilter hooks

Signed-off-by: Felix Fietkau

netfilter: drop proprietary xt_id match

2016-12-14T00:05:06+00:00

The xt_id match was used by the firewall3 package to track its own rules but
the approach has been changed to use xt_comment instead now, so we can drop
this nonstandard extension.

Signed-off-by: Jo-Philipp Wich

netfilter: fix file conflicts between kmod-ipt- and kmod-nft- packages

2016-09-30T21:32:05+00:00

The nf_reject_* and nf_nat_masquerade_* modules are moved into the
corresponding kmod-nf- packages. Appropriate dependencies are added to the
kmod-nft- packages.

Signed-off-by: Matthias Schiffer

include/netfilter.mk: fix kmod-ipt-tee build with 4.3/4.4

2015-12-13T18:33:11+00:00

Signed-off-by: Felix Fietkau 

SVN-Revision: 47890

netfilter.mk: fix redirect module locations for 3.19+

2015-06-22T12:27:25+00:00

ntf_redir_ipvX is part of NAT support, so they should be in the
appropriate nft-nat kmods. Since they depend on nf_nat_redirect,
nf_nat_redirect should be part of nf-nat, not ipt-nat.

Fixes nft-core gaining a missing dependency on nf_nat_redirect.ko.

Signed-off-by: Jonas Gorski 

SVN-Revision: 46109

netfilter.mk: remove obsolete ip_nat_ftp related line

2015-04-20T13:36:25+00:00

Signed-off-by: Felix Fietkau 

SVN-Revision: 45516

netfilter.mk: move IRC conntrack/nat helpers to kmod-nf-nathelper-extra

2015-04-20T13:36:02+00:00

Signed-off-by: Felix Fietkau 

SVN-Revision: 45515

kernel: finally remove layer7 filter support

2015-04-13T22:23:14+00:00

it has been non-functional for years and caused numerous memleaks and
crashes for people that tried to enable it.
it has no maintained upstream source, and it does not look like it's
going to be fixed any time soon

Signed-off-by: Felix Fietkau 

SVN-Revision: 45423