mtk-20170518/package/network/utils/iptables, branch v17.01.5 MTK 20170518 : Mediatek SDK based on OpenWRT Barrier Breaker iptables: make kmod-ipt-debug part of default ALL build 2018-01-26T07:37:28+00:00 Yousong Zhou yszhou4tech@gmail.com 2018-01-26T06:40:25+00:00 fbeae9d891e7661cfb9f9d5209f9656234466127 The iptables TRACE target is only available in raw table that's why the dependency was moved from iptables-mod-trace into kmod-ipt-debug Fixes FS#1219 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> 
The iptables TRACE target is only available in raw table that's why the
dependency was moved from iptables-mod-trace into kmod-ipt-debug

Fixes FS#1219

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
iptables: Fix target TRACE issue 2018-01-26T07:32:46+00:00 Martin Wetterwald martin.wetterwald@corp.ovh.com 2017-01-12T14:06:00+00:00 6ea9a702c5b6ff0866ae93241d6b2bdd80ead5e4 The package kmod-ipt-debug builds the module xt_TRACE, which allows users to use '-j TRACE' as target in the chain PREROUTING of the table raw in iptables. The kernel compilation flag NETFILTER_XT_TARGET_TRACE is also enabled so that this feature which is implemented deep inside the linux IP stack (for example in sk_buff) is compiled. But a strace of iptables -t raw -I PREROUTING -p icmp -j TRACE reveals that an attempt is made to read /usr/lib/iptables/libxt_TRACE.so, which fails as this dynamic library is not present on the system. I created the package iptables-mod-trace which takes care of that, and target TRACE now works! https://dev.openwrt.org/ticket/16694 https://dev.openwrt.org/ticket/19661 Signed-off-by: Martin Wetterwald <martin.wetterwald@corp.ovh.com> [Jo-Philipp Wich: also remove trace extension from builtin extension list and depend on kmod-ipt-raw since its required for rules] Signed-off-by: Jo-Philipp Wich <jo@mein.io> Tested-by: Enrico Mioso <mrkiko.rs@gmail.com> 
The package kmod-ipt-debug builds the module xt_TRACE, which allows
users to use '-j TRACE' as target in the chain PREROUTING of the table
raw in iptables.

The kernel compilation flag NETFILTER_XT_TARGET_TRACE is also enabled so
that this feature which is implemented deep inside the linux IP stack
(for example in sk_buff) is compiled.

But a strace of iptables -t raw -I PREROUTING -p icmp -j TRACE reveals
that an attempt is made to read /usr/lib/iptables/libxt_TRACE.so, which
fails as this dynamic library is not present on the system.

I created the package iptables-mod-trace which takes care of that, and
target TRACE now works!

https://dev.openwrt.org/ticket/16694
https://dev.openwrt.org/ticket/19661

Signed-off-by: Martin Wetterwald <martin.wetterwald@corp.ovh.com>
[Jo-Philipp Wich: also remove trace extension from builtin extension list
                  and depend on kmod-ipt-raw since its required for rules]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Tested-by: Enrico Mioso <mrkiko.rs@gmail.com>
Revert "iptables: fix nftables compile issue (FS#711)" 2018-01-02T09:05:55+00:00 Hans Dedecker dedeckeh@gmail.com 2018-01-02T09:04:59+00:00 04265964530cca55203282d871338f8cc71c7925 This reverts commit da126d557c6d1cfe19d3f93481af6e00631d7931 as the iptables patch does not apply cleanly. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> 
This reverts commit da126d557c6d1cfe19d3f93481af6e00631d7931 as the iptables patch does not apply cleanly.

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
iptables: fix nftables compile issue (FS#711) 2018-01-02T07:00:37+00:00 rektide de la faye rektide@voodoowarez.com 2017-12-14T06:29:11+00:00 da126d557c6d1cfe19d3f93481af6e00631d7931 Enabling IPTABLES_NFTABLES resulted in an error during build:# *** No rule to make target '../extensions/libext.a', needed by 'xtables-compat-multi'." Comments from Alexander Lochmann and Fedor Konstantinov in FS#711 provided fixes for this build error, allowing iptables to compile. https://bugs.lede-project.org/index.php?do=details&task_id=711. This commit updates the Makefile.am xtables_compat_multi_LDFLAGS and _LDADD, moving linking of extensions to LDFLAGS. Signed-off-by: rektide de la faye <rektide@voodoowarez.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> 
Enabling IPTABLES_NFTABLES resulted in an error during build:#
*** No rule to make target '../extensions/libext.a',
needed by 'xtables-compat-multi'."

Comments from Alexander Lochmann and Fedor Konstantinov in FS#711
provided fixes for this build error, allowing iptables to compile.
https://bugs.lede-project.org/index.php?do=details&task_id=711.

This commit updates the Makefile.am xtables_compat_multi_LDFLAGS
and _LDADD, moving linking of extensions to LDFLAGS.

Signed-off-by: rektide de la faye <rektide@voodoowarez.com>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
netfilter: add iptables-mod-rpfilter package 2017-12-13T15:23:38+00:00 Alin Nastac alin.nastac@gmail.com 2017-06-16T12:16:07+00:00 c86490605c5511e88093d3584dc9a277afcb9d6d Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com> (cherry picked from commit d8748e537f11ab5f2b5e2ed25d94baa5ce353984) 
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw
-I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to
become full when a packet flood with randomly selected source IP addresses
is received from the lan side.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
(cherry picked from commit d8748e537f11ab5f2b5e2ed25d94baa5ce353984)
build: use mkhash to replace various quirky md5sum/openssl calls 2017-01-05T10:09:12+00:00 Felix Fietkau nbd@nbd.name 2016-12-25T15:40:05+00:00 84bd74057f0d2543ddbc7de2351b0a310df329c6 Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Signed-off-by: Felix Fietkau <nbd@nbd.name>
treewide: clean up download hashes 2016-12-16T21:39:22+00:00 Felix Fietkau nbd@nbd.name 2016-12-16T16:32:10+00:00 720b99215da295a2e7b4acdef30b58bec6acedc2 Replace *MD5SUM with *HASH, replace MD5 hashes with SHA256 Signed-off-by: Felix Fietkau <nbd@nbd.name> 
Replace *MD5SUM with *HASH, replace MD5 hashes with SHA256

Signed-off-by: Felix Fietkau <nbd@nbd.name>
netfilter: drop proprietary xt_id match 2016-12-14T00:05:06+00:00 Jo-Philipp Wich jo@mein.io 2016-12-13T23:36:28+00:00 e2f8d200f598c67534c6292d732f7927b3609473 The xt_id match was used by the firewall3 package to track its own rules but the approach has been changed to use xt_comment instead now, so we can drop this nonstandard extension. Signed-off-by: Jo-Philipp Wich <jo@mein.io> 
The xt_id match was used by the firewall3 package to track its own rules but
the approach has been changed to use xt_comment instead now, so we can drop
this nonstandard extension.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
iptables: using external kernel tree should not alter patch behaviour. 2016-02-07T13:29:27+00:00 Felix Fietkau nbd@openwrt.org 2016-02-07T13:29:27+00:00 3f1c0c8ef750985b412ace33593b80d7ac4648b2 iptables is the only exception in the package tree, causing patch behaviour to be inconsistent on this package. Signed-off-by: Rick van der Zwet <rick.vanderzwet@anywi.com> SVN-Revision: 48643 
iptables is the only exception in the package tree, causing patch
behaviour to be inconsistent on this package.

Signed-off-by: Rick van der Zwet <rick.vanderzwet@anywi.com>

SVN-Revision: 48643
iptables: improve iptables listing output of xt_id match 2016-01-24T18:01:40+00:00 Jo-Philipp Wich jow@openwrt.org 2016-01-24T18:01:40+00:00 eda1ea9eaab82c4037b6f30cb0eafdcf038fcd47 Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48478 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 48478