Commit Graph

128 Commits

Author SHA1 Message Date
Felix Fietkau
c0f4c9e0d8 include/netfilter.mk: fix kmod-ipt-tee build with 4.3/4.4
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 47890
2015-12-13 18:33:11 +00:00
Jonas Gorski
e9650d4557 netfilter.mk: fix redirect module locations for 3.19+
ntf_redir_ipvX is part of NAT support, so they should be in the
appropriate nft-nat kmods. Since they depend on nf_nat_redirect,
nf_nat_redirect should be part of nf-nat, not ipt-nat.

Fixes nft-core gaining a missing dependency on nf_nat_redirect.ko.

Signed-off-by: Jonas Gorski <jogo@openwrt.org>

SVN-Revision: 46109
2015-06-22 12:27:25 +00:00
Felix Fietkau
3edc273a33 netfilter.mk: remove obsolete ip_nat_ftp related line
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45516
2015-04-20 13:36:25 +00:00
Felix Fietkau
391387eb69 netfilter.mk: move IRC conntrack/nat helpers to kmod-nf-nathelper-extra
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45515
2015-04-20 13:36:02 +00:00
Felix Fietkau
d0ba3bb1e2 kernel: finally remove layer7 filter support
it has been non-functional for years and caused numerous memleaks and
crashes for people that tried to enable it.
it has no maintained upstream source, and it does not look like it's
going to be fixed any time soon

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45423
2015-04-13 22:23:14 +00:00
Felix Fietkau
54a7ce626d netfilter.mk: remove bogus NAT related kernel module entries (#19451)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45382
2015-04-11 12:22:39 +00:00
Felix Fietkau
da7ef81ad4 netfilter.mk: drop obsolete kernel version dependencies
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45381
2015-04-11 12:22:28 +00:00
Luka Perkov
7002f6326e include: remove trailing whitespaces
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 45127
2015-03-29 07:29:18 +00:00
Felix Fietkau
c901f4fcbb netfilter: add missing module/symbol
ipv4 symbol was added but ipv6 symbol is missing

Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>

SVN-Revision: 45122
2015-03-29 05:16:13 +00:00
Felix Fietkau
46efd56b40 netfilter: clean up compatibility code for old kernels
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 44904
2015-03-20 11:01:26 +00:00
John Crispin
f26a59aa13 netfilter: fix nf_nat_redirect dependencies for 3.19 and 4.0
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>

SVN-Revision: 44598
2015-03-05 20:24:22 +00:00
Jo-Philipp Wich
b2f666d098 include: netfilter: fix packaging of LOG target for Linux >= 3.16 (#19031)
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 44488
2015-02-18 13:28:28 +00:00
Jo-Philipp Wich
634e9fe920 netfilter: add missing symbols and modules for Linux 3.18+
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 44187
2015-01-29 10:22:17 +00:00
Imre Kaloz
d26694243a generic: add preliminary 3.19 support
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>

SVN-Revision: 44126
2015-01-25 15:20:39 +00:00
Imre Kaloz
3a9e3dfa95 netfilter: handle NFT_MASQ_IPV6
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>

SVN-Revision: 43966
2015-01-14 08:53:11 +00:00
Imre Kaloz
c3c00c4286 netfilter: handle nft_masq and nft_masq_ipv4
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>

SVN-Revision: 43950
2015-01-12 20:16:36 +00:00
Felix Fietkau
27f36718d3 kernel: add a patch to make netfilter conntrack cache routing information
Significantly improves routing / NAT performance

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 43587
2014-12-09 11:01:49 +00:00
John Crispin
6521f53c65 keernel: Fixed dependencies in netfilter modules introduced with 3.18 kernel
Building current trunk with 3.18 kernel fired some errors like 'missed
dependancy of module XXX from library kmod_YYY.ko'. These patch fixes 3
of such issues which are critical to have a successful build.

Signed-off-by: Alexey N Vinogradov <a.n.vinogradov@gmail.com>

SVN-Revision: 43318
2014-11-19 14:09:01 +00:00
Steven Barth
25a6d37e23 kernel: 3.18: Fix kmod-ipt-nat
The 3.18 kernel introduced new Kconfig options for the xt_nat and iptable_nat
kernel modules, that both belong to the ipt_nat kernel package.

Enable this new options.

Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>

SVN-Revision: 43212
2014-11-08 12:17:14 +00:00
Felix Fietkau
9a2cf10c33 netfilter: Enable compiling iptables match cluster
This patch adds the userspace and kernelspace for

- match NETFILTER_XT_MATCH_CLUSTER
  This match can be used to deploy gateway and back-end load-sharing clusters.
- target IP_NF_TARGET_CLUSTERIP
  This module allows you to configure a simple cluster of nodes
  that share a certain IP and MAC address
  without an explicit load balancer in front of them.
  Connections are statically distributed between the nodes in this cluster.

This is used i.e. by strongswan-ha.

Signed-off-by: Christian Scheele <cs@embedd.com>

SVN-Revision: 43174
2014-11-03 22:01:45 +00:00
Steven Barth
a294c670e5 netfilter: unbreak kmod-ipt-nat for <3.7
SVN-Revision: 42696
2014-09-29 05:24:32 +00:00
Steven Barth
aba8e9ceef netfilter: fix a typo in TTL-match module
SVN-Revision: 42611
2014-09-18 14:53:26 +00:00
Steven Barth
0e0efd4771 netfilter: remove redundant CONFIG_IP_NF_IPTABLES
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 42599
2014-09-17 12:17:01 +00:00
Steven Barth
e4e5c31f87 Reorganize netfilter kernel modules and package nftables kernel support
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 42596
2014-09-17 12:10:44 +00:00
Steven Barth
9f2a17103f iptables: NFLOG and NFQUEUE targets' full support
NFLOG and NFQUEUE targets' full support for iptables.

Includes all needed kernel modules (Xtables's and Netlink's)
 and userspace libraries.
All added kernel modules can be individually disabled,
 all other new libraries get their own individual packages.

Reported-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch>
Reported-by: Rainer Poisel <rainer.poisel@fhstp.ac.at>
Reported-by: Derek LaHousse <dlahouss@mtu.edu>
Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com>

SVN-Revision: 42022
2014-08-07 04:42:22 +00:00
Jo-Philipp Wich
baa7c211f5 netfilter: introduce xt_id match
This commit implements a new netfilter match "xt_id" which can be used to
attach unsigned 32bit IDs to iptables rules.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 41945
2014-08-01 22:49:47 +00:00
Felix Fietkau
4b241e9827 netfilter: split off header matching modules not used by the default config (reduces rootfs size and memory usage)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 40983
2014-06-02 18:13:38 +00:00
Steven Barth
97ea9e3c2a iptables/netfilter: add connlimit to conntrack-extra
SVN-Revision: 39878
2014-03-11 14:58:00 +00:00
Steven Barth
2e2c4c2dd3 Fix IPv6 NAT breaking older kernels
SVN-Revision: 37891
2013-09-03 06:29:46 +00:00
Steven Barth
0a85c59040 netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration
SVN-Revision: 37866
2013-09-01 17:59:48 +00:00
Luka Perkov
e5e83478a9 netfilter: fix typo
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37821
2013-08-21 23:17:08 +00:00
Felix Fietkau
c404cd5bfa netfilter: remove use of obsolete compatibility config symbols for mark and connmark
fixes duplication of xt_mark and xt_connmark module entries

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37344
2013-07-15 13:08:20 +00:00
Jo-Philipp Wich
8df6cd005c netfilter: move time, mark, set matches and MARK, REDIRECT, SET targets into base iptables package - drop iptables-mod-ipset
SVN-Revision: 36683
2013-05-21 12:58:15 +00:00
Steven Barth
ed083586aa netfilter: Fix typo in last commit
SVN-Revision: 35899
2013-03-07 09:30:52 +00:00
Steven Barth
62ea398cd8 iptables: Add missing IPv6 builtin modules
SVN-Revision: 35898
2013-03-07 08:48:41 +00:00
Gabor Juhos
b20cb26ed7 package/kernel: xt_NOTRACK has been removed in 3.7-rc1
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 35475
2013-02-04 10:02:52 +00:00
Jo-Philipp Wich
03a50b9087 netfilter.mk: add addrtype match to iptables-mod-extra (kmod-ipt-extra)
SVN-Revision: 35155
2013-01-14 16:12:56 +00:00
Florian Fainelli
3a57cd4929 netfilter: xt_NOTRACK is incorporated in xt_CT as of 3.8-rc3
Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 35087
2013-01-10 17:20:29 +00:00
John Crispin
b21458709a fix ipv4 nat on 3.7 by adding missing iptables modules
SVN-Revision: 34841
2012-12-22 10:17:29 +00:00
Gabor Juhos
cfc6489579 netfilter: fix module list for 3.7 kernel
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 34750
2012-12-18 14:50:42 +00:00
Jo-Philipp Wich
5ba9873914 netfilter.mk: extend nf_add macro to take a version dependency expression
- nf_add now takes an optional 4th argument which specifies a kernel version dependency, e.g. "lt 3.7.0"
	- remove CompareKernelPatchVer conditionals around nf_add invocations, use version depends instead
	- fixes xt_LOG.ko packaging with Linux 3.6.0 and later

SVN-Revision: 34681
2012-12-15 00:05:35 +00:00
Jo-Philipp Wich
8420783407 netfilter.mk: fix packaging of xt_LOG.ko, it moved between 3.3.8 and 3.6.x
SVN-Revision: 34625
2012-12-11 09:53:50 +00:00
Hauke Mehrtens
d648dad7fa kernel: fix loading of nf_nat_irc
nf_nat_irc depends on nf_conntrack_irc and it should be defined after that.
This fixes a problem introduced in r34247.

SVN-Revision: 34251
2012-11-18 21:18:37 +00:00
Imre Kaloz
935ca3f3eb add 3.7-rc6 support (patch 820 still has to be fixed)
SVN-Revision: 34247
2012-11-18 18:52:38 +00:00
Felix Fietkau
d406a5208f include/netfilter.mk: remove a few obsolete lines
SVN-Revision: 33518
2012-09-23 08:25:32 +00:00
Felix Fietkau
cfe79471d1 kmod-ipt-nathelper-extra: fix missing nf_conntrack_broadcast.ko
kmod-ipt-nathelper-extra is missing the package nf_conntrack_broadcast.ko

if it is not included into the kmod-ipt-nathelper-extra packge the modules
nf_conntrack_snmp and nf_nat_snmp_basic cant get loaded:

[   44.500000] nf_conntrack_snmp: Unknown symbol nf_conntrack_broadcast_help (err 0)
[   44.664000] nf_nat_snmp_basic: Unknown symbol nf_nat_snmp_hook (err 0)

Signed-off-by: Peter Wagner <tripolar@gmx.at>

SVN-Revision: 32434
2012-06-18 23:30:48 +00:00
Felix Fietkau
b4b60ab62f include/netfilter.mk: clean up, remove junk for old kernel versions
SVN-Revision: 32114
2012-06-07 16:30:48 +00:00
Jo-Philipp Wich
e6af9d374a fix ipt_ttl and ipt_TTL userspace library packaging
SVN-Revision: 30897
2012-03-12 02:07:22 +00:00
Jonas Gorski
c336de3d85 kernel: update module names and add new config symbols for linux 3.3
SVN-Revision: 29985
2012-02-02 08:23:44 +00:00
Jo-Philipp Wich
a529e3f09e add CT target and TTL/HL match+target
This patch adds the CT target for conntrack (enables manipulation of
conntrack events and supercedes NOTRACK) as well as the TTL/HL target and
match.

SVN-Revision: 29645
2012-01-04 02:52:54 +00:00