diff options
Diffstat (limited to 'meta/recipes-extended/iptables')
-rw-r--r-- | meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch | 18 | ||||
-rw-r--r-- | meta/recipes-extended/iptables/iptables/0002-iptables-xshared.h-add-missing-sys.types.h-include.patch | 31 | ||||
-rw-r--r-- | meta/recipes-extended/iptables/iptables/0004-configure.ac-only-check-conntrack-when-libnfnetlink-.patch (renamed from meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch) | 10 | ||||
-rw-r--r-- | meta/recipes-extended/iptables/iptables_1.8.10.bb (renamed from meta/recipes-extended/iptables/iptables_1.8.7.bb) | 61 |
4 files changed, 80 insertions, 40 deletions
diff --git a/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch b/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch index 03c36ccbc2..8824bf2af7 100644 --- a/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch +++ b/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From c46db7c2e1f63ec525835553587e70c635565310 Mon Sep 17 00:00:00 2001 | 1 | From 0096c854d5015918ed154dccb3ad472fd06c1010 Mon Sep 17 00:00:00 2001 |
2 | From: "Maxin B. John" <maxin.john@intel.com> | 2 | From: "Maxin B. John" <maxin.john@intel.com> |
3 | Date: Tue, 21 Feb 2017 11:16:31 +0200 | 3 | Date: Tue, 21 Feb 2017 11:16:31 +0200 |
4 | Subject: [PATCH] configure: Add option to enable/disable libnfnetlink | 4 | Subject: [PATCH] configure: Add option to enable/disable libnfnetlink |
@@ -10,12 +10,13 @@ Upstream-Status: Pending | |||
10 | 10 | ||
11 | Signed-off-by: Khem Raj <raj.khem@gmail.com> | 11 | Signed-off-by: Khem Raj <raj.khem@gmail.com> |
12 | Signed-off-by: Maxin B. John <maxin.john@intel.com> | 12 | Signed-off-by: Maxin B. John <maxin.john@intel.com> |
13 | |||
13 | --- | 14 | --- |
14 | configure.ac | 10 +++++++--- | 15 | configure.ac | 10 +++++++--- |
15 | 1 file changed, 7 insertions(+), 3 deletions(-) | 16 | 1 file changed, 7 insertions(+), 3 deletions(-) |
16 | 17 | ||
17 | diff --git a/configure.ac b/configure.ac | 18 | diff --git a/configure.ac b/configure.ac |
18 | index eda7871..03ddc50 100644 | 19 | index d99fa3b..d607772 100644 |
19 | --- a/configure.ac | 20 | --- a/configure.ac |
20 | +++ b/configure.ac | 21 | +++ b/configure.ac |
21 | @@ -63,6 +63,9 @@ AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH], | 22 | @@ -63,6 +63,9 @@ AC_ARG_WITH([pkgconfigdir], AS_HELP_STRING([--with-pkgconfigdir=PATH], |
@@ -28,9 +29,9 @@ index eda7871..03ddc50 100644 | |||
28 | AC_ARG_ENABLE([connlabel], | 29 | AC_ARG_ENABLE([connlabel], |
29 | AS_HELP_STRING([--disable-connlabel], | 30 | AS_HELP_STRING([--disable-connlabel], |
30 | [Do not build libnetfilter_conntrack]), | 31 | [Do not build libnetfilter_conntrack]), |
31 | @@ -115,9 +118,10 @@ if test "x$enable_bpfc" = "xyes" || test "x$enable_nfsynproxy" = "xyes"; then | 32 | @@ -113,9 +116,10 @@ AM_CONDITIONAL([ENABLE_SYNCONF], [test "$enable_nfsynproxy" = "yes"]) |
32 | AC_CHECK_LIB(pcap, pcap_compile,, AC_MSG_ERROR(missing libpcap library required by bpf compiler or nfsynproxy tool)) | 33 | AM_CONDITIONAL([ENABLE_NFTABLES], [test "$enable_nftables" = "yes"]) |
33 | fi | 34 | AM_CONDITIONAL([ENABLE_CONNLABEL], [test "$enable_connlabel" = "yes"]) |
34 | 35 | ||
35 | -PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], | 36 | -PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], |
36 | - [nfnetlink=1], [nfnetlink=0]) | 37 | - [nfnetlink=1], [nfnetlink=0]) |
@@ -40,8 +41,5 @@ index eda7871..03ddc50 100644 | |||
40 | + ]) | 41 | + ]) |
41 | +AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "x$enable_libnfnetlink" = "xyes"]) | 42 | +AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "x$enable_libnfnetlink" = "xyes"]) |
42 | 43 | ||
43 | if test "x$enable_nftables" = "xyes"; then | 44 | if test "x$enable_bpfc" = "xyes" || test "x$enable_nfsynproxy" = "xyes"; then |
44 | PKG_CHECK_MODULES([libmnl], [libmnl >= 1.0], [mnl=1], [mnl=0]) | 45 | PKG_CHECK_MODULES([libpcap], [libpcap], [], [ |
45 | -- | ||
46 | 2.4.0 | ||
47 | |||
diff --git a/meta/recipes-extended/iptables/iptables/0002-iptables-xshared.h-add-missing-sys.types.h-include.patch b/meta/recipes-extended/iptables/iptables/0002-iptables-xshared.h-add-missing-sys.types.h-include.patch new file mode 100644 index 0000000000..a190c7e8ae --- /dev/null +++ b/meta/recipes-extended/iptables/iptables/0002-iptables-xshared.h-add-missing-sys.types.h-include.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | From 465e3ef77f1763d225adc76220e43ee9bd73b178 Mon Sep 17 00:00:00 2001 | ||
2 | From: Alexander Kanavin <alex@linutronix.de> | ||
3 | Date: Tue, 17 May 2022 10:56:59 +0200 | ||
4 | Subject: [PATCH] iptables/xshared.h: add missing sys.types.h include | ||
5 | |||
6 | This resolves the build error under musl: | ||
7 | |||
8 | | ../../../../../../../workspace/sources/iptables/iptables/xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? | ||
9 | | 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, | ||
10 | | | ^~~~~~~~~ | ||
11 | | | uint16_t | ||
12 | |||
13 | Upstream-Status: Submitted [via email to phil@nwl.cc] | ||
14 | Signed-off-by: Alexander Kanavin <alex@linutronix.de> | ||
15 | |||
16 | --- | ||
17 | iptables/xshared.h | 1 + | ||
18 | 1 file changed, 1 insertion(+) | ||
19 | |||
20 | diff --git a/iptables/xshared.h b/iptables/xshared.h | ||
21 | index a200e0d..f543dbf 100644 | ||
22 | --- a/iptables/xshared.h | ||
23 | +++ b/iptables/xshared.h | ||
24 | @@ -6,6 +6,7 @@ | ||
25 | #include <stdint.h> | ||
26 | #include <netinet/in.h> | ||
27 | #include <net/if.h> | ||
28 | +#include <sys/types.h> | ||
29 | #include <linux/netfilter_arp/arp_tables.h> | ||
30 | #include <linux/netfilter_ipv4/ip_tables.h> | ||
31 | #include <linux/netfilter_ipv6/ip6_tables.h> | ||
diff --git a/meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch b/meta/recipes-extended/iptables/iptables/0004-configure.ac-only-check-conntrack-when-libnfnetlink-.patch index 7842c6408a..5a022ebc8c 100644 --- a/meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch +++ b/meta/recipes-extended/iptables/iptables/0004-configure.ac-only-check-conntrack-when-libnfnetlink-.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 26090b3dbcdf6a11e60535da949b726a6e86426d Mon Sep 17 00:00:00 2001 | 1 | From 6832501bbb90a3dab977a4625d0391804c0e795c Mon Sep 17 00:00:00 2001 |
2 | From: "Maxin B. John" <maxin.john@intel.com> | 2 | From: "Maxin B. John" <maxin.john@intel.com> |
3 | Date: Tue, 21 Feb 2017 11:49:07 +0200 | 3 | Date: Tue, 21 Feb 2017 11:49:07 +0200 |
4 | Subject: [PATCH] configure.ac: | 4 | Subject: [PATCH] configure.ac: |
@@ -23,15 +23,16 @@ Upstream-Status: Pending | |||
23 | 23 | ||
24 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | 24 | Signed-off-by: Kai Kang <kai.kang@windriver.com> |
25 | Signed-off-by: Maxin B. John <maxin.john@intel.com> | 25 | Signed-off-by: Maxin B. John <maxin.john@intel.com> |
26 | |||
26 | --- | 27 | --- |
27 | configure.ac | 6 ++++-- | 28 | configure.ac | 6 ++++-- |
28 | 1 file changed, 4 insertions(+), 2 deletions(-) | 29 | 1 file changed, 4 insertions(+), 2 deletions(-) |
29 | 30 | ||
30 | diff --git a/configure.ac b/configure.ac | 31 | diff --git a/configure.ac b/configure.ac |
31 | index 03ddc50..523caea 100644 | 32 | index d607772..25a8e75 100644 |
32 | --- a/configure.ac | 33 | --- a/configure.ac |
33 | +++ b/configure.ac | 34 | +++ b/configure.ac |
34 | @@ -172,10 +172,12 @@ if test "$nftables" != 1; then | 35 | @@ -159,10 +159,12 @@ if test "$nftables" != 1; then |
35 | fi | 36 | fi |
36 | 37 | ||
37 | if test "x$enable_connlabel" = "xyes"; then | 38 | if test "x$enable_connlabel" = "xyes"; then |
@@ -46,6 +47,3 @@ index 03ddc50..523caea 100644 | |||
46 | if test "$nfconntrack" -ne 1; then | 47 | if test "$nfconntrack" -ne 1; then |
47 | blacklist_modules="$blacklist_modules connlabel"; | 48 | blacklist_modules="$blacklist_modules connlabel"; |
48 | echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built"; | 49 | echo "WARNING: libnetfilter_conntrack not found, connlabel match will not be built"; |
49 | -- | ||
50 | 2.4.0 | ||
51 | |||
diff --git a/meta/recipes-extended/iptables/iptables_1.8.7.bb b/meta/recipes-extended/iptables/iptables_1.8.10.bb index 621f87ff87..5a87897742 100644 --- a/meta/recipes-extended/iptables/iptables_1.8.7.bb +++ b/meta/recipes-extended/iptables/iptables_1.8.10.bb | |||
@@ -3,22 +3,23 @@ DESCRIPTION = "iptables is the userspace command line program used to configure | |||
3 | filtering code in Linux." | 3 | filtering code in Linux." |
4 | HOMEPAGE = "http://www.netfilter.org/" | 4 | HOMEPAGE = "http://www.netfilter.org/" |
5 | BUGTRACKER = "http://bugzilla.netfilter.org/" | 5 | BUGTRACKER = "http://bugzilla.netfilter.org/" |
6 | LICENSE = "GPLv2+" | 6 | LICENSE = "GPL-2.0-or-later" |
7 | LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ | 7 | LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ |
8 | file://iptables/iptables.c;beginline=13;endline=25;md5=c5cffd09974558cf27d0f763df2a12dc \ | 8 | file://iptables/iptables.c;beginline=13;endline=25;md5=c5cffd09974558cf27d0f763df2a12dc \ |
9 | " | 9 | " |
10 | 10 | ||
11 | SRC_URI = "http://netfilter.org/projects/iptables/files/iptables-${PV}.tar.bz2 \ | 11 | SRC_URI = "http://netfilter.org/projects/iptables/files/iptables-${PV}.tar.xz \ |
12 | file://0001-configure-Add-option-to-enable-disable-libnfnetlink.patch \ | ||
13 | file://0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch \ | ||
14 | file://iptables.service \ | 12 | file://iptables.service \ |
15 | file://iptables.rules \ | 13 | file://iptables.rules \ |
16 | file://ip6tables.service \ | 14 | file://ip6tables.service \ |
17 | file://ip6tables.rules \ | 15 | file://ip6tables.rules \ |
16 | file://0001-configure-Add-option-to-enable-disable-libnfnetlink.patch \ | ||
17 | file://0002-iptables-xshared.h-add-missing-sys.types.h-include.patch \ | ||
18 | file://0004-configure.ac-only-check-conntrack-when-libnfnetlink-.patch \ | ||
18 | " | 19 | " |
19 | SRC_URI[sha256sum] = "c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0" | 20 | SRC_URI[sha256sum] = "5cc255c189356e317d070755ce9371eb63a1b783c34498fb8c30264f3cc59c9c" |
20 | 21 | ||
21 | SYSTEMD_SERVICE_${PN} = "\ | 22 | SYSTEMD_SERVICE:${PN} = "\ |
22 | iptables.service \ | 23 | iptables.service \ |
23 | ${@bb.utils.contains('PACKAGECONFIG', 'ipv6', 'ip6tables.service', '', d)} \ | 24 | ${@bb.utils.contains('PACKAGECONFIG', 'ipv6', 'ip6tables.service', '', d)} \ |
24 | " | 25 | " |
@@ -27,6 +28,8 @@ inherit autotools pkgconfig systemd | |||
27 | 28 | ||
28 | EXTRA_OECONF = "--with-kernel=${STAGING_INCDIR}" | 29 | EXTRA_OECONF = "--with-kernel=${STAGING_INCDIR}" |
29 | 30 | ||
31 | CFLAGS:append:libc-musl = " -D__UAPI_DEF_ETHHDR=0" | ||
32 | |||
30 | PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" | 33 | PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" |
31 | PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," | 34 | PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," |
32 | 35 | ||
@@ -36,20 +39,23 @@ PACKAGECONFIG[libnfnetlink] = "--enable-libnfnetlink,--disable-libnfnetlink,libn | |||
36 | # libnftnl recipe is in meta-networking layer(previously known as libnftables) | 39 | # libnftnl recipe is in meta-networking layer(previously known as libnftables) |
37 | PACKAGECONFIG[libnftnl] = "--enable-nftables,--disable-nftables,libnftnl" | 40 | PACKAGECONFIG[libnftnl] = "--enable-nftables,--disable-nftables,libnftnl" |
38 | 41 | ||
39 | do_configure_prepend() { | 42 | do_configure:prepend() { |
40 | # Remove some libtool m4 files | 43 | # Remove some libtool m4 files |
41 | # Keep ax_check_linker_flags.m4 which belongs to autoconf-archive. | 44 | # Keep ax_check_linker_flags.m4 which belongs to autoconf-archive. |
42 | rm -f libtool.m4 lt~obsolete.m4 ltoptions.m4 ltsugar.m4 ltversion.m4 | 45 | rm -f libtool.m4 lt~obsolete.m4 ltoptions.m4 ltsugar.m4 ltversion.m4 |
46 | |||
47 | # Copy a header to fix out of tree builds | ||
48 | cp -f ${S}/libiptc/linux_list.h ${S}/include/libiptc/ | ||
43 | } | 49 | } |
44 | 50 | ||
45 | IPTABLES_RULES_DIR ?= "${sysconfdir}/${BPN}" | 51 | IPTABLES_RULES_DIR ?= "${sysconfdir}/${BPN}" |
46 | 52 | ||
47 | do_install_append() { | 53 | do_install:append() { |
48 | install -d ${D}${IPTABLES_RULES_DIR} | 54 | install -d ${D}${IPTABLES_RULES_DIR} |
49 | install -m 0644 ${WORKDIR}/iptables.rules ${D}${IPTABLES_RULES_DIR} | 55 | install -m 0644 ${UNPACKDIR}/iptables.rules ${D}${IPTABLES_RULES_DIR} |
50 | 56 | ||
51 | install -d ${D}${systemd_system_unitdir} | 57 | install -d ${D}${systemd_system_unitdir} |
52 | install -m 0644 ${WORKDIR}/iptables.service ${D}${systemd_system_unitdir} | 58 | install -m 0644 ${UNPACKDIR}/iptables.service ${D}${systemd_system_unitdir} |
53 | 59 | ||
54 | sed -i \ | 60 | sed -i \ |
55 | -e 's,@SBINDIR@,${sbindir},g' \ | 61 | -e 's,@SBINDIR@,${sbindir},g' \ |
@@ -57,28 +63,33 @@ do_install_append() { | |||
57 | ${D}${systemd_system_unitdir}/iptables.service | 63 | ${D}${systemd_system_unitdir}/iptables.service |
58 | 64 | ||
59 | if ${@bb.utils.contains('PACKAGECONFIG', 'ipv6', 'true', 'false', d)} ; then | 65 | if ${@bb.utils.contains('PACKAGECONFIG', 'ipv6', 'true', 'false', d)} ; then |
60 | install -m 0644 ${WORKDIR}/ip6tables.rules ${D}${IPTABLES_RULES_DIR} | 66 | install -m 0644 ${UNPACKDIR}/ip6tables.rules ${D}${IPTABLES_RULES_DIR} |
61 | install -m 0644 ${WORKDIR}/ip6tables.service ${D}${systemd_system_unitdir} | 67 | install -m 0644 ${UNPACKDIR}/ip6tables.service ${D}${systemd_system_unitdir} |
62 | 68 | ||
63 | sed -i \ | 69 | sed -i \ |
64 | -e 's,@SBINDIR@,${sbindir},g' \ | 70 | -e 's,@SBINDIR@,${sbindir},g' \ |
65 | -e 's,@RULESDIR@,${IPTABLES_RULES_DIR},g' \ | 71 | -e 's,@RULESDIR@,${IPTABLES_RULES_DIR},g' \ |
66 | ${D}${systemd_system_unitdir}/ip6tables.service | 72 | ${D}${systemd_system_unitdir}/ip6tables.service |
67 | fi | 73 | fi |
74 | |||
75 | # if libnftnl is included, make the iptables symlink point to the nft-based binary by default | ||
76 | if ${@bb.utils.contains('PACKAGECONFIG', 'libnftnl', 'true', 'false', d)} ; then | ||
77 | ln -sf ${sbindir}/xtables-nft-multi ${D}${sbindir}/iptables | ||
78 | fi | ||
68 | } | 79 | } |
69 | 80 | ||
70 | PACKAGES =+ "${PN}-modules ${PN}-apply" | 81 | PACKAGES =+ "${PN}-modules ${PN}-apply" |
71 | PACKAGES_DYNAMIC += "^${PN}-module-.*" | 82 | PACKAGES_DYNAMIC += "^${PN}-module-.*" |
72 | 83 | ||
73 | python populate_packages_prepend() { | 84 | python populate_packages:prepend() { |
74 | modules = do_split_packages(d, '${libdir}/xtables', r'lib(.*)\.so$', '${PN}-module-%s', '${PN} module %s', extra_depends='') | 85 | modules = do_split_packages(d, '${libdir}/xtables', r'lib(.*)\.so$', '${PN}-module-%s', '${PN} module %s', extra_depends='') |
75 | if modules: | 86 | if modules: |
76 | metapkg = d.getVar('PN') + '-modules' | 87 | metapkg = d.getVar('PN') + '-modules' |
77 | d.appendVar('RDEPENDS_' + metapkg, ' ' + ' '.join(modules)) | 88 | d.appendVar('RDEPENDS:' + metapkg, ' ' + ' '.join(modules)) |
78 | } | 89 | } |
79 | 90 | ||
80 | RDEPENDS_${PN} = "${PN}-module-xt-standard" | 91 | RDEPENDS:${PN} = "${PN}-module-xt-standard" |
81 | RRECOMMENDS_${PN} = " \ | 92 | RRECOMMENDS:${PN} = " \ |
82 | ${PN}-modules \ | 93 | ${PN}-modules \ |
83 | kernel-module-x-tables \ | 94 | kernel-module-x-tables \ |
84 | kernel-module-ip-tables \ | 95 | kernel-module-ip-tables \ |
@@ -95,16 +106,18 @@ RRECOMMENDS_${PN} = " \ | |||
95 | ', '', d)} \ | 106 | ', '', d)} \ |
96 | " | 107 | " |
97 | 108 | ||
98 | FILES_${PN} += "${datadir}/xtables" | 109 | FILES:${PN} += "${datadir}/xtables" |
99 | 110 | ||
100 | FILES_${PN}-apply = "${sbindir}/ip*-apply" | 111 | FILES:${PN}-apply = "${sbindir}/ip*-apply" |
101 | RDEPENDS_${PN}-apply = "${PN} bash" | 112 | RDEPENDS:${PN}-apply = "${PN} bash" |
102 | 113 | ||
103 | # Include the symlinks as well in respective packages | 114 | # Include the symlinks as well in respective packages |
104 | FILES_${PN}-module-xt-conntrack += "${libdir}/xtables/libxt_state.so" | 115 | FILES:${PN}-module-xt-conntrack += "${libdir}/xtables/libxt_state.so" |
105 | FILES_${PN}-module-xt-ct += "${libdir}/xtables/libxt_NOTRACK.so" | 116 | FILES:${PN}-module-xt-ct += "${libdir}/xtables/libxt_NOTRACK.so ${libdir}/xtables/libxt_REDIRECT.so" |
117 | FILES:${PN}-module-xt-nat += "${libdir}/xtables/libxt_SNAT.so ${libdir}/xtables/libxt_DNAT.so ${libdir}/xtables/libxt_MASQUERADE.so" | ||
106 | 118 | ||
107 | ALLOW_EMPTY_${PN}-modules = "1" | 119 | ALLOW_EMPTY:${PN}-modules = "1" |
108 | 120 | ||
109 | INSANE_SKIP_${PN}-module-xt-conntrack = "dev-so" | 121 | INSANE_SKIP:${PN}-module-xt-conntrack = "dev-so" |
110 | INSANE_SKIP_${PN}-module-xt-ct = "dev-so" | 122 | INSANE_SKIP:${PN}-module-xt-ct = "dev-so" |
123 | INSANE_SKIP:${PN}-module-xt-nat = "dev-so" | ||