linux/poky.git/meta/recipes-extended/iptables, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

iptables: upgrade 1.8.10 -> 1.8.11

2024-11-18T22:09:02+00:00

0001-configure-Add-option-to-enable-disable-libnfnetlink.patch 0002-nft-ruleparse-Add-missing-braces-around-ternary.patch removed since they're included in 1.8.11 Changelog: https://netfilter.org/projects/iptables/files/changes-iptables-1.8.11.txt (From OE-Core rev: d12f4bf60cc45bf9f73f688000786cfea7a2faeb) Signed-off-by: Wang Mingyu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

iptables: fix memory corruption when parsing nft rules

2024-07-26T11:28:42+00:00

This commit fixes a memory corruption issue when iptables (with enabled PACKAGECONFIG libnftnl) is used to access rules created by nft. To reproduce the issue: nft add chain ip filter TESTCHAIN { meta mark set 123 \;} iptables -t filter -n -L TESTCHAIN This produced the following output: Chain TESTCHAIN (0 references) target prot opt source destination MARK 0 -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x7b malloc(): corrupted top size Aborted (core dumped) This commit fixes this issue. (From OE-Core rev: 461d6333dabacdc181c91f31a8dd4ad6682cc0e4) Signed-off-by: Christian Taedcke Signed-off-by: Richard Purdie

iptables: remove /etc/ethertypes

2024-07-13T22:28:30+00:00

When building an image including iptable built with the libnftnl PACKAGECONFIG, one hits Downloading file:.../oe-rootfs-repo/armv8a/libkmod2 * check_data_file_clashes: Package iptables wants to install file .../rootfs/etc/ethertypes But that file is already provided by package * netbase This used to be handled by 0003-Makefile.am-do-not-install-etc-ethertypes.patch, but that patch got removed with the 1.8.9->1.8.10 upgrade (commit 4616ada82e70). I think the rationale for dropping the patch was wrong; the commit log talks about xtables.conf, which is indeed gone from upstream, but said patch didn't change anything about xtables.conf, it did -dist_conf_DATA = etc/ethertypes etc/xtables.conf +dist_conf_DATA = etc/xtables.conf However, instead of patching iptables to not install ethertypes, and having to forward-port that patch, it is much simpler to just remove the file in this do_install:append. (From OE-Core rev: 3b9c8d5c26a48123d3845c93f6e04d430569e6a2) Signed-off-by: Rasmus Villemoes Signed-off-by: Richard Purdie

iptables: fix save/restore symlinks with libnftnl PACKAGECONFIG enabled

2024-06-10T13:27:23+00:00

When the libnftnl PACKAGECONFIG is enabled, the "iptables" symlink is correctly points to xtables-nft-multi, however the "iptables-save" and "iptables-restore" are still point to the xtables-legacy-multi. So, when the "iptables" command is used it's using the nftables backend where is the "iptables-save/restore" are using the legacy backend. This is not consistent with other distros (e.g. Ubuntu). The issue was identified when testing the UFW firewall with nftables backend. (From OE-Core rev: 6579e4333b74232d8b576c399eab88e37da881ac) Signed-off-by: Kirill Yatsenko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

iptables: correctly enable libnetfilter_conntrack support

2024-05-28T08:38:23+00:00

This is done via configure option, and makes 0004-configure.ac-only-check-conntrack-when-libnfnetlink-.patch unnecessary, as both libnetfilter_conntrack and libnfnetlink are enabled in lockstep. (From OE-Core rev: 04ffb341864b443544e9f594248c0c785f601a55) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

iptables: remove unneeded 0002-iptables-xshared.h-add-missing-sys.types.h-include.patch

2024-05-28T08:38:23+00:00

Somewhere on the way it ceased to be necessary. (From OE-Core rev: b5a32b5744b4ebb1bdc8937e5ebbc35dced0b1a7) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

iptables: submit 0001-configure-Add-option-to-enable-disable-libnfnetlink.patch upstream

2024-05-28T08:38:23+00:00

(From OE-Core rev: 67f6c3534a18520f3b7c5eed27dc2744c5bf44c2) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

recipes: Update WORKDIR references to UNPACKDIR

2024-05-02T14:15:51+00:00

Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. (From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c) Signed-off-by: Richard Purdie

iptables: upgrade 1.8.9 -> 1.8.10

2023-12-04T11:23:37+00:00

- 0003-x is not required anymore because to xtables.conf is dropped. - format-security.patch is already in upstream. - Other patches are refreshed. (From OE-Core rev: 4616ada82e7079f0cc7e995c2f421f43b54d4a08) Signed-off-by: Changhyeok Bae Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie