aboutsummaryrefslogtreecommitdiff
path: root/package/network/utils/iptables/Makefile
Commit message (Collapse)AuthorAge
...
* iptables: make kmod-ipt-debug part of default ALL buildYousong Zhou2018-01-26
| | | | | | | | | The iptables TRACE target is only available in raw table that's why the dependency was moved from iptables-mod-trace into kmod-ipt-debug Fixes FS#1219 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* add PKG_CPE_ID ids to package and toolsAlexander Couzens2017-11-17
| | | | | | | | | | | CPE ids helps to tracks CVE in packages. https://cpe.mitre.org/specification/ Thanks to swalker for CPE to package mapping and keep tracking CVEs. Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* netfilter, iptables: add optional CHECKSUM moduleDenis Osvald2017-11-06
| | | | Signed-off-by: Denis Osvald <denis.osvald@sartura.hr>
* iptables: Fix target TRACE issueMartin Wetterwald2017-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | The package kmod-ipt-debug builds the module xt_TRACE, which allows users to use '-j TRACE' as target in the chain PREROUTING of the table raw in iptables. The kernel compilation flag NETFILTER_XT_TARGET_TRACE is also enabled so that this feature which is implemented deep inside the linux IP stack (for example in sk_buff) is compiled. But a strace of iptables -t raw -I PREROUTING -p icmp -j TRACE reveals that an attempt is made to read /usr/lib/iptables/libxt_TRACE.so, which fails as this dynamic library is not present on the system. I created the package iptables-mod-trace which takes care of that, and target TRACE now works! https://dev.openwrt.org/ticket/16694 https://dev.openwrt.org/ticket/19661 Signed-off-by: Martin Wetterwald <martin.wetterwald@corp.ovh.com> [Jo-Philipp Wich: also remove trace extension from builtin extension list and depend on kmod-ipt-raw since its required for rules] Signed-off-by: Jo-Philipp Wich <jo@mein.io> Tested-by: Enrico Mioso <mrkiko.rs@gmail.com>
* netfilter: add iptables-mod-rpfilter packageAlin Nastac2017-07-11
| | | | | | | | | Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
* iptables: fix wrong depends for nftables support (FS#707)Ansuel Smith2017-04-22
| | | | | | | The dep for the nftables support was wrong, if someone actually enable that option gain a compilation error. This fix this problem. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* iptables: set ABI_VERSION to force rebuild of dependent packagesFelix Fietkau2017-04-12
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iptables: bump to 1.6.1Ansuel Smith2017-04-12
| | | | | | | | | Switch to git repo Removed musl patch Refreshed existing patch Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> [cleanup]
* build: use mkhash to replace various quirky md5sum/openssl callsFelix Fietkau2017-01-05
| | | | Signed-off-by: Felix Fietkau <nbd@nbd.name>
* treewide: clean up download hashesFelix Fietkau2016-12-16
| | | | | | Replace *MD5SUM with *HASH, replace MD5 hashes with SHA256 Signed-off-by: Felix Fietkau <nbd@nbd.name>
* iptables: using external kernel tree should not alter patch behaviour.Felix Fietkau2016-02-07
| | | | | | | | | iptables is the only exception in the package tree, causing patch behaviour to be inconsistent on this package. Signed-off-by: Rick van der Zwet <rick.vanderzwet@anywi.com> SVN-Revision: 48643
* iptables: improve iptables listing output of xt_id matchJo-Philipp Wich2016-01-24
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48478
* iptables: fix rebuild errors on configuration changesFelix Fietkau2016-01-18
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48314
* iptables: reduce binary sizeJo-Philipp Wich2015-05-26
| | | | | | | | | | | * drop unused lenient restore patch * instead of statically linking core extensions, build shared libraries for reuse in fw3 * strip outdated match revisions and aliases to trim down library size Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 45758
* iptables: remove layer7 leftovers (#19506)Felix Fietkau2015-04-17
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45481
* iptables: remove layer7 supportFelix Fietkau2015-04-13
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 45424
* iptables: revert r40916John Crispin2015-04-10
| | | | | | | | it causes problems with newer iptables when ipv6 is disabled as iptc uncoditionally links ip6tc Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 45350
* netfilter: Enable compiling iptables match clusterFelix Fietkau2014-11-03
| | | | | | | | | | | | | | | | | | This patch adds the userspace and kernelspace for - match NETFILTER_XT_MATCH_CLUSTER This match can be used to deploy gateway and back-end load-sharing clusters. - target IP_NF_TARGET_CLUSTERIP This module allows you to configure a simple cluster of nodes that share a certain IP and MAC address without an explicit load balancer in front of them. Connections are statically distributed between the nodes in this cluster. This is used i.e. by strongswan-ha. Signed-off-by: Christian Scheele <cs@embedd.com> SVN-Revision: 43174
* license info - revert r43155John Crispin2014-11-03
| | | | | | | | turns out that r43155 adds duplicate info. Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 43167
* Add more license tags with SPDX identifiersJohn Crispin2014-11-03
| | | | | | | | | | | | | | | | | | Note, that licensing stuff is a nightmare: many packages does not clearly state their licenses, and often multiple source files are simply copied together - each with different licensing information in the file headers. I tried hard to ensure, that the license information extracted into the OpenWRT's makefiles fit the "spirit" of the packages, e.g. such small packages which come without a dedicated source archive "inherites" the OpenWRT's own license in my opinion. However, I can not garantee that I always picked the correct information and/or did not miss license information. Signed-off-by: Michael Heimpold <mhei@heimpold.de> SVN-Revision: 43155
* Add a few SPDX tagsSteven Barth2014-11-02
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 43151
* iptables: add kmod-ipt-nf* to dependency list of iptables-mod-nf*.Steven Barth2014-08-07
| | | | | | Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> SVN-Revision: 42034
* iptables: NFLOG and NFQUEUE targets' full supportSteven Barth2014-08-07
| | | | | | | | | | | | | | | | NFLOG and NFQUEUE targets' full support for iptables. Includes all needed kernel modules (Xtables's and Netlink's) and userspace libraries. All added kernel modules can be individually disabled, all other new libraries get their own individual packages. Reported-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch> Reported-by: Rainer Poisel <rainer.poisel@fhstp.ac.at> Reported-by: Derek LaHousse <dlahouss@mtu.edu> Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com> SVN-Revision: 42022
* iptables: pass --disable-ipv6 is CONFIG_IPV6 is unsetJo-Philipp Wich2014-07-02
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 41458
* netfilter: split off header matching modules not used by the default config ↵Felix Fietkau2014-06-02
| | | | | | | | (reduces rootfs size and memory usage) Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 40983
* iptables: Makefile: only build ip6tc, if IPv6 is enabledJohn Crispin2014-06-02
| | | | | | | | when disabling ipv6, the iptables build breaks without a manul clean or this patch Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com> SVN-Revision: 40916
* iptables/netfilter: add connlimit to conntrack-extraSteven Barth2014-03-11
| | | | SVN-Revision: 39878
* iptables: bump to 1.4.21Steven Barth2014-03-11
| | | | SVN-Revision: 39877
* netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam ↵Steven Barth2013-09-01
| | | | | | Novak and Sedat Dilek for patches and inspiration SVN-Revision: 37866
* iptables: Update to 1.4.20Steven Barth2013-09-01
| | | | SVN-Revision: 37865
* Bump iptables versionSteven Barth2013-07-15
| | | | SVN-Revision: 37329
* iptables: install libext*.a into staging dirJo-Philipp Wich2013-06-06
| | | | SVN-Revision: 36867
* iptables: bump to 1.4.19.1Steven Barth2013-05-29
| | | | SVN-Revision: 36760
* netfilter: move time, mark, set matches and MARK, REDIRECT, SET targets into ↵Jo-Philipp Wich2013-05-21
| | | | | | base iptables package - drop iptables-mod-ipset SVN-Revision: 36683
* iptables: use -ffunction-sections, -fdata-sections and --gc-sectionsJo-Philipp Wich2013-05-21
| | | | SVN-Revision: 36680
* package: fold the IPv6 menu into NetworkFelix Fietkau2013-05-14
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 36634
* Fix install of iptables pkg-config files.Jo-Philipp Wich2013-05-02
| | | | | | | | | | | libiptc.pc depends on libip[4|6]tc.pc, thus all of those need to be installed. Should fix collectd build and thus #13146; which should make collectd appear in snapshots again. Signed-off-by: Danny Baumann <dannybaumann@web.de> SVN-Revision: 36509
* iptables: don't use --enable-ipv6 if IPv6 is disabledSteven Barth2013-03-25
| | | | SVN-Revision: 36125
* iptables: Add missing IPv6 builtin modulesSteven Barth2013-03-07
| | | | SVN-Revision: 35898
* iptables: redo update to 1.4.18 with old linking-behaviourSteven Barth2013-03-06
| | | | SVN-Revision: 35896
* Revert "iptables: update to 1.4.18" due to toolchain-issue: binaries cause ↵Steven Barth2013-03-06
| | | | | | segfaults when stripped on ar71xx SVN-Revision: 35894
* iptables: update to 1.4.18Steven Barth2013-03-05
| | | | SVN-Revision: 35892
* iptables: fix bad PKG_RELEASE in previous commitJo-Philipp Wich2013-02-11
| | | | SVN-Revision: 35569
* iptables: add --lenient switch to iptables-restore and ip6tables-restore ↵Jo-Philipp Wich2013-02-11
| | | | | | that allows to skip erroneous lines SVN-Revision: 35568
* netfilter.mk: add addrtype match to iptables-mod-extra (kmod-ipt-extra)Jo-Philipp Wich2013-01-14
| | | | SVN-Revision: 35155
* iptables: remove support for libipq, it has been obsolete for years and is ↵Felix Fietkau2012-11-04
| | | | | | unsupported in newer kernels SVN-Revision: 34069
* packages: sort network related packages into package/network/Felix Fietkau2012-10-10
SVN-Revision: 33688
Powered by cgit, Themed by Ted Yin.