qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2025-04-21 12:27:27 +03:00
Code Activity

packages: sort network related packages into package/network/

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@33688 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
nbd
2012-10-10 12:32:29 +00:00
parent eecf5b1752
commit 9c8997d54d
344 changed files with 0 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

371
package/network/utils/iptables/patches/002-layer7_2.22.patch Normal file
View File

@@ -0,0 +1,371 @@
--- /dev/null
+++ b/extensions/libxt_layer7.c
@@ -0,0 +1,368 @@
+/*
+ Shared library add-on to iptables for layer 7 matching support.
+
+ By Matthew Strait <quadong@users.sf.net>, Oct 2003-Aug 2008.
+
+ http://l7-filter.sf.net
+
+ This program is free software; you can redistribute it and/or
+ modify it under the terms of the GNU General Public License
+ as published by the Free Software Foundation; either version
+ 2 of the License, or (at your option) any later version.
+ http://www.gnu.org/licenses/gpl.txt
+*/
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <netdb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ctype.h>
+#include <dirent.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_layer7.h>
+
+#define MAX_FN_LEN 256
+
+static char l7dir[MAX_FN_LEN] = "\0";
+
+/* Function which prints out usage message. */
+static void help(void)
+{
+ printf(
+ "layer7 match options:\n"
+ " --l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n"
+ " (--l7dir must be specified before --l7proto if used)\n"
+ "[!] --l7proto <name>: Match named protocol using /etc/l7-protocols/.../name.pat\n");
+}
+
+static const struct option opts[] = {
+ { .name = "l7proto", .has_arg = 1, .val = 'p' },
+ { .name = "l7dir", .has_arg = 1, .val = 'd' },
+ { .name = NULL }
+};
+
+/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
+static int parse_protocol_file(char * filename, const char * protoname, struct xt_layer7_info *info)
+{
+ FILE * f;
+ char * line = NULL;
+ size_t len = 0;
+
+ enum { protocol, pattern, done } datatype = protocol;
+
+ f = fopen(filename, "r");
+
+ if(!f)
+ return 0;
+
+ while(getline(&line, &len, f) != -1)
+ {
+ if(strlen(line) < 2 || line[0] == '#')
+ continue;
+
+ /* strip the pesky newline... */
+ if(line[strlen(line) - 1] == '\n')
+ line[strlen(line) - 1] = '\0';
+
+ if(datatype == protocol)
+ {
+ /* Ignore everything on the line beginning with the
+ first space or tab . For instance, this allows the
+ protocol line in http.pat to be "http " (or
+ "http I am so cool") instead of just "http". */
+ if(strchr(line, ' ')){
+ char * space = strchr(line, ' ');
+ space[0] = '\0';
+ }
+ if(strchr(line, '\t')){
+ char * space = strchr(line, '\t');
+ space[0] = '\0';
+ }
+
+ /* sanity check. First non-comment non-blank
+ line must be the same as the file name. */
+ if(strcmp(line, protoname))
+ xtables_error(OTHER_PROBLEM,
+ "Protocol name (%s) doesn't match file name (%s). Bailing out\n",
+ line, filename);
+
+ if(strlen(line) >= MAX_PROTOCOL_LEN)
+ xtables_error(PARAMETER_PROBLEM,
+ "Protocol name in %s too long!", filename);
+ strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
+
+ datatype = pattern;
+ }
+ else if(datatype == pattern)
+ {
+ if(strlen(line) >= MAX_PATTERN_LEN)
+ xtables_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
+ strncpy(info->pattern, line, MAX_PATTERN_LEN);
+
+ datatype = done;
+ break;
+ }
+ else
+ xtables_error(OTHER_PROBLEM, "Internal error");
+ }
+
+ if(datatype != done)
+ xtables_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
+
+ if(line) free(line);
+ fclose(f);
+
+ return 1;
+}
+
+static int hex2dec(char c)
+{
+ switch (c)
+ {
+ case '0' ... '9':
+ return c - '0';
+ case 'a' ... 'f':
+ return c - 'a' + 10;
+ case 'A' ... 'F':
+ return c - 'A' + 10;
+ default:
+ xtables_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
+ return 0;
+ }
+}
+
+/* takes a string with \xHH escapes and returns one with the characters
+they stand for */
+static char * pre_process(char * s)
+{
+ char * result = malloc(strlen(s) + 1);
+ int sindex = 0, rrindex = 0;
+ while( sindex < strlen(s) )
+ {
+ if( sindex + 3 < strlen(s) &&
+ s[sindex] == '\\' && s[sindex+1] == 'x' &&
+ isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
+ {
+ /* carefully remember to call tolower here... */
+ result[rrindex] = tolower( hex2dec(s[sindex + 2])*16 +
+ hex2dec(s[sindex + 3] ) );
+
+ switch ( result[rrindex] )
+ {
+ case 0x24:
+ case 0x28:
+ case 0x29:
+ case 0x2a:
+ case 0x2b:
+ case 0x2e:
+ case 0x3f:
+ case 0x5b:
+ case 0x5c:
+ case 0x5d:
+ case 0x5e:
+ case 0x7c:
+ fprintf(stderr,
+ "Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n"
+ "I recommend that you write this as %c or \\%c, depending on what you meant.\n",
+ result[rrindex], s[sindex + 2], s[sindex + 3], result[rrindex], result[rrindex]);
+ break;
+ case 0x00:
+ fprintf(stderr,
+ "Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n");
+ break;
+ default:
+ break;
+ }
+
+
+ sindex += 3; /* 4 total */
+ }
+ else
+ result[rrindex] = tolower(s[sindex]);
+
+ sindex++;
+ rrindex++;
+ }
+ result[rrindex] = '\0';
+
+ return result;
+}
+
+#define MAX_SUBDIRS 128
+static char ** readl7dir(char * dirname)
+{
+ DIR * scratchdir;
+ struct dirent ** namelist;
+ char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
+
+ int n, d = 1;
+ subdirs[0] = "";
+
+ n = scandir(dirname, &namelist, 0, alphasort);
+
+ if (n < 0)
+ {
+ perror("scandir");
+ xtables_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
+ }
+ else
+ {
+ while(n--)
+ {
+ char fulldirname[MAX_FN_LEN];
+
+ snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
+
+ if((scratchdir = opendir(fulldirname)) != NULL)
+ {
+ closedir(scratchdir);
+
+ if(!strcmp(namelist[n]->d_name, ".") ||
+ !strcmp(namelist[n]->d_name, ".."))
+ /* do nothing */ ;
+ else
+ {
+ subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
+ strcpy(subdirs[d], namelist[n]->d_name);
+ d++;
+ if(d >= MAX_SUBDIRS - 1)
+ {
+ fprintf(stderr,
+ "Too many subdirectories, skipping the rest!\n");
+ break;
+ }
+ }
+ }
+ free(namelist[n]);
+ }
+ free(namelist);
+ }
+
+ subdirs[d] = NULL;
+
+ return subdirs;
+}
+
+static void parse_layer7_protocol(const char *s, struct xt_layer7_info *info)
+{
+ char filename[MAX_FN_LEN];
+ char * dir = NULL;
+ char ** subdirs;
+ int n = 0, done = 0;
+
+ if(strlen(l7dir) > 0) dir = l7dir;
+ else dir = "/etc/l7-protocols";
+
+ subdirs = readl7dir(dir);
+
+ while(subdirs[n] != NULL)
+ {
+ int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
+
+ if(c > MAX_FN_LEN)
+ xtables_error(OTHER_PROBLEM,
+ "Filename beginning with %s is too long!\n", filename);
+
+ /* read in the pattern from the file */
+ if(parse_protocol_file(filename, s, info)){
+ done = 1;
+ break;
+ }
+
+ n++;
+ }
+
+ if(!done)
+ xtables_error(OTHER_PROBLEM,
+ "Couldn't find a pattern definition file for %s.\n", s);
+
+ /* process \xHH escapes and tolower everything. (our regex lib has no
+ case insensitivity option.) */
+ strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
+}
+
+/* Function which parses command options; returns true if it ate an option */
+static int parse(int c, char **argv, int invert, unsigned int *flags,
+ const void *entry, struct xt_entry_match **match)
+{
+ struct xt_layer7_info *layer7info =
+ (struct xt_layer7_info *)(*match)->data;
+
+ switch (c) {
+ case 'p':
+ parse_layer7_protocol(argv[optind-1], layer7info);
+ if (invert)
+ layer7info->invert = true;
+ *flags = 1;
+ break;
+
+ case 'd':
+ if(strlen(argv[optind-1]) >= MAX_FN_LEN)
+ xtables_error(PARAMETER_PROBLEM, "directory name too long\n");
+
+ strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
+
+ *flags = 1;
+ break;
+
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+/* Final check; must have specified --l7proto */
+static void final_check(unsigned int flags)
+{
+ if (!flags)
+ xtables_error(PARAMETER_PROBLEM,
+ "LAYER7 match: You must specify `--l7proto'");
+}
+
+static void print_protocol(char s[], int invert, int numeric)
+{
+ fputs("l7proto ", stdout);
+ if (invert) fputc('!', stdout);
+ printf("%s ", s);
+}
+
+/* Prints out the matchinfo. */
+static void print(const void *ip,
+ const struct xt_entry_match *match,
+ int numeric)
+{
+ printf("LAYER7 ");
+ print_protocol(((struct xt_layer7_info *)match->data)->protocol,
+ ((struct xt_layer7_info *)match->data)->invert, numeric);
+}
+/* Saves the union ipt_matchinfo in parsable form to stdout. */
+static void save(const void *ip, const struct xt_entry_match *match)
+{
+ const struct xt_layer7_info *info =
+ (const struct xt_layer7_info*) match->data;
+
+ printf("--l7proto %s%s ", (info->invert)? "! ":"", info->protocol);
+}
+
+static struct xtables_match layer7 = {
+ .family = AF_INET,
+ .name = "layer7",
+ .version = XTABLES_VERSION,
+ .size = XT_ALIGN(sizeof(struct xt_layer7_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_layer7_info)),
+ .help = &help,
+ .parse = &parse,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+void _init(void)
+{
+ xtables_register_match(&layer7);
+}

11
package/network/utils/iptables/patches/009-table-alignment.patch Normal file
View File

@@ -0,0 +1,11 @@
--- a/libiptc/libiptc.c
+++ b/libiptc/libiptc.c
@@ -69,7 +69,7 @@ static const char *hooknames[] = {
struct ipt_error_target
{
STRUCT_ENTRY_TARGET t;
- char error[TABLE_MAXNAMELEN];
+ char error[FUNCTION_MAXNAMELEN];
};
struct chain_head;

265
package/network/utils/iptables/patches/010-multiport-linux-2.4-compat.patch Normal file
View File

@@ -0,0 +1,265 @@
--- a/extensions/libxt_multiport.c
+++ b/extensions/libxt_multiport.c
@@ -15,21 +15,6 @@
#include <linux/netfilter/xt_multiport.h>
/* Function which prints out usage message. */
-static void multiport_help(void)
-{
- printf(
-"multiport match options:\n"
-" --source-ports port[,port,port...]\n"
-" --sports ...\n"
-" match source port(s)\n"
-" --destination-ports port[,port,port...]\n"
-" --dports ...\n"
-" match destination port(s)\n"
-" --ports port[,port,port]\n"
-" match both source and destination port(s)\n"
-" NOTE: this kernel does not support port ranges in multiport.\n");
-}
-
static void multiport_help_v1(void)
{
printf(
@@ -72,26 +57,6 @@ proto_to_name(u_int8_t proto)
}
}
-static unsigned int
-parse_multi_ports(const char *portstring, u_int16_t *ports, const char *proto)
-{
- char *buffer, *cp, *next;
- unsigned int i;
-
- buffer = strdup(portstring);
- if (!buffer) xtables_error(OTHER_PROBLEM, "strdup failed");
-
- for (cp=buffer, i=0; cp && i<XT_MULTI_PORTS; cp=next,i++)
- {
- next=strchr(cp, ',');
- if (next) *next++='\0';
- ports[i] = xtables_parse_port(cp, proto);
- }
- if (cp) xtables_error(PARAMETER_PROBLEM, "too many ports specified");
- free(buffer);
- return i;
-}
-
static void
parse_multi_ports_v1(const char *portstring,
struct xt_multiport_v1 *multiinfo,
@@ -155,73 +120,6 @@ check_proto(u_int16_t pnum, u_int8_t inv
/* Function which parses command options; returns true if it
ate an option */
static int
-__multiport_parse(int c, char **argv, int invert, unsigned int *flags,
- struct xt_entry_match **match, u_int16_t pnum,
- u_int8_t invflags)
-{
- const char *proto;
- struct xt_multiport *multiinfo
- = (struct xt_multiport *)(*match)->data;
-
- switch (c) {
- case '1':
- xtables_check_inverse(optarg, &invert, &optind, 0, argv);
- proto = check_proto(pnum, invflags);
- multiinfo->count = parse_multi_ports(optarg,
- multiinfo->ports, proto);
- multiinfo->flags = XT_MULTIPORT_SOURCE;
- break;
-
- case '2':
- xtables_check_inverse(optarg, &invert, &optind, 0, argv);
- proto = check_proto(pnum, invflags);
- multiinfo->count = parse_multi_ports(optarg,
- multiinfo->ports, proto);
- multiinfo->flags = XT_MULTIPORT_DESTINATION;
- break;
-
- case '3':
- xtables_check_inverse(optarg, &invert, &optind, 0, argv);
- proto = check_proto(pnum, invflags);
- multiinfo->count = parse_multi_ports(optarg,
- multiinfo->ports, proto);
- multiinfo->flags = XT_MULTIPORT_EITHER;
- break;
-
- default:
- return 0;
- }
-
- if (invert)
- xtables_error(PARAMETER_PROBLEM,
- "multiport does not support invert");
-
- if (*flags)
- xtables_error(PARAMETER_PROBLEM,
- "multiport can only have one option");
- *flags = 1;
- return 1;
-}
-
-static int
-multiport_parse(int c, char **argv, int invert, unsigned int *flags,
- const void *e, struct xt_entry_match **match)
-{
- const struct ipt_entry *entry = e;
- return __multiport_parse(c, argv, invert, flags, match,
- entry->ip.proto, entry->ip.invflags);
-}
-
-static int
-multiport_parse6(int c, char **argv, int invert, unsigned int *flags,
- const void *e, struct xt_entry_match **match)
-{
- const struct ip6t_entry *entry = e;
- return __multiport_parse(c, argv, invert, flags, match,
- entry->ipv6.proto, entry->ipv6.invflags);
-}
-
-static int
__multiport_parse_v1(int c, char **argv, int invert, unsigned int *flags,
struct xt_entry_match **match, u_int16_t pnum,
u_int8_t invflags)
@@ -314,55 +212,6 @@ print_port(u_int16_t port, u_int8_t prot
}
/* Prints out the matchinfo. */
-static void
-__multiport_print(const struct xt_entry_match *match, int numeric,
- u_int16_t proto)
-{
- const struct xt_multiport *multiinfo
- = (const struct xt_multiport *)match->data;
- unsigned int i;
-
- printf("multiport ");
-
- switch (multiinfo->flags) {
- case XT_MULTIPORT_SOURCE:
- printf("sports ");
- break;
-
- case XT_MULTIPORT_DESTINATION:
- printf("dports ");
- break;
-
- case XT_MULTIPORT_EITHER:
- printf("ports ");
- break;
-
- default:
- printf("ERROR ");
- break;
- }
-
- for (i=0; i < multiinfo->count; i++) {
- printf("%s", i ? "," : "");
- print_port(multiinfo->ports[i], proto, numeric);
- }
- printf(" ");
-}
-
-static void multiport_print(const void *ip_void,
- const struct xt_entry_match *match, int numeric)
-{
- const struct ipt_ip *ip = ip_void;
- __multiport_print(match, numeric, ip->proto);
-}
-
-static void multiport_print6(const void *ip_void,
- const struct xt_entry_match *match, int numeric)
-{
- const struct ip6t_ip6 *ip = ip_void;
- __multiport_print(match, numeric, ip->proto);
-}
-
static void __multiport_print_v1(const struct xt_entry_match *match,
int numeric, u_int16_t proto)
{
@@ -419,48 +268,6 @@ static void multiport_print6_v1(const vo
}
/* Saves the union ipt_matchinfo in parsable form to stdout. */
-static void __multiport_save(const struct xt_entry_match *match,
- u_int16_t proto)
-{
- const struct xt_multiport *multiinfo
- = (const struct xt_multiport *)match->data;
- unsigned int i;
-
- switch (multiinfo->flags) {
- case XT_MULTIPORT_SOURCE:
- printf("--sports ");
- break;
-
- case XT_MULTIPORT_DESTINATION:
- printf("--dports ");
- break;
-
- case XT_MULTIPORT_EITHER:
- printf("--ports ");
- break;
- }
-
- for (i=0; i < multiinfo->count; i++) {
- printf("%s", i ? "," : "");
- print_port(multiinfo->ports[i], proto, 1);
- }
- printf(" ");
-}
-
-static void multiport_save(const void *ip_void,
- const struct xt_entry_match *match)
-{
- const struct ipt_ip *ip = ip_void;
- __multiport_save(match, ip->proto);
-}
-
-static void multiport_save6(const void *ip_void,
- const struct xt_entry_match *match)
-{
- const struct ip6t_ip6 *ip = ip_void;
- __multiport_save(match, ip->proto);
-}
-
static void __multiport_save_v1(const struct xt_entry_match *match,
u_int16_t proto)
{
@@ -514,34 +321,6 @@ static struct xtables_match multiport_mt
{
.family = NFPROTO_IPV4,
.name = "multiport",
- .revision = 0,
- .version = XTABLES_VERSION,
- .size = XT_ALIGN(sizeof(struct xt_multiport)),
- .userspacesize = XT_ALIGN(sizeof(struct xt_multiport)),
- .help = multiport_help,
- .parse = multiport_parse,
- .final_check = multiport_check,
- .print = multiport_print,
- .save = multiport_save,
- .extra_opts = multiport_opts,
- },
- {
- .family = NFPROTO_IPV6,
- .name = "multiport",
- .revision = 0,
- .version = XTABLES_VERSION,
- .size = XT_ALIGN(sizeof(struct xt_multiport)),
- .userspacesize = XT_ALIGN(sizeof(struct xt_multiport)),
- .help = multiport_help,
- .parse = multiport_parse6,
- .final_check = multiport_check,
- .print = multiport_print6,
- .save = multiport_save6,
- .extra_opts = multiport_opts,
- },
- {
- .family = NFPROTO_IPV4,
- .name = "multiport",
.version = XTABLES_VERSION,
.revision = 1,
.size = XT_ALIGN(sizeof(struct xt_multiport_v1)),

116
package/network/utils/iptables/patches/011-recent-add-reap.patch Normal file
View File

@@ -0,0 +1,116 @@
From 20c706d4cba3227c9c44fb61c4d93b0ae84e1464 Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner@canonical.com>
Date: Mon, 1 Mar 2010 19:00:29 -0700
Subject: [PATCH] xt_recent: Added XT_RECENT_REAP logic and man page documentation
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
extensions/libxt_recent.c | 20 ++++++++++++++++++++
extensions/libxt_recent.man | 5 +++++
include/linux/netfilter/xt_recent.h | 7 +++++++
3 files changed, 32 insertions(+), 0 deletions(-)
--- a/extensions/libxt_recent.c
+++ b/extensions/libxt_recent.c
@@ -20,6 +20,7 @@ static const struct option recent_opts[]
{.name = "name", .has_arg = true, .val = 208},
{.name = "rsource", .has_arg = false, .val = 209},
{.name = "rdest", .has_arg = false, .val = 210},
+ {.name = "reap", .has_arg = false, .val = 211},
XT_GETOPT_TABLEEND,
};
@@ -37,6 +38,7 @@ static void recent_help(void)
" --hitcount hits For check and update commands above.\n"
" Specifies that the match will only occur if source address seen hits times.\n"
" May be used in conjunction with the seconds option.\n"
+" --reap Remove entries that have expired. Can only be used with --seconds\n"
" --rttl For check and update commands above.\n"
" Specifies that the match will only occur if the source address and the TTL\n"
" match between this packet and the one which was set.\n"
@@ -63,6 +65,8 @@ static void recent_init(struct xt_entry_
(XT_RECENT_SET | XT_RECENT_CHECK | \
XT_RECENT_UPDATE | XT_RECENT_REMOVE)
+#define XT_RECENT_SECONDS 1 << 31
+
static int recent_parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
@@ -104,6 +108,7 @@ static int recent_parse(int c, char **ar
case 204:
info->seconds = atoi(optarg);
+ *flags |= XT_RECENT_SECONDS;
break;
case 205:
@@ -139,6 +144,11 @@ static int recent_parse(int c, char **ar
info->side = XT_RECENT_DEST;
break;
+ case 211:
+ info->check_set |= XT_RECENT_REAP;
+ *flags |= XT_RECENT_REAP;
+ break;
+
default:
return 0;
}
@@ -157,6 +167,12 @@ static void recent_check(unsigned int fl
xtables_error(PARAMETER_PROBLEM,
"recent: --rttl may only be used with --rcheck or "
"--update");
+ if ((flags & XT_RECENT_REAP) &&
+ ((flags & (XT_RECENT_SET | XT_RECENT_REMOVE)) ||
+ (!(flags & XT_RECENT_SECONDS))))
+ xtables_error(PARAMETER_PROBLEM,
+ "recent: --reap may only be used with --rcheck or "
+ "--update and --seconds");
}
static void recent_print(const void *ip, const struct xt_entry_match *match,
@@ -185,6 +201,8 @@ static void recent_print(const void *ip,
printf("side: source ");
if (info->side == XT_RECENT_DEST)
printf("side: dest ");
+ if (info->check_set & XT_RECENT_REAP)
+ printf("reap ");
}
static void recent_save(const void *ip, const struct xt_entry_match *match)
@@ -211,6 +229,8 @@ static void recent_save(const void *ip,
printf("--rsource ");
if (info->side == XT_RECENT_DEST)
printf("--rdest ");
+ if (info->check_set & XT_RECENT_REAP)
+ printf("--reap ");
}
static struct xtables_match recent_mt_reg = {
--- a/extensions/libxt_recent.man
+++ b/extensions/libxt_recent.man
@@ -41,6 +41,11 @@ This option must be used in conjunction
\fB\-\-update\fP. When used, this will narrow the match to only happen when the
address is in the list and was seen within the last given number of seconds.
.TP
+\fB\-\-reap\fP \fIreap\fP
+This option must be used in conjunction with \fB\-\-seconds\fP. When used, this
+will remove entries with the most recent timestamp older then \fB\-\-seconds\fP
+since the last packet was received.
+.TP
\fB\-\-hitcount\fP \fIhits\fP
This option must be used in conjunction with one of \fB\-\-rcheck\fP or
\fB\-\-update\fP. When used, this will narrow the match to only happen when the
--- a/include/linux/netfilter/xt_recent.h
+++ b/include/linux/netfilter/xt_recent.h
@@ -23,6 +23,9 @@ enum {
#define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
+/* Only allowed with --rcheck and --update */
+#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
+
struct xt_recent_mtinfo {
__u32 seconds;
__u32 hit_count;

18
package/network/utils/iptables/patches/020-iptables-disable-modprobe.patch Normal file
View File

@@ -0,0 +1,18 @@
--- a/xtables.c
+++ b/xtables.c
@@ -305,6 +305,7 @@ static char *get_modprobe(void)
int xtables_insmod(const char *modname, const char *modprobe, bool quiet)
{
+#if 0
char *buf = NULL;
char *argv[4];
int status;
@@ -348,6 +349,7 @@ int xtables_insmod(const char *modname,
free(buf);
if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
return 0;
+#endif
return -1;
}

92
package/network/utils/iptables/patches/030-no-libnfnetlink.patch Normal file
View File

@@ -0,0 +1,92 @@
--- a/configure
+++ b/configure
@@ -10917,75 +10917,7 @@ $as_echo "no" >&6; }
fi
fi
-pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libnfnetlink" >&5
-$as_echo_n "checking for libnfnetlink... " >&6; }
-
-if test -n "$libnfnetlink_CFLAGS"; then
- pkg_cv_libnfnetlink_CFLAGS="$libnfnetlink_CFLAGS"
- elif test -n "$PKG_CONFIG"; then
- if test -n "$PKG_CONFIG" && \
- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5
- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then
- pkg_cv_libnfnetlink_CFLAGS=`$PKG_CONFIG --cflags "libnfnetlink >= 1.0" 2>/dev/null`
-else
- pkg_failed=yes
-fi
- else
- pkg_failed=untried
-fi
-if test -n "$libnfnetlink_LIBS"; then
- pkg_cv_libnfnetlink_LIBS="$libnfnetlink_LIBS"
- elif test -n "$PKG_CONFIG"; then
- if test -n "$PKG_CONFIG" && \
- { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"libnfnetlink >= 1.0\""; } >&5
- ($PKG_CONFIG --exists --print-errors "libnfnetlink >= 1.0") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then
- pkg_cv_libnfnetlink_LIBS=`$PKG_CONFIG --libs "libnfnetlink >= 1.0" 2>/dev/null`
-else
- pkg_failed=yes
-fi
- else
- pkg_failed=untried
-fi
-
-
-
-if test $pkg_failed = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-
-if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
- _pkg_short_errors_supported=yes
-else
- _pkg_short_errors_supported=no
-fi
- if test $_pkg_short_errors_supported = yes; then
- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors "libnfnetlink >= 1.0" 2>&1`
- else
- libnfnetlink_PKG_ERRORS=`$PKG_CONFIG --print-errors "libnfnetlink >= 1.0" 2>&1`
- fi
- # Put the nasty error message in config.log where it belongs
- echo "$libnfnetlink_PKG_ERRORS" >&5
-
- nfnetlink=0
-elif test $pkg_failed = untried; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
- nfnetlink=0
-else
- libnfnetlink_CFLAGS=$pkg_cv_libnfnetlink_CFLAGS
- libnfnetlink_LIBS=$pkg_cv_libnfnetlink_LIBS
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- nfnetlink=1
-fi
- if test "$nfnetlink" = 1; then
+if false; then
HAVE_LIBNFNETLINK_TRUE=
HAVE_LIBNFNETLINK_FALSE='#'
else
--- a/configure.ac
+++ b/configure.ac
@@ -79,9 +79,7 @@ AM_CONDITIONAL([ENABLE_LARGEFILE], [test
AM_CONDITIONAL([ENABLE_DEVEL], [test "$enable_devel" = "yes"])
AM_CONDITIONAL([ENABLE_LIBIPQ], [test "$enable_libipq" = "yes"])
-PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0],
- [nfnetlink=1], [nfnetlink=0])
-AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "$nfnetlink" = 1])
+AM_CONDITIONAL([HAVE_LIBNFNETLINK], [false])
regular_CFLAGS="${largefile_cflags} \
-D_REENTRANT -Wall -Waggregate-return -Wmissing-declarations \

16
package/network/utils/iptables/patches/100-bash-location.patch Normal file
View File

@@ -0,0 +1,16 @@
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
autoreconf -fi;
rm -Rf autom4te*.cache;
--- a/iptables-apply
+++ b/iptables-apply
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
#
# iptables-apply -- a safer way to update iptables remotely
#

12
package/network/utils/iptables/patches/110-linux_3.2_compat.patch Normal file
View File

@@ -0,0 +1,12 @@
--- iptables-1.4.10/include/linux/types.h.orig 2011-11-07 00:08:33.000000000 +0100
+++ iptables-1.4.10/include/linux/types.h 2011-11-07 00:09:25.000000000 +0100
@@ -34,5 +34,9 @@
typedef __u16 __bitwise __sum16;
typedef __u32 __bitwise __wsum;
+#define __aligned_u64 __u64 __attribute__((aligned(8)))
+#define __aligned_be64 __be64 __attribute__((aligned(8)))
+#define __aligned_le64 __le64 __attribute__((aligned(8)))
+
#endif /* __ASSEMBLY__ */
#endif /* _LINUX_TYPES_H */

56
package/network/utils/iptables/patches/200-configurable_builtin.patch Normal file
View File

@@ -0,0 +1,56 @@
--- a/extensions/GNUmakefile.in
+++ b/extensions/GNUmakefile.in
@@ -40,9 +40,24 @@
pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod})
pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod})
pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod})
-pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_mod})
-pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_mod})
-pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_mod})
+
+ifdef BUILTIN_MODULES
+pfx_build_static := $(filter $(BUILTIN_MODULES),${pfx_build_mod})
+pf4_build_static := $(filter $(BUILTIN_MODULES),${pf4_build_mod})
+pf6_build_static := $(filter $(BUILTIN_MODULES),${pf6_build_mod})
+else
+@ENABLE_STATIC_TRUE@ pfx_build_static := $(pfx_build_mod)
+@ENABLE_STATIC_TRUE@ pf4_build_static := $(pf4_build_mod)
+@ENABLE_STATIC_TRUE@ pf6_build_static := $(pf6_build_mod)
+endif
+
+pfx_build_mod := $(filter-out $(pfx_build_static),$(pfx_build_mod))
+pf4_build_mod := $(filter-out $(pf4_build_static),$(pf4_build_mod))
+pf6_build_mod := $(filter-out $(pf6_build_static),$(pf6_build_mod))
+
+pfx_objs := $(patsubst %,libxt_%.o,${pfx_build_static})
+pf4_objs := $(patsubst %,libipt_%.o,${pf4_build_static})
+pf6_objs := $(patsubst %,libip6t_%.o,${pf6_build_static})
pfx_solibs := $(patsubst %,libxt_%.so,${pfx_build_mod})
pf4_solibs := $(patsubst %,libipt_%.so,${pf4_build_mod})
pf6_solibs := $(patsubst %,libip6t_%.so,${pf6_build_mod})
@@ -54,10 +69,10 @@
targets := libext4.a libext6.a matches4.man matches6.man \
targets4.man targets6.man
targets_install :=
-@ENABLE_STATIC_TRUE@ libext4_objs := ${pfx_objs} ${pf4_objs}
-@ENABLE_STATIC_TRUE@ libext6_objs := ${pfx_objs} ${pf6_objs}
-@ENABLE_STATIC_FALSE@ targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs}
-@ENABLE_STATIC_FALSE@ targets_install += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs}
+libext4_objs := ${pfx_objs} ${pf4_objs}
+libext6_objs := ${pfx_objs} ${pf6_objs}
+targets += ${pfx_solibs} ${pf4_solibs} ${pf6_solibs}
+targets_install := $(strip ${targets_install} ${pfx_solibs} ${pf4_solibs} ${pf6_solibs})
.SECONDARY:
@@ -107,8 +122,8 @@
libext6.a: initext6.o ${libext6_objs}
${AM_VERBOSE_AR} ${AR} crs $@ $^;
-initext_func := $(addprefix xt_,${pfx_build_mod}) $(addprefix ipt_,${pf4_build_mod})
-initext6_func := $(addprefix xt_,${pfx_build_mod}) $(addprefix ip6t_,${pf6_build_mod})
+initext_func := $(addprefix xt_,${pfx_build_static}) $(addprefix ipt_,${pf4_build_static})
+initext6_func := $(addprefix xt_,${pfx_build_static}) $(addprefix ip6t_,${pf6_build_static})
.initext4.dd: FORCE
@echo "${initext_func}" >$@.tmp; \