Since iptables v1.8.11, `iptables -C` commands return unexpected zero status
even for cases when the rules don't exist. This breaks e.g. standard Docker
operation, where checking for existing rules is used extensively when creating
networks.
The patch fixing the behavior is available upstream - apply it to v1.8.11
before a newer version is available.
Signed-off-by: Jan Čermák <sairon@sairon.cz>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Instead of installing an empty rules file, the init script now checks
if the rules file exists and does nothing if it doesn't. The "save"
action is exempt from that limit because it may be used to create the
rules file.
Also fix the shellcheck warning about the unused IPTABLES_ARGS
variable, and use long form options for iptables commands.
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For an nftables-based firewall setup it may be desirable to use
iptables-nft as the "iptables" binary, in particular to better
integrate legacy applications that do not support nftables directly
and call iptables. If the BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT option
introduced by this patch is enabled, iptables, iptables-restore, and
iptables-save are symlinked to the -nft version of iptables. The
-legacy options can still be called directly if desired.
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
iptables generally bundles the netfilter header files inside its own
tar-ball.
Since iptables 1.8.8, it started to make use of netfilter/nf_log.h, but
didn't include it in the iptables tar-ball. This can lead to build
failures.
Add a patch that rectifies this for iptables 1.8.8.
Signed-off-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
libnetfilter_conntrack dependency is wrongly duplicated since commit
b835171cf9
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: drop from "main" _DEPENDENCIES instead]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch removes unneeded redirections when
calling iptables-restore and iptables-save, and
it adds the save operation to the usage help.
Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch will add an init script that allows
to set a ruleset in /etc/iptables.conf to be loaded
on boot, or flushed on stop, as well as a saving
command to generate a new file.
Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
[Arnout: change handling of readonly filesystem]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Drop upstream patch.
Add upstream patch for fixing build with musl libc.
Add upstream patch fixing build with glibc older that 2.19, and another
upstream patch fixing musl build cause by the previous patch.
Add yet another upstream patch fixing build with kernel headers before
4.2
Switch download site to https for better security.
Add license file hash.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Also removed a patch fixing the build with musl as it made its way into
the 1.6.2 version.
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
We want to use SPDX identifier for license strings as much as possible.
SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+.
This change is done by using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g'
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Also removed the 3 patches as they have been added into the latest
version.
Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
[Thomas: drop autoreconf, no longer needed.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
It now requires 3.12.x series headers so adjust the dependencies to
match.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add option for nftables compat utilies and for bpf compiler/nfsynproxy
configuration tool.
Drop symlink trickery since it's not required any more.
Switch homepage to proper one and drop the kernel v2.4+ note since
that's not supported by buildroot anyway.
Drop most patches (except musl build) since they're upstream.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since a while, the semantic of BR2_PREFER_STATIC_LIB has been changed
from "prefer static libraries when possible" to "use only static
libraries". The former semantic didn't make much sense, since the user
had absolutely no control/idea of which package would use static
libraries, and which packages would not. Therefore, for quite some
time, we have been starting to enforce that BR2_PREFER_STATIC_LIB
should really build everything with static libraries.
As a consequence, this patch renames BR2_PREFER_STATIC_LIB to
BR2_STATIC_LIBS, and adjust the Config.in option accordingly.
This also helps preparing the addition of other options to select
shared, shared+static or just static.
Note that we have verified that this commit can be reproduced by
simply doing a global rename of BR2_PREFER_STATIC_LIB to
BR2_STATIC_LIBS plus adding BR2_PREFER_STATIC_LIB to Config.in.legacy.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.
Sed command used:
find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
As reported by 'scanf' on IRC, the iptables now fails to build because
of a missing <asm/cache.h> header in the kernel headers. The package
directly uses $(LINUX_HEADERS_DIR), which is not correct: this is the
source directory of the kernel, not where they are installed, and in
addition, this directory is empty/does not exist when using external
toolchains.
Instead, we use $(STAGING_DIR)/usr, which contains the kernel headers,
as part of the toolchain headers.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Jan Čermák