From: Jo-Philipp Wich Date: Tue, 13 Dec 2016 23:36:28 +0000 (+0100) Subject: netfilter: drop proprietary xt_id match X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=e2f8d200f598c67534c6292d732f7927b3609473;p=openwrt%2Fstaging%2Flynxis%2Fomap.git netfilter: drop proprietary xt_id match The xt_id match was used by the firewall3 package to track its own rules but the approach has been changed to use xt_comment instead now, so we can drop this nonstandard extension. Signed-off-by: Jo-Philipp Wich --- diff --git a/include/netfilter.mk b/include/netfilter.mk index c793ce5ac1..a4e495e644 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -39,13 +39,12 @@ $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_FILTER, $(P_V4)iptabl $(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_MANGLE, $(P_V4)iptable_mangle),)) # userland only -$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_id xt_set xt_SET))) +$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_set xt_SET))) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_LIMIT, $(P_XT)xt_limit)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MAC, $(P_XT)xt_mac)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MULTIPORT, $(P_XT)xt_multiport)) $(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_COMMENT, $(P_XT)xt_comment)) -$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_ID, $(P_XT)xt_id)) #cluster $(eval $(call nf_add,IPT_CLUSTER,CONFIG_NETFILTER_XT_MATCH_CLUSTER, $(P_XT)xt_cluster)) diff --git a/package/network/utils/iptables/patches/500-add-xt_id-match.patch b/package/network/utils/iptables/patches/500-add-xt_id-match.patch deleted file mode 100644 index 0964f0175f..0000000000 --- a/package/network/utils/iptables/patches/500-add-xt_id-match.patch +++ /dev/null @@ -1,69 +0,0 @@ ---- /dev/null -+++ b/extensions/libxt_id.c -@@ -0,0 +1,55 @@ -+/* Shared library add-on to iptables to add id match support. */ -+ -+#include -+#include -+#include -+ -+enum { -+ O_ID = 0, -+}; -+ -+static const struct xt_option_entry id_opts[] = { -+ { -+ .name = "id", -+ .id = O_ID, -+ .type = XTTYPE_UINT32, -+ .flags = XTOPT_MAND | XTOPT_PUT, -+ XTOPT_POINTER(struct xt_id_info, id) -+ }, -+ XTOPT_TABLEEND, -+}; -+ -+static void -+id_print(const void *ip, const struct xt_entry_match *match, int numeric) -+{ -+ struct xt_id_info *idinfo = (void *)match->data; -+ -+ printf(" ID:%08lx", idinfo->id); -+} -+ -+ -+/* Saves the union ipt_matchinfo in parsable form to stdout. */ -+static void -+id_save(const void *ip, const struct xt_entry_match *match) -+{ -+ struct xt_id_info *idinfo = (void *)match->data; -+ -+ printf(" --id 0x%lx", idinfo->id); -+} -+ -+static struct xtables_match id_match = { -+ .family = NFPROTO_UNSPEC, -+ .name = "id", -+ .version = XTABLES_VERSION, -+ .size = XT_ALIGN(sizeof(struct xt_id_info)), -+ .userspacesize = XT_ALIGN(sizeof(struct xt_id_info)), -+ .print = id_print, -+ .save = id_save, -+ .x6_parse = xtables_option_parse, -+ .x6_options = id_opts, -+}; -+ -+void _init(void) -+{ -+ xtables_register_match(&id_match); -+} ---- /dev/null -+++ b/include/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ __u32 id; -+}; -+ -+#endif /* XT_ID_H */ diff --git a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index e9dae74d8d..0000000000 --- a/target/linux/generic/patches-3.18/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1157,6 +1157,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -143,6 +143,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit); diff --git a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index 7d0fe27e98..0000000000 --- a/target/linux/generic/patches-4.1/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1164,6 +1164,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -145,6 +145,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit); diff --git a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch b/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch deleted file mode 100644 index b403c79a07..0000000000 --- a/target/linux/generic/patches-4.4/615-netfilter_add_xt_id_match.patch +++ /dev/null @@ -1,95 +0,0 @@ ---- a/include/uapi/linux/netfilter/Kbuild -+++ b/include/uapi/linux/netfilter/Kbuild -@@ -55,6 +55,7 @@ header-y += xt_ecn.h - header-y += xt_esp.h - header-y += xt_hashlimit.h - header-y += xt_helper.h -+header-y += xt_id.h - header-y += xt_ipcomp.h - header-y += xt_iprange.h - header-y += xt_ipvs.h ---- /dev/null -+++ b/include/uapi/linux/netfilter/xt_id.h -@@ -0,0 +1,8 @@ -+#ifndef _XT_ID_H -+#define _XT_ID_H -+ -+struct xt_id_info { -+ u32 id; -+}; -+ -+#endif /* XT_ID_H */ ---- a/net/netfilter/Kconfig -+++ b/net/netfilter/Kconfig -@@ -1180,6 +1180,13 @@ config NETFILTER_XT_MATCH_IPCOMP - - To compile it as a module, choose M here. If unsure, say N. - -+config NETFILTER_XT_MATCH_ID -+ tristate '"id" match support' -+ depends on NETFILTER_ADVANCED -+ ---help--- -+ This option adds a `id' dummy-match, which allows you to put -+ numeric IDs into your iptables ruleset. -+ - config NETFILTER_XT_MATCH_IPRANGE - tristate '"iprange" address range match support' - depends on NETFILTER_ADVANCED ---- a/net/netfilter/Makefile -+++ b/net/netfilter/Makefile -@@ -144,6 +144,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += - obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o - obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o -+obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o - obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o ---- /dev/null -+++ b/net/netfilter/xt_id.c -@@ -0,0 +1,45 @@ -+/* -+ * Implements a dummy match to allow attaching IDs to rules -+ * -+ * 2014-08-01 Jo-Philipp Wich -+ */ -+ -+#include -+#include -+#include -+#include -+ -+MODULE_AUTHOR("Jo-Philipp Wich "); -+MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID"); -+MODULE_LICENSE("GPL"); -+MODULE_ALIAS("ipt_id"); -+MODULE_ALIAS("ip6t_id"); -+ -+static bool -+id_mt(const struct sk_buff *skb, struct xt_action_param *par) -+{ -+ /* We always match */ -+ return true; -+} -+ -+static struct xt_match id_mt_reg __read_mostly = { -+ .name = "id", -+ .revision = 0, -+ .family = NFPROTO_UNSPEC, -+ .match = id_mt, -+ .matchsize = sizeof(struct xt_id_info), -+ .me = THIS_MODULE, -+}; -+ -+static int __init id_mt_init(void) -+{ -+ return xt_register_match(&id_mt_reg); -+} -+ -+static void __exit id_mt_exit(void) -+{ -+ xt_unregister_match(&id_mt_reg); -+} -+ -+module_init(id_mt_init); -+module_exit(id_mt_exit);