On Wed, Apr 06, 2016 at 05:20:23PM +0200, Andreas Geisenhainer wrote: > - since iptables 1.6.0 depends on libnftnl, this patchset adds support > for nftables, too. > nftables should be used on sufficient new kernel, somewhere around 4.2 > should be ok. > - new libraries to resolv dependencies are > - libnftnl > - libmnl > > Signed-off-by: Andreas Geisenhainer <[email protected]> > --- > rules/iptables.in | 18 ++++++++++++++++++ > rules/iptables.make | 47 +++++++++++++++++++++++++++++++++++++++++------ > 2 files changed, 59 insertions(+), 6 deletions(-) > > diff --git a/rules/iptables.in b/rules/iptables.in > index e6f3699..6e4bc91 100644 > --- a/rules/iptables.in > +++ b/rules/iptables.in > @@ -7,6 +7,7 @@ menuconfig IPTABLES > select LIBC_M > select LIBC_DL > select GCCLIBS_GCC_S > + select LIBNFTNL
Please reorder your patches so libnftnl is actually available. > select LIBNFNETLINK if IPTABLES_LIBNFNETLINK > help > Iptables is used to set up, maintain, and inspect the > @@ -32,6 +33,16 @@ config IPTABLES_LIBIPQ > Builds and installs libipq (the iptables userspace packet > queuing library). > > +config IPTABLES_BPF_COMPILE > + bool > + prompt "install BPF_compile" Maybe we could enable this unconditionally? I guessing the binary will be rather small and this doesn't introduce any new external dependencies. > + help > + Enable for the Berkeley Packet Filter(BPF) compile helper program. > + > +config IPTABLES_NFSYNPROXY > + bool > + prompt "install nfsynproxy" Same here. What's this for anyways? > + > config IPTABLES_INSTALL_TOOLS > bool "install executables" > help > @@ -61,4 +72,11 @@ config IPTABLES_LIBNFNETLINK > help > Select if iptables should be build against libnfnetlink > > +config IPTABLES_NFTABLES_COMPAT > + bool > + select NFTABLES > + prompt "nftables compat" > + help > + build with nftables compability support > + > endif > diff --git a/rules/iptables.make b/rules/iptables.make > index 8a1ea66..90df197 100644 > --- a/rules/iptables.make > +++ b/rules/iptables.make > @@ -4,6 +4,8 @@ > # 2007 by Carsten Schlote, konzeptpark > # 2008 by Juergen Beisert > # 2009 by Marc Kleine-Budde <[email protected]> > +# 2016 by Andreas Geisenhainer > <[email protected]> > +# > # > # See CREDITS for details about who has contributed to this project. > # > @@ -19,8 +21,8 @@ PACKAGES-$(PTXCONF_IPTABLES) += iptables > # > # Paths and names > # > -IPTABLES_VERSION := 1.4.21 > -IPTABLES_MD5 := 536d048c8e8eeebcd9757d0863ebb0c0 > +IPTABLES_VERSION := 1.6.0 > +IPTABLES_MD5 := 27ba3451cb622467fc9267a176f19a31 > IPTABLES := iptables-$(IPTABLES_VERSION) > IPTABLES_SUFFIX := tar.bz2 > IPTABLES_URL := > http://ftp.netfilter.org/pub/iptables/$(IPTABLES).$(IPTABLES_SUFFIX) > @@ -43,12 +45,15 @@ IPTABLES_CONF_OPT := \ > $(GLOBAL_LARGE_FILE_OPTION) \ > --enable-devel \ > --$(call ptx/endis, PTXCONF_IPTABLES_LIBIPQ)-libipq \ > + --$(call ptx/endis, PTXCONF_IPTABLES_BPF_COMPILE)-bpf-compiler \ > + --$(call ptx/endis, PTXCONF_IPTABLES_NFTABLES_COMPAT)-nftables \ > + --$(call ptx/endis, PTXCONF_IPTABLES_NFSYNPROXY)-nfsynproxy \ Make sure --disable-* works correctly now. Otherwise you need to use: $(call ptx/ifdef, PTXCONF_IPTABLES_...,--enable-...) > --with-kernel=$(KERNEL_HEADERS_DIR) \ > --with-xtlibdir=/usr/lib > > -## broken configure.ac, so setting these would _enable_ the options: > -# --disable-bpf-compiler > -# --disable-nfsynproxy > +# static build is possible, but probably not useful. expand with: > +# --enable-static --disable-shared No need to comment on shared/static options. It's the same for everything. Michael > + > > # > ---------------------------------------------------------------------------- > # Install > @@ -110,8 +115,8 @@ endif > > ifdef PTXCONF_IPTABLES_INSTALL_TOOLS > @$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/xtables-multi) > - > @$(call install_link, iptables, ../sbin/xtables-multi, > /usr/bin/iptables-xml) > + @$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfnl_osf) > > ifdef PTXCONF_IPTABLES_IPV6 > # # IPv6 part > @@ -132,6 +137,36 @@ ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY > @$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/iptables-apply) > endif > > +# # nftables compability layer > +ifdef PTXCONF_IPTABLES_NFTABLES_COMPAT > + @$(call install_copy, iptables, 0, 0, 0755, -, > /usr/sbin/xtables-compat-multi) > + > +ifdef PTXCONF_IPTABLES_IPV4 > +# # IPv4 part > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/iptables-compat) > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/iptables-compat-save) > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/iptables-compat-restore) > +endif > + > +ifdef PTXCONF_IPTABLES_IPV6 > +# # IPv6 part > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/ip6tables-compat) > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/ip6tables-compat-save) > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/ip6tables-compat-restore) > +endif > + > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/arptables-compat) > + @$(call install_link, iptables, xtables-compat-multi, > /usr/sbin/ebtables-compat) > +endif > + > +ifdef PTXCONF_IPTABLES_NFSYNPROXY > + @$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfsynproxy) > +endif > + > +ifdef PTXCONF_IPTABLES_BPF_COMPILE > + @$(call install_copy, iptables, 0, 0, 0755, -, /usr/sbin/nfbpf_compile) > +endif > + > @$(call install_finish, iptables) > > @$(call touch) > -- > 2.8.0.rc3 > > ____________ > Virus checked by G Data MailSecurity > Version: AVA 25.6071 dated 06.04.2016 > Virus news: www.antiviruslab.com. > > _______________________________________________ > ptxdist mailing list > [email protected] -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list [email protected]
