[openwrt/openwrt] iptables: update to 1.8.8

LEDE Commits lede-commits at lists.infradead.org
Sun Jul 10 15:59:20 PDT 2022


hauke pushed a commit to openwrt/openwrt.git, branch master:
https://git.openwrt.org/436fad7a3edaf071b45d8201e839acd914be4d10

commit 436fad7a3edaf071b45d8201e839acd914be4d10
Author: Nick Hainke <vincent at systemli.org>
AuthorDate: Sat May 14 07:04:12 2022 +0200

    iptables: update to 1.8.8
    
    Remove upstreamed patches:
    - 001-xtables-Call-init_extensions6-for-static-builds.patch
    - 002-xtables-Call-init_extensions_a_b.patch
    
    Fix patches:
    - 102-iptables-disable-modprobe.patch
      Fix warnings in the form of:
      xtables.c:475:14: warning: 'get_modprobe' defined but not used [-Wunused-function]
      475 | static char *get_modprobe(void)
          |              ^~~~~~~~~~~~
    
    Backport patches:
    - 020-treewide-use-uint-instead-of-u_int.patch
    - 030-revert-fix-build-for-missing-ETH_ALEN-definition.patch
    - 040-xshared-Fix-build-for-Werror-format-security.patch
    - 050-build-fix-error-during-out-of-tree-build.patch
    - 060-libxtables-unexport-init_extensions-declarations.patch
    
    Refresh patches:
    - 101-remove-check-already.patch
    - 102-iptables-disable-modprobe.patch
    - 200-configurable_builtin.patch
    - 600-shared-libext.patch
    - 700-disable-legacy-revisions.patch
    
    Remove from Makefile:
     $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
    
    Changelog:
    fa0ccdbd configure: bump version for 1.8.8 release
    8468fd4f nft: Fix EPERM handling for extensions without rev 0
    ce9195c6 extensions: LOG: Document --log-macdecode in man page
    404f304d man: *NAT: Review --random* option descriptions
    0a538259 extensions: DNAT: Merge core printing functions
    a7c2b728 libxtables: Revert change to struct xtables_pprot
    fd64a587 libxtables: Drop xtables_globals 'optstring' field
    3b8a6a6f xshared: Extend xtables_printhelp() for arptables
    8ff84eaf xshared: Move arp_opcodes into shared space
    adbfec0b extensions: MARK: Drop extra newline at end of help
    1dcfb81e nft: split gen_payload() to allocate register and initialize expression
    7e38890c nft: prepare for dynamic register allocation
    165cafec nft: pass handle to helper functions to build netlink payload
    94309632 nft: native mark matching support
    aa92ec96 nft: pass struct nft_xt_ctx to parse_meta()
    4c70c42f nft-shared: update context register for bitwise expression
    18c96821 extensions: man: Document service name support in DNAT and REDIRECT
    72d542b6 extensions: Merge REDIRECT into DNAT
    14d77c8a extensions: Merge IPv4 and IPv6 DNAT targets
    9621318b extensions: DNAT: Rename from libipt to libxt
    2e0c9a40 extensions: ipt_DNAT: Combine xlate functions also
    7adef314 extensions: ipt_DNAT: Merge v1/v2 print/save code
    3f4f1cf0 extensions: ipt_DNAT: Merge v1 and v2 parsers
    070a8626 Revert "libipt_[SD]NAT: avoid false error about multiple destinations specified"
    08c14fa6 man: DNAT: Describe shifted port range feature
    24fff5d7 xlate-test: Fix for empty source line on failure
    ac4c84cc libxtables: Boost rule target checks by announcing chain names
    f58b0d74 libxtables: Implement notargets hash table
    b1aee6b2 nft: Reject standard targets as chain names when restoring
    b555bfed tests: shell: Fix 0004-return-codes_0 for static builds
    c293e116 nft: Review static extension loading
    0836524f xtables: Call init_extensions{,a,b}() for static builds
    6c689b63 Simplify static build extension loading
    0c8e2535 libxtables: Fix for warning in xtables_ipmask_to_numeric
    0c0cd434 nft: Don't pass command state opaque to family ops callbacks
    b6196c75 xshared: Prefer xtables_chain_protos lookup over getprotoent
    07ee529f nft: Speed up immediate parsing
    b5f2faea nft: Simplify immediate parsing
    17534cb1 Improve error messages for unsupported extensions
    2dbb49d1 libxtables: Register only the highest revision extension
    07e2107e xshared: Implement xtables lock timeout using signals
    a3980769 tests: NFLOG: enable `--nflog-range` tests
    b8e8ac27 tests: support explicit variant test result
    adb03c3f tests: add `NOMATCH` test result
    7a006c7d tests: iptables-test: rename variable
    b7f15b42 iptables.8: Describe the effect of multiple -v flags
    1407a9c4 tests: iptables-test: Support variant deviation
    fc8f7289 nft: cache: Dump rules if debugging
    73b91292 nft: Add debug output to table creation
    51d9d9e0 ebtables: Support verbose mode
    ad1ed75f nft: Set NFTNL_CHAIN_FAMILY in new chains
    17ed253f iptables-restore: Support for extra debug output
    a761a026 nft: Use verbose flag to toggle debug output
    98e69b7e nft: add support for native tcp flag matching
    92808bd5 nft-shared: add tcp flag dissection
    6aba94ef nft: prefer native expressions instead of tcp match
    c034cf31 nft: prefer native expressions instead of udp match
    5489493e nft-shared: support native udp port delinearize
    5795a1b5 nft-shared: support native tcp port range delinearize
    250dce87 nft-shared: support native tcp port delinearize
    ea5d45dc extensions: libxt_NFLOG: fix typo
    26ecdf53 xshared: Fix response to unprivileged users
    b32ae771 build: replace `AM_PROG_LIBTOOL` and `AC_DISABLE_STATIC` with `LT_INIT`
    05286bab extensions: libxt_NFLOG: remove extra space when saving targets with prefixes
    f0d02998 extensions: libxt_NFLOG: fix `--nflog-prefix` Python test-cases
    f9df828a extensions: libxt_NFLOG: disable `--nflog-range` Python test-cases
    62ad29e9 extensions: libxt_NFLOG: don't truncate log prefix on print/save
    db99f601 extensions: libxt_NFLOG: use nft built-in logging instead of xt_NFLOG
    30b178b9 extensions: *NAT: Kill multiple IPv4 range support
    7ee5b970 tests: iptables-test: correct misspelt variable
    223f02ca nft: fix indentation error.
    5c2c2eea ip6tables: Use the shared do_parse, too
    9baf3bf0 iptables: Use xtables' do_parse() function
    e4f5185d nft: Move proto_parse and post_parse callbacks to xshared
    ded7b579 xshared: Store parsed wait and wait_interval in xtables_args
    62c3c93d xshared: Move do_parse to shared space
    3039a52c xtables: Do not pass nft_handle to do_parse()
    ece001c2 xtables: Pass xtables_args to check_inverse()
    17abaeb1 xtables: Pass xtables_args to check_empty_interface()
    dc8d8fce xtables: Move struct nft_xt_cmd_parse to xshared.h
    98a4462f xtables: Pull table validity check out of do_parse()
    d83371c7 xtables: Drop xtables' family on demand feature
    49aa44ba nft-shared: set correct register value
    b129b1cf iptables-*-restore: Drop pointless line reference
    316d8efb libxtables: Extend basic_exit_err()
    4bff5aef xtables_globals: Embed variant name in .program_version
    51e5d293 xshared: Share exit_tryhelp()
    56ac0452 xshared: Share a common printhelp function
    4149b5d8 xshared: Share print_match_save() between legacy ip*tables
    273d88a7 extensions: tcpmss: add iptables-translate support
    7213561d xshared: Make load_proto() static
    cf14b92b nft-shared: Drop unused function print_proto()
    24f30842 xshared: Share print_header() with legacy iptables
    a323c283 xshared: Share print_fragment() with legacy
    1d73cec0 xshared: Share print_rule_details() with legacy
    e5fb9f8e xshared: Share save_ipv{4,6}_addr() with legacy
    22f2e1fc xshared: Share save_rule_details() with legacy
    766e4872 xshared: Share print_iface() function
    b5881e7f nft: Change whitespace printing in save_rule callback
    1189d830 xshared: Merge and share parse_chain()
    1eab8e83 extensions: hashlimit: Fix tests with HZ=1000
    afa525ee xlate-test: Print full path if testing all files
    b8d5271d Unbreak xtables-translate
    0af80a91 nft: Merge xtables-arp-standalone.c into xtables-standalone.c
    142cf724 xtables: arptables accepts empty interface names
    ab0a785a xtables: Derive xtables_globals from family
    6cf3976e nft-shared: Make nft_check_xt_legacy() family agnostic
    832a0e2b nft-arp: Introduce post_parse callback
    0aea399d arptables: Use standard data structures when parsing
    fe83b12f libxtables: Introduce xtables_globals print_help callback
    0687852d xtables-standalone: Drop version number from init errors
    dded8ff3 nft: Add family ops callbacks wrapping different nft_cmd_* functions
    38e1fe58 xtables: Simplify addr_mask freeing
    cfdda180 nft-shared: Introduce init_cs family ops callback
    65b150ae xshared: Store optstring in xtables_globals
    2e6014c7 nft: Introduce builtin_tables_lookup()
    db90ff64 tests: shell: fix bashism
    45d8f769 nft: Delete builtin chains compatibly
    e865a853 nft-chain: Introduce base_slot field
    f9b33967 nft: Check base-chain compatibility when adding to cache
    43189612 nft: cache: Avoid double free of unrecognized base-chains
    040a15f2 xtables-translate: add missing argument and option to usage
    2ed6dc75 tests: iptables-test: Fix conditional colors on stderr
    63ab4fe3 ebtables: Avoid dropping policy when flushing
    b714d45d iptables-test.py: print with color escapes only when stdout isatty
    481626bb tests: shell: Return non-zero on error
    7559af83 tests: iptables-test: Exit non-zero on error
    c057939d tests: xlate-test: Exit non-zero on error
    a8da7186 tests: iptables-test: Print errors to stderr
    5166c445 tests: xlate-test: Print errors to stderr
    fa78ff15 tests: xlate-test: Don't skip any input after the first empty line
    fcbe454b tests: iptables-test: Fix missing chain case
    61e85e31 iptables-nft: allow removal of empty builtin chains
    544e7dc1 Fix a few doc typos
    e438b976 nft: Use xtables_{m,c}alloc() everywhere
    ca11c7b7 nft: Use xtables_malloc() in mnl_err_list_node_add()
    cf410aa6 extensions: libxt_mac: Fix for missing space in listing
    7ae14dc1 iptables-test: Make netns spawning more robust
    bef9dc57 extensions: hashlimit: Fix tests with HZ=100
    943fbf3e ip6tables: masquerade: use fully-random so that nft can understand the rule
    ef7781eb libxtables: exit if called by setuid executeable
    8629c53f tests/shell: Assert non-verbose mode is silent
    57d1422d nft: Fix for non-verbose check command
    26318637 ebtables: Dump atomic waste
    765bf04e doc: ebtables-nft.8: Adjust for missing atomic-options
    e727ccad xtables: Call init_extensions6() for static builds
    9e1fffdf extensions: libxt_multiport: add translation for -m multiport --ports
    c8145139 extensions: libxt_conntrack: simplify translation using negation
    1c934617 extensions: libxt_tcp: rework translation to use flags match representation
    bb01e33d extensions: libxt_connlimit: add translation
    62828a6a tests: xlate-test: support multiline expectation
    ba863c4b libxtables: extend xlate infrastructure
    68ed965b extensions: libxt_string: Avoid buffer size warning for strncpy()
    9b85e1ab libxtables: Introduce xtables_strdup() and use it everywhere
    ca840c20 extensions: libebt_ip6: Use xtables_ip6parse_any()
    084671d5 iptables-apply: Drop unused variable
    0729ab37 nft: Avoid buffer size warnings copying iface names
    eab75ed3 nft: Avoid memleak in error path of nft_cmd_new()
    ffe88f8f libxtables: Fix memleak in xtopt_parse_hostmask()
    8bb5bcae extensions: libebt_ip6: Drop unused variables
    97fabae7 libxtables: Drop leftover variable in xtables_numeric_to_ip6addr()
    5818be17 extensions: sctp: Translate --chunk-types option
    a61282ec extensions: sctp: Fix nftables translation
    556f7044 Use proto_to_name() from xshared in more places
    eea68ca8 ebtables-translate: Use shared ebt_get_current_chain() function
    9dc50b5b xshared: Merge invflags handling code
    3664249f xshared: Eliminate iptables_command_state->invert
    f647f61f xtables: Make invflags 16bit wide
    616800af extensions: SECMARK: Implement revision 1
    1e984079 nft-arp: Make use of ipv4_addr_to_string()
    acac2dbe Eliminate inet_aton() and inet_ntoa()
    9084ef29 extensions: sctp: Explain match types in man page
    a3e81c62 nft: Increase BATCH_PAGE_SIZE to support huge rulesets
    fdf64dcd nft: cache: Sort chains on demand only
    c5d9a723 fix build for missing ETH_ALEN definition
    18d7535d extensions: libxt_conntrack: use bitops for status negation
    18e334da extensions: libxt_conntrack: use bitops for state negation
    831f57c7 libxtables: Simplify xtables_ipmask_to_cidr() a bit
    46f9d3a9 xtables-translate: Fix translation of odd netmasks
    330f5df0 nft: Fix bitwise expression avoidance detection
    5f1fcace iptables-nft: fix -Z option
    c9441657 include: Drop libipulog.h
    30c1d443 ebtables: Exit gracefully on invalid table names
    
    Signed-off-by: Nick Hainke <vincent at systemli.org>
---
 package/network/utils/iptables/Makefile            |   7 +-
 ...s-Call-init_extensions6-for-static-builds.patch |  68 ----------
 .../002-xtables-Call-init_extensions_a_b.patch     | 107 ---------------
 .../020-treewide-use-uint-instead-of-u_int.patch   | 144 +++++++++++++++++++++
 ...fix-build-for-missing-ETH_ALEN-definition.patch |  60 +++++++++
 ...ared-Fix-build-for-Werror-format-security.patch |  23 ++++
 ...-build-fix-error-during-out-of-tree-build.patch |  28 ++++
 ...les-unexport-init_extensions-declarations.patch |  82 ++++++++++++
 .../patches/101-remove-check-already.patch         |   4 +-
 .../patches/102-iptables-disable-modprobe.patch    |  13 +-
 .../patches/200-configurable_builtin.patch         |   2 +-
 .../utils/iptables/patches/600-shared-libext.patch |   2 +-
 .../patches/700-disable-legacy-revisions.patch     |  14 +-
 13 files changed, 362 insertions(+), 192 deletions(-)

diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index 6546067553..fdb1aa916b 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=iptables
-PKG_VERSION:=1.8.7
-PKG_RELEASE:=7
+PKG_VERSION:=1.8.8
+PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_HASH:=c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0
+PKG_HASH:=71c75889dc710676631553eb1511da0177bbaaf1b551265b912d236c3f51859f
 
 PKG_FIXUP:=autoreconf
 PKG_FLAGS:=nonshared
@@ -650,7 +650,6 @@ define Build/InstallDev
 	$(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 	$(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 	$(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
-	$(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 	$(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 
 	$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
diff --git a/package/network/utils/iptables/patches/001-xtables-Call-init_extensions6-for-static-builds.patch b/package/network/utils/iptables/patches/001-xtables-Call-init_extensions6-for-static-builds.patch
deleted file mode 100644
index 22ccfa533a..0000000000
--- a/package/network/utils/iptables/patches/001-xtables-Call-init_extensions6-for-static-builds.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From e727ccad036e2cdba3339536c65c7ceef43c0740 Mon Sep 17 00:00:00 2001
-From: Erik Wilson <erik.e.wilson at gmail.com>
-Date: Tue, 13 Jul 2021 16:48:23 -0700
-Subject: [PATCH] xtables: Call init_extensions6() for static builds
-
-Initialize extensions from libext6 for cases where xtables is built statically.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1550
-Signed-off-by: Erik Wilson <Erik.E.Wilson at gmail.com>
-Signed-off-by: Florian Westphal <fw at strlen.de>
----
- iptables/xtables-monitor.c    | 1 +
- iptables/xtables-restore.c    | 1 +
- iptables/xtables-save.c       | 1 +
- iptables/xtables-standalone.c | 1 +
- iptables/xtables-translate.c  | 1 +
- 5 files changed, 5 insertions(+)
-
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -628,6 +628,7 @@ int xtables_monitor_main(int argc, char
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
- 	init_extensions();
- 	init_extensions4();
-+	init_extensions6();
- #endif
- 
- 	if (nft_init(&h, AF_INET, xtables_ipv4)) {
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -364,6 +364,7 @@ xtables_restore_main(int family, const c
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
- 		init_extensions();
- 		init_extensions4();
-+		init_extensions6();
- #endif
- 		break;
- 	case NFPROTO_ARP:
---- a/iptables/xtables-save.c
-+++ b/iptables/xtables-save.c
-@@ -202,6 +202,7 @@ xtables_save_main(int family, int argc,
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
- 		init_extensions();
- 		init_extensions4();
-+		init_extensions6();
- #endif
- 		tables = xtables_ipv4;
- 		d.commit = true;
---- a/iptables/xtables-standalone.c
-+++ b/iptables/xtables-standalone.c
-@@ -57,6 +57,7 @@ xtables_main(int family, const char *pro
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
- 	init_extensions();
- 	init_extensions4();
-+	init_extensions6();
- #endif
- 
- 	if (nft_init(&h, family, xtables_ipv4) < 0) {
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -469,6 +469,7 @@ static int xtables_xlate_main_common(str
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
- 	init_extensions();
- 	init_extensions4();
-+	init_extensions6();
- #endif
- 		tables = xtables_ipv4;
- 		break;
diff --git a/package/network/utils/iptables/patches/002-xtables-Call-init_extensions_a_b.patch b/package/network/utils/iptables/patches/002-xtables-Call-init_extensions_a_b.patch
deleted file mode 100644
index 0d7226ccd5..0000000000
--- a/package/network/utils/iptables/patches/002-xtables-Call-init_extensions_a_b.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-A modified version of this patch was commited upstream
-as part of a fixup series
-https://bugzilla.netfilter.org/show_bug.cgi?id=1593
-https://git.netfilter.org/iptables/commit/?id=0836524f093c0fd9c39604a46a949e43d9b47ef2
-
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -629,6 +629,8 @@ int xtables_monitor_main(int argc, char
- 	init_extensions();
- 	init_extensions4();
- 	init_extensions6();
-+	init_extensionsa();
-+	init_extensionsb();
- #endif
- 
- 	if (nft_init(&h, AF_INET, xtables_ipv4)) {
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -368,9 +368,17 @@ xtables_restore_main(int family, const c
- #endif
- 		break;
- 	case NFPROTO_ARP:
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsa();
-+#endif
- 		tables = xtables_arp;
- 		break;
- 	case NFPROTO_BRIDGE:
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsb();
-+#endif
- 		tables = xtables_bridge;
- 		break;
- 	default:
---- a/iptables/xtables-save.c
-+++ b/iptables/xtables-save.c
-@@ -208,9 +208,17 @@ xtables_save_main(int family, int argc,
- 		d.commit = true;
- 		break;
- 	case NFPROTO_ARP:
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsa();
-+#endif
- 		tables = xtables_arp;
- 		break;
- 	case NFPROTO_BRIDGE: {
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsb();
-+#endif
- 		const char *ctr = getenv("EBTABLES_SAVE_COUNTER");
- 
- 		if (!(d.format & FMT_NOCOUNTS)) {
---- a/iptables/xtables-standalone.c
-+++ b/iptables/xtables-standalone.c
-@@ -58,6 +58,8 @@ xtables_main(int family, const char *pro
- 	init_extensions();
- 	init_extensions4();
- 	init_extensions6();
-+	init_extensionsa();
-+	init_extensionsb();
- #endif
- 
- 	if (nft_init(&h, family, xtables_ipv4) < 0) {
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -474,9 +474,17 @@ static int xtables_xlate_main_common(str
- 		tables = xtables_ipv4;
- 		break;
- 	case NFPROTO_ARP:
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsa();
-+#endif
- 		tables = xtables_arp;
- 		break;
- 	case NFPROTO_BRIDGE:
-+#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+		init_extensions();
-+		init_extensionsb();
-+#endif
- 		tables = xtables_bridge;
- 		break;
- 	default:
---- a/iptables/xtables-arp.c
-+++ b/iptables/xtables-arp.c
-@@ -438,6 +438,7 @@ int nft_init_arp(struct nft_handle *h, c
- 	}
- 
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+	init_extensions();
- 	init_extensionsa();
- #endif
- 
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -685,6 +685,7 @@ int nft_init_eb(struct nft_handle *h, co
- 	}
- 
- #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-+	init_extensions();
- 	init_extensionsb();
- #endif
- 
diff --git a/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch b/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch
new file mode 100644
index 0000000000..e4b0cd92de
--- /dev/null
+++ b/package/network/utils/iptables/patches/020-treewide-use-uint-instead-of-u_int.patch
@@ -0,0 +1,144 @@
+From f319389525b066b7dc6d389c88f16a0df3b8f189 Mon Sep 17 00:00:00 2001
+From: Nick Hainke <vincent at systemli.org>
+Date: Mon, 16 May 2022 18:16:41 +0200
+Subject: treewide: use uint* instead of u_int*
+
+Gcc complains about missing types. Some commits introduced u_int* instead
+of uint*. Use uint treewide.
+
+Fixes errors in the form of:
+In file included from xtables-legacy-multi.c:5:
+xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'?
+    83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
+        |                                                        ^~~~~~~~~
+        |                                                        uint16_t
+make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1
+
+Avoid libipq API breakage by adjusting libipq.h include accordingly. For
+arpt_mangle.h kernel uAPI header, apply same change as in kernel commit
+e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t").
+
+Signed-off-by: Nick Hainke <vincent at systemli.org>
+Signed-off-by: Phil Sutter <phil at nwl.cc>
+---
+ extensions/libxt_conntrack.c              | 2 +-
+ include/libipq/libipq.h                   | 8 ++++----
+ include/libiptc/libxtc.h                  | 2 +-
+ include/linux/netfilter_arp/arpt_mangle.h | 2 +-
+ iptables/xshared.c                        | 2 +-
+ iptables/xshared.h                        | 2 +-
+ libipq/ipq_create_handle.3                | 2 +-
+ libipq/ipq_set_mode.3                     | 2 +-
+ 8 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -778,7 +778,7 @@ matchinfo_print(const void *ip, const st
+ 
+ static void
+ conntrack_dump_ports(const char *prefix, const char *opt,
+-		     u_int16_t port_low, u_int16_t port_high)
++		     uint16_t port_low, uint16_t port_high)
+ {
+ 	if (port_high == 0 || port_low == port_high)
+ 		printf(" %s%s %u", prefix, opt, port_low);
+--- a/include/libipq/libipq.h
++++ b/include/libipq/libipq.h
+@@ -24,7 +24,7 @@
+ #include <errno.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+-#include <sys/types.h>
++#include <stdint.h>
+ #include <sys/socket.h>
+ #include <sys/uio.h>
+ #include <asm/types.h>
+@@ -48,19 +48,19 @@ typedef unsigned long ipq_id_t;
+ struct ipq_handle
+ {
+ 	int fd;
+-	u_int8_t blocking;
++	uint8_t blocking;
+ 	struct sockaddr_nl local;
+ 	struct sockaddr_nl peer;
+ };
+ 
+-struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol);
++struct ipq_handle *ipq_create_handle(uint32_t flags, uint32_t protocol);
+ 
+ int ipq_destroy_handle(struct ipq_handle *h);
+ 
+ ssize_t ipq_read(const struct ipq_handle *h,
+                 unsigned char *buf, size_t len, int timeout);
+ 
+-int ipq_set_mode(const struct ipq_handle *h, u_int8_t mode, size_t len);
++int ipq_set_mode(const struct ipq_handle *h, uint8_t mode, size_t len);
+ 
+ ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf);
+ 
+--- a/include/libiptc/libxtc.h
++++ b/include/libiptc/libxtc.h
+@@ -10,7 +10,7 @@ extern "C" {
+ #endif
+ 
+ #ifndef XT_MIN_ALIGN
+-/* xt_entry has pointers and u_int64_t's in it, so if you align to
++/* xt_entry has pointers and uint64_t's in it, so if you align to
+    it, you'll also align to any crazy matches and targets someone
+    might write */
+ #define XT_MIN_ALIGN (__alignof__(struct xt_entry))
+--- a/include/linux/netfilter_arp/arpt_mangle.h
++++ b/include/linux/netfilter_arp/arpt_mangle.h
+@@ -13,7 +13,7 @@ struct arpt_mangle
+ 	union {
+ 		struct in_addr tgt_ip;
+ 	} u_t;
+-	u_int8_t flags;
++	__u8 flags;
+ 	int target;
+ };
+ 
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -1025,7 +1025,7 @@ static const int inverse_for_options[NUM
+ };
+ 
+ void
+-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
++set_option(unsigned int *options, unsigned int option, uint16_t *invflg,
+ 	   bool invert)
+ {
+ 	if (*options & option)
+--- a/iptables/xshared.h
++++ b/iptables/xshared.h
+@@ -80,7 +80,7 @@ struct xtables_target;
+ #define IPT_INV_ARPHRD		0x0800
+ 
+ void
+-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
++set_option(unsigned int *options, unsigned int option, uint16_t *invflg,
+ 	   bool invert);
+ 
+ /**
+--- a/libipq/ipq_create_handle.3
++++ b/libipq/ipq_create_handle.3
+@@ -24,7 +24,7 @@ ipq_create_handle, ipq_destroy_handle \(
+ .br
+ .B #include <libipq.h>
+ .sp
+-.BI "struct ipq_handle *ipq_create_handle(u_int32_t " flags ", u_int32_t " protocol ");"
++.BI "struct ipq_handle *ipq_create_handle(uint32_t " flags ", uint32_t " protocol ");"
+ .br
+ .BI "int ipq_destroy_handle(struct ipq_handle *" h );
+ .SH DESCRIPTION
+--- a/libipq/ipq_set_mode.3
++++ b/libipq/ipq_set_mode.3
+@@ -24,7 +24,7 @@ ipq_set_mode \(em set the ip_queue queui
+ .br
+ .B #include <libipq.h>
+ .sp
+-.BI "int ipq_set_mode(const struct ipq_handle *" h ", u_int8_t " mode ", size_t " range );
++.BI "int ipq_set_mode(const struct ipq_handle *" h ", uint8_t " mode ", size_t " range );
+ .SH DESCRIPTION
+ The
+ .B ipq_set_mode
diff --git a/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch b/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch
new file mode 100644
index 0000000000..6c8e3deb5c
--- /dev/null
+++ b/package/network/utils/iptables/patches/030-revert-fix-build-for-missing-ETH_ALEN-definition.patch
@@ -0,0 +1,60 @@
+From 0e7cf0ad306cdf95dc3c28d15a254532206a888e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil at nwl.cc>
+Date: Wed, 18 May 2022 16:04:09 +0200
+Subject: Revert "fix build for missing ETH_ALEN definition"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke
+compiling against musl libc. Might be a bug in the latter, but for the
+time being try to please both by avoiding the include and instead
+defining ETH_ALEN if unset.
+
+While being at it, move netinet/ether.h include up.
+
+Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support")
+Signed-off-by: Phil Sutter <phil at nwl.cc>
+Reviewed-by: Maciej Żenczykowski <maze at google.com>
+---
+ libxtables/xtables.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -28,6 +28,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <unistd.h>
++#include <netinet/ether.h>
+ #include <sys/socket.h>
+ #include <sys/stat.h>
+ #include <sys/statfs.h>
+@@ -45,7 +46,6 @@
+ 
+ #include <xtables.h>
+ #include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */
+-#include <linux/if_ether.h> /* ETH_ALEN */
+ #include <linux/netfilter_ipv4/ip_tables.h>
+ #include <linux/netfilter_ipv6/ip6_tables.h>
+ #include <libiptc/libxtc.h>
+@@ -72,6 +72,10 @@
+ #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
+ #endif
+ 
++#ifndef ETH_ALEN
++#define ETH_ALEN 6
++#endif
++
+ /* we need this for ip6?tables-restore.  ip6?tables-restore.c sets line to the
+  * current line of the input file, in order  to give a more precise error
+  * message.  ip6?tables itself doesn't need this, so it is initialized to the
+@@ -2245,8 +2249,6 @@ void xtables_print_num(uint64_t number,
+ 	printf(FMT("%4lluT ","%lluT "), (unsigned long long)number);
+ }
+ 
+-#include <netinet/ether.h>
+-
+ static const unsigned char mac_type_unicast[ETH_ALEN] =   {};
+ static const unsigned char msk_type_unicast[ETH_ALEN] =   {1};
+ static const unsigned char mac_type_multicast[ETH_ALEN] = {1};
diff --git a/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch b/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch
new file mode 100644
index 0000000000..f7e5e34c73
--- /dev/null
+++ b/package/network/utils/iptables/patches/040-xshared-Fix-build-for-Werror-format-security.patch
@@ -0,0 +1,23 @@
+From b72eb12ea5a61df0655ad99d5048994e916be83a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil at nwl.cc>
+Date: Fri, 13 May 2022 16:51:58 +0200
+Subject: [PATCH] xshared: Fix build for -Werror=format-security
+
+Gcc complains about the omitted format string.
+
+Signed-off-by: Phil Sutter <phil at nwl.cc>
+---
+ iptables/xshared.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct
+ 		return;
+ 
+ 	if (args->family != NFPROTO_ARP)
+-		xtables_error(PARAMETER_PROBLEM, msg);
++		xtables_error(PARAMETER_PROBLEM, "%s", msg);
+ 
+ 	fprintf(stderr, "%s", msg);
+ }
diff --git a/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch b/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch
new file mode 100644
index 0000000000..acfca96e0f
--- /dev/null
+++ b/package/network/utils/iptables/patches/050-build-fix-error-during-out-of-tree-build.patch
@@ -0,0 +1,28 @@
+From 0ebf52fc951b2a4d98a166afb34af4f364bbeece Mon Sep 17 00:00:00 2001
+From: Ben Brown <ben at demerara.io>
+Date: Wed, 25 May 2022 16:26:13 +0100
+Subject: build: Fix error during out of tree build
+
+Fixes the following error:
+
+    ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory
+       52 | #include <libiptc/linux_list.h>
+
+Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table")
+Signed-off-by: Ben Brown <ben at demerara.io>
+Signed-off-by: Phil Sutter <phil at nwl.cc>
+---
+ libxtables/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/libxtables/Makefile.am
++++ b/libxtables/Makefile.am
+@@ -1,7 +1,7 @@
+ # -*- Makefile -*-
+ 
+ AM_CFLAGS   = ${regular_CFLAGS}
+-AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables ${kinclude_CPPFLAGS}
++AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables -I${top_srcdir} ${kinclude_CPPFLAGS}
+ 
+ lib_LTLIBRARIES       = libxtables.la
+ libxtables_la_SOURCES = xtables.c xtoptions.c getethertype.c
diff --git a/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch b/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch
new file mode 100644
index 0000000000..559b93eea4
--- /dev/null
+++ b/package/network/utils/iptables/patches/060-libxtables-unexport-init_extensions-declarations.patch
@@ -0,0 +1,82 @@
+From ef108943f69a6e20533d58823740d3f0534ea8ec Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil at nwl.cc>
+Date: Wed, 1 Jun 2022 19:15:06 +0200
+Subject: libxtables: Unexport init_extensions*() declarations
+
+The functions are used for static builds to initialize extensions after
+libxtables init. Regular library users should not need them, but the
+empty declarations introduced in #else case (and therefore present in
+user's env) may clash with existing symbol names.
+
+Avoid problems and guard the whole block declaring the function
+prototypes and mangling extensions' _init functions by XTABLES_INTERNAL.
+
+Reported-by: Nick Hainke <vincent at systemli.org>
+Fixes: 6c689b639cf8e ("Simplify static build extension loading")
+Signed-off-by: Phil Sutter <phil at nwl.cc>
+---
+ include/xtables.h | 44 ++++++++++++++++++++++----------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+--- a/include/xtables.h
++++ b/include/xtables.h
+@@ -585,27 +585,6 @@ static inline void xtables_print_mark_ma
+ 	xtables_print_val_mask(mark, mask, NULL);
+ }
+ 
+-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
+-#	ifdef _INIT
+-#		undef _init
+-#		define _init _INIT
+-#	endif
+-	extern void init_extensions(void);
+-	extern void init_extensions4(void);
+-	extern void init_extensions6(void);
+-	extern void init_extensionsa(void);
+-	extern void init_extensionsb(void);
+-#else
+-#	define _init __attribute__((constructor)) _INIT
+-#	define EMPTY_FUNC_DEF(x) static inline void x(void) {}
+-	EMPTY_FUNC_DEF(init_extensions)
+-	EMPTY_FUNC_DEF(init_extensions4)
+-	EMPTY_FUNC_DEF(init_extensions6)
+-	EMPTY_FUNC_DEF(init_extensionsa)
+-	EMPTY_FUNC_DEF(init_extensionsb)
+-#	undef EMPTY_FUNC_DEF
+-#endif
+-
+ extern const struct xtables_pprot xtables_chain_protos[];
+ extern uint16_t xtables_parse_protocol(const char *s);
+ 
+@@ -663,9 +642,30 @@ void xtables_announce_chain(const char *
+ #		define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
+ #	endif
+ 
++#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
++#	ifdef _INIT
++#		undef _init
++#		define _init _INIT
++#	endif
++	extern void init_extensions(void);
++	extern void init_extensions4(void);
++	extern void init_extensions6(void);
++	extern void init_extensionsa(void);
++	extern void init_extensionsb(void);
++#else
++#	define _init __attribute__((constructor)) _INIT
++#	define EMPTY_FUNC_DEF(x) static inline void x(void) {}
++	EMPTY_FUNC_DEF(init_extensions)
++	EMPTY_FUNC_DEF(init_extensions4)
++	EMPTY_FUNC_DEF(init_extensions6)
++	EMPTY_FUNC_DEF(init_extensionsa)
++	EMPTY_FUNC_DEF(init_extensionsb)
++#	undef EMPTY_FUNC_DEF
++#endif
++
+ extern void _init(void);
+ 
+-#endif
++#endif /* XTABLES_INTERNAL */
+ 
+ #ifdef __cplusplus
+ } /* extern "C" */
diff --git a/package/network/utils/iptables/patches/101-remove-check-already.patch b/package/network/utils/iptables/patches/101-remove-check-already.patch
index 16afafec2d..bd49224c70 100644
--- a/package/network/utils/iptables/patches/101-remove-check-already.patch
+++ b/package/network/utils/iptables/patches/101-remove-check-already.patch
@@ -1,6 +1,6 @@
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -968,12 +968,6 @@ void xtables_register_match(struct xtabl
+@@ -1093,12 +1093,6 @@ void xtables_register_match(struct xtabl
  	struct xtables_match **pos;
  	bool seen_myself = false;
  
@@ -13,7 +13,7 @@
  	if (me->version == NULL) {
  		fprintf(stderr, "%s: match %s<%u> is missing a version\n",
  		        xt_params->program_name, me->name, me->revision);
-@@ -1152,12 +1146,6 @@ void xtables_register_target(struct xtab
+@@ -1277,12 +1271,6 @@ void xtables_register_target(struct xtab
  	struct xtables_target **pos;
  	bool seen_myself = false;
  
diff --git a/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
index b8e19c781a..710f481cac 100644
--- a/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
+++ b/package/network/utils/iptables/patches/102-iptables-disable-modprobe.patch
@@ -1,6 +1,15 @@
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -403,6 +403,7 @@ static char *get_modprobe(void)
+@@ -476,7 +476,7 @@ char *xtables_strdup(const char *s)
+ 	return dup;
+ }
+ 
+-static char *get_modprobe(void)
++__attribute__((unused)) static char *get_modprobe(void)
+ {
+ 	int procfile;
+ 	char *ret;
+@@ -511,6 +511,7 @@ static char *get_modprobe(void)
  
  int xtables_insmod(const char *modname, const char *modprobe, bool quiet)
  {
@@ -8,7 +17,7 @@
  	char *buf = NULL;
  	char *argv[4];
  	int status;
-@@ -437,6 +438,7 @@ int xtables_insmod(const char *modname,
+@@ -545,6 +546,7 @@ int xtables_insmod(const char *modname,
  	free(buf);
  	if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
  		return 0;
diff --git a/package/network/utils/iptables/patches/200-configurable_builtin.patch b/package/network/utils/iptables/patches/200-configurable_builtin.patch
index 6d7b5b5822..75c29e1e9c 100644
--- a/package/network/utils/iptables/patches/200-configurable_builtin.patch
+++ b/package/network/utils/iptables/patches/200-configurable_builtin.patch
@@ -60,7 +60,7 @@
  
  .SECONDARY:
  
-@@ -161,11 +181,11 @@ libext4.a: initext4.o ${libext4_objs}
+@@ -163,11 +183,11 @@ libext4.a: initext4.o ${libext4_objs}
  libext6.a: initext6.o ${libext6_objs}
  	${AM_VERBOSE_AR} ${AR} crs $@ $^;
  
diff --git a/package/network/utils/iptables/patches/600-shared-libext.patch b/package/network/utils/iptables/patches/600-shared-libext.patch
index 819f628f9e..838b1ffa66 100644
--- a/package/network/utils/iptables/patches/600-shared-libext.patch
+++ b/package/network/utils/iptables/patches/600-shared-libext.patch
@@ -18,7 +18,7 @@
  
  -include .*.d
  
-@@ -164,22 +164,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
+@@ -166,22 +166,22 @@ xt_connlabel_LIBADD = @libnetfilter_conn
  #	handling code in the Makefiles.
  #
  lib%.o: ${srcdir}/lib%.c
diff --git a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
index cc451ef959..09db390006 100644
--- a/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
+++ b/package/network/utils/iptables/patches/700-disable-legacy-revisions.patch
@@ -1,6 +1,6 @@
 --- a/extensions/libxt_conntrack.c
 +++ b/extensions/libxt_conntrack.c
-@@ -1395,6 +1395,7 @@ static int conntrack3_mt6_xlate(struct x
+@@ -1399,6 +1399,7 @@ static int conntrack3_mt6_xlate(struct x
  }
  
  static struct xtables_match conntrack_mt_reg[] = {
@@ -8,7 +8,7 @@
  	{
  		.version       = XTABLES_VERSION,
  		.name          = "conntrack",
-@@ -1470,6 +1471,7 @@ static struct xtables_match conntrack_mt
+@@ -1474,6 +1475,7 @@ static struct xtables_match conntrack_mt
  		.alias	       = conntrack_print_name_alias,
  		.x6_options    = conntrack2_mt_opts,
  	},
@@ -16,7 +16,7 @@
  	{
  		.version       = XTABLES_VERSION,
  		.name          = "conntrack",
-@@ -1502,6 +1504,7 @@ static struct xtables_match conntrack_mt
+@@ -1506,6 +1508,7 @@ static struct xtables_match conntrack_mt
  		.x6_options    = conntrack3_mt_opts,
  		.xlate	       = conntrack3_mt6_xlate,
  	},
@@ -24,7 +24,7 @@
  	{
  		.family        = NFPROTO_UNSPEC,
  		.name          = "state",
-@@ -1532,6 +1535,8 @@ static struct xtables_match conntrack_mt
+@@ -1536,6 +1539,8 @@ static struct xtables_match conntrack_mt
  		.x6_parse      = state_ct23_parse,
  		.x6_options    = state_opts,
  	},
@@ -33,7 +33,7 @@
  	{
  		.family        = NFPROTO_UNSPEC,
  		.name          = "state",
-@@ -1561,6 +1566,7 @@ static struct xtables_match conntrack_mt
+@@ -1565,6 +1570,7 @@ static struct xtables_match conntrack_mt
  		.x6_parse      = state_parse,
  		.x6_options    = state_opts,
  	},
@@ -77,7 +77,7 @@
  void _init(void)
 --- a/extensions/libxt_multiport.c
 +++ b/extensions/libxt_multiport.c
-@@ -571,6 +571,7 @@ static int multiport_xlate6_v1(struct xt
+@@ -591,6 +591,7 @@ static int multiport_xlate6_v1(struct xt
  }
  
  static struct xtables_match multiport_mt_reg[] = {
@@ -85,7 +85,7 @@
  	{
  		.family        = NFPROTO_IPV4,
  		.name          = "multiport",
-@@ -601,6 +602,7 @@ static struct xtables_match multiport_mt
+@@ -621,6 +622,7 @@ static struct xtables_match multiport_mt
  		.x6_options    = multiport_opts,
  		.xlate         = multiport_xlate6,
  	},




More information about the lede-commits mailing list