diff options
Diffstat (limited to 'import-layers/yocto-poky/meta/recipes-extended/iptables/iptables')
4 files changed, 166 insertions, 0 deletions
diff --git a/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch new file mode 100644 index 000000000..b711b7aa3 --- /dev/null +++ b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-configure-Add-option-to-enable-disable-libnfnetlink.patch @@ -0,0 +1,37 @@ +[PATCH] configure: Add option to enable/disable libnfnetlink + +This changes the configure behaviour from autodetecting +for libnfnetlink to having an option to disable it explicitly + +Upstream-Status: Pending + +Signed-off-by: Khem Raj <raj.khem@gmail.com> +Signed-off-by: Maxin B. John <maxin.john@intel.com> +--- +diff -Naur iptables-1.6.0-old/configure.ac iptables-1.6.0/configure.ac +--- iptables-1.6.0-old/configure.ac 2015-12-28 18:40:35.255417976 +0200 ++++ iptables-1.6.0/configure.ac 2015-12-29 13:01:12.388840200 +0200 +@@ -63,6 +63,9 @@ + AC_ARG_ENABLE([nftables], + AS_HELP_STRING([--disable-nftables], [Do not build nftables compat]), + [enable_nftables="$enableval"], [enable_nftables="yes"]) ++AC_ARG_ENABLE([libnfnetlink], ++ AS_HELP_STRING([--disable-libnfnetlink], [Do not use netfilter netlink library]), ++ [enable_libnfnetlink="$enableval"], [enable_libnfnetlink="yes"]) + + libiptc_LDFLAGS2=""; + AX_CHECK_LINKER_FLAGS([-Wl,--no-as-needed], +@@ -123,9 +126,10 @@ + AC_CHECK_LIB(pcap, pcap_compile,, AC_MSG_ERROR(missing libpcap library required by bpf compiler or nfsynproxy tool)) + fi + +-PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0], +- [nfnetlink=1], [nfnetlink=0]) +-AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "$nfnetlink" = 1]) ++AS_IF([test "x$enable_libnfnetlink" = "xyes"], [ ++ PKG_CHECK_MODULES([libnfnetlink], [libnfnetlink >= 1.0]) ++ ]) ++AM_CONDITIONAL([HAVE_LIBNFNETLINK], [test "x$enable_libnfnetlink" = "xyes"]) + + if test "x$enable_nftables" = "xyes"; then + PKG_CHECK_MODULES([libmnl], [libmnl >= 1.0], [mnl=1], [mnl=0]) diff --git a/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-fix-build-with-musl.patch b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-fix-build-with-musl.patch new file mode 100644 index 000000000..f1f85a6fa --- /dev/null +++ b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0001-fix-build-with-musl.patch @@ -0,0 +1,46 @@ +[PATCH] fix build with musl + +Define additional TCOPTS if not there +u_initX types are in sys/types.h be explicit about it + +Upstream-Status: Pending + +Signed-off-by: Khem Raj <raj.khem@gmail.com> +Signed-off-by: Maxin B. John <maxin.john@intel.com> +--- +diff -Naur iptables-1.6.0-origin/extensions/libxt_TCPOPTSTRIP.c iptables-1.6.0/extensions/libxt_TCPOPTSTRIP.c +--- iptables-1.6.0-origin/extensions/libxt_TCPOPTSTRIP.c 2015-12-09 14:55:06.000000000 +0200 ++++ iptables-1.6.0/extensions/libxt_TCPOPTSTRIP.c 2015-12-29 14:44:32.585327077 +0200 +@@ -12,6 +12,21 @@ + #ifndef TCPOPT_MD5SIG + # define TCPOPT_MD5SIG 19 + #endif ++#ifndef TCPOPT_MAXSEG ++#define TCPOPT_MAXSEG 2 ++#endif ++#ifndef TCPOPT_WINDOW ++#define TCPOPT_WINDOW 3 ++#endif ++#ifndef TCPOPT_SACK_PERMITTED ++#define TCPOPT_SACK_PERMITTED 4 ++#endif ++#ifndef TCPOPT_SACK ++#define TCPOPT_SACK 5 ++#endif ++#ifndef TCPOPT_TIMESTAMP ++#define TCPOPT_TIMESTAMP 8 ++#endif + + enum { + O_STRIP_OPTION = 0, +diff -Naur iptables-1.6.0-origin/include/linux/netfilter_ipv4/ip_tables.h iptables-1.6.0/include/linux/netfilter_ipv4/ip_tables.h +--- iptables-1.6.0-origin/include/linux/netfilter_ipv4/ip_tables.h 2015-12-09 14:55:06.000000000 +0200 ++++ iptables-1.6.0/include/linux/netfilter_ipv4/ip_tables.h 2015-12-29 14:40:21.250469195 +0200 +@@ -15,6 +15,7 @@ + #ifndef _IPTABLES_H + #define _IPTABLES_H + ++#include <sys/types.h> + #include <linux/types.h> + + #include <linux/netfilter_ipv4.h> diff --git a/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch new file mode 100644 index 000000000..89ad8f666 --- /dev/null +++ b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch @@ -0,0 +1,34 @@ +Package libnetfilter-conntrack depends on package libnfnetlink. iptables +checks package libnetfilter-conntrack whatever its package config +libnfnetlink is enabled or not. When libnfnetlink is disabled but +package libnetfilter-conntrack exists, it fails randomly with: + +| In file included from .../iptables/1.4.21-r0/iptables-1.4.21/extensions/libxt_connlabel.c:8:0: +| .../tmp/sysroots/qemumips/usr/include/libnetfilter_conntrack/libnetfilter_conntrack.h:14:42: fatal error: libnfnetlink/linux_nfnetlink.h: No such file or directory +| compilation terminated. +| GNUmakefile:96: recipe for target 'libxt_connlabel.oo' failed + +Only check libnetfilter-conntrack when libnfnetlink is enabled to fix it. + +Upstream-Status: Pending + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +diff --git a/configure.ac b/configure.ac +index 5d7e62b..e331ee7 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -88,8 +88,12 @@ if test "$ac_cv_header_linux_ip_vs_h" != "yes"; then + blacklist_modules="$blacklist_modules ipvs"; + fi; + +-PKG_CHECK_MODULES([libnetfilter_conntrack], [libnetfilter_conntrack >= 1.0.4], ++nfconntrack=0 ++AS_IF([test "x$enable_libnfnetlink" = "xyes"], [ ++ PKG_CHECK_MODULES([libnetfilter_conntrack], [libnetfilter_conntrack >= 1.0.4], + [nfconntrack=1], [nfconntrack=0]) ++ ]) ++ + AM_CONDITIONAL([HAVE_LIBNETFILTER_CONNTRACK], [test "$nfconntrack" = 1]) + + if test "$nfconntrack" -ne 1; then diff --git a/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/types.h-add-defines-that-are-required-for-if_packet.patch b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/types.h-add-defines-that-are-required-for-if_packet.patch new file mode 100644 index 000000000..24ee29e2d --- /dev/null +++ b/import-layers/yocto-poky/meta/recipes-extended/iptables/iptables/types.h-add-defines-that-are-required-for-if_packet.patch @@ -0,0 +1,49 @@ +From 19593491f43b70c1a71c3b9b8f4ff4fd14500014 Mon Sep 17 00:00:00 2001 +From: Bruce Ashfield <bruce.ashfield@windriver.com> +Date: Fri, 23 Mar 2012 14:27:20 -0400 +Subject: [PATCH] types.h: add defines that are required for if_packet.h + +The iptables local linux/types.h overrides the kernel/sysroot +types.h. As such, we need to provide some defines that are required +to build against 3.2+ kernel headers. + +ifndef protection is provided for the defines to ensure that +configuration that already have these defines are still buildable. + +This commit is temporary until a new version of iptables can be +used that contains the defines. + +This is similar to the commit in the iptables git repository: + + https://git.netfilter.org/cgi-bin/gitweb.cgi?p=iptables.git;a=commit;h=dbe77cc974cee656eae37e75039dd1a410a4535b + +Upstream-Status: Backport + +Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com> +--- + include/linux/types.h | 10 ++++++++++ + 1 files changed, 10 insertions(+), 0 deletions(-) + +diff --git a/include/linux/types.h b/include/linux/types.h +index 8b483c8..ebf6432 100644 +--- a/include/linux/types.h ++++ b/include/linux/types.h +@@ -34,5 +34,15 @@ typedef __u64 __bitwise __be64; + typedef __u16 __bitwise __sum16; + typedef __u32 __bitwise __wsum; + ++#ifndef __aligned_u64 ++#define __aligned_u64 __u64 __attribute__((aligned(8))) ++#endif ++#ifndef __aligned_be64 ++#define __aligned_be64 __be64 __attribute__((aligned(8))) ++#endif ++#ifndef __aligned_le64 ++#define __aligned_le64 __le64 __attribute__((aligned(8))) ++#endif ++ + #endif /* __ASSEMBLY__ */ + #endif /* _LINUX_TYPES_H */ +-- +1.7.0.4 + |
