mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
c57bcf0d43
Since kernels 6.17, support for netfilter legacy tables were disabled by default [1] but iptables package needs Netfilter legacy tables support enabled in the kernel when nftables compat is not enabled. Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17. Fixes: [BRTEST# iptables --flush modprobe: module ip_tables not found in modules.dep iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. On the other hand, when nftables compat (iptables-nft) is used by default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable nft protocol support in the kernel. iptables --version iptables: Failed to initialize nft: Protocol not supported Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with CONFIG_NFT_SOCKET needed to pass the TestIptables with nftables compat (iptables-nft) enabled. Without CONFIG_NFT_SOCKET: iptables --policy INPUT ACCEPT iptables v1.8.11 (nf_tables): TABLE_ADD failed (Operation not supported): table filter So, enable kernel support for iptables-legacy only if nftables compat is not enabled by default. Enable iptables-nft support when nftables compat is enabled, even if not used by default. [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6 Signed-off-by: Romain Naour <romain.naour@smile.fr> [Fiona: fix typo in commit message] Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
99 lines
3.3 KiB
Makefile
99 lines
3.3 KiB
Makefile
################################################################################
|
|
#
|
|
# iptables
|
|
#
|
|
################################################################################
|
|
|
|
IPTABLES_VERSION = 1.8.11
|
|
IPTABLES_SOURCE = iptables-$(IPTABLES_VERSION).tar.xz
|
|
IPTABLES_SITE = https://netfilter.org/projects/iptables/files
|
|
IPTABLES_INSTALL_STAGING = YES
|
|
IPTABLES_DEPENDENCIES = host-pkgconf
|
|
IPTABLES_LICENSE = GPL-2.0
|
|
IPTABLES_LICENSE_FILES = COPYING
|
|
IPTABLES_CPE_ID_VENDOR = netfilter
|
|
IPTABLES_SELINUX_MODULES = iptables
|
|
|
|
# Building static causes ugly warnings on some plugins
|
|
IPTABLES_CONF_OPTS = --libexecdir=/usr/lib --with-kernel=$(STAGING_DIR)/usr \
|
|
$(if $(BR2_STATIC_LIBS),,--disable-static)
|
|
|
|
# For connlabel match
|
|
ifeq ($(BR2_PACKAGE_LIBNETFILTER_CONNTRACK),y)
|
|
IPTABLES_DEPENDENCIES += libnetfilter_conntrack
|
|
endif
|
|
|
|
# For nfnl_osf
|
|
ifeq ($(BR2_PACKAGE_LIBNFNETLINK),y)
|
|
IPTABLES_DEPENDENCIES += libnfnetlink
|
|
endif
|
|
|
|
# For iptables-compat tools
|
|
ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES),y)
|
|
IPTABLES_CONF_OPTS += --enable-nftables
|
|
IPTABLES_DEPENDENCIES += host-bison host-flex libmnl libnftnl
|
|
else
|
|
IPTABLES_CONF_OPTS += --disable-nftables
|
|
endif
|
|
|
|
# bpf compiler support and nfsynproxy tool
|
|
ifeq ($(BR2_PACKAGE_IPTABLES_BPF_NFSYNPROXY),y)
|
|
# libpcap is tricky for static-only builds and needs help
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
IPTABLES_LIBS_FOR_STATIC_LINK += `$(STAGING_DIR)/usr/bin/pcap-config --static --additional-libs`
|
|
IPTABLES_CONF_OPTS += LIBS="$(IPTABLES_LIBS_FOR_STATIC_LINK)"
|
|
endif
|
|
IPTABLES_CONF_OPTS += --enable-bpf-compiler --enable-nfsynproxy
|
|
IPTABLES_DEPENDENCIES += libpcap
|
|
else
|
|
IPTABLES_CONF_OPTS += --disable-bpf-compiler --disable-nfsynproxy
|
|
endif
|
|
|
|
# Enable kernel support for iptables-nft even if nftables compat is not
|
|
# enabled by default.
|
|
ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES),y)
|
|
define IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_NFT
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NF_TABLES)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NF_TABLES_INET)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NFT_SOCKET)
|
|
endef
|
|
endif
|
|
|
|
# Enable kernel support for iptables-legacy only if nftables compat is not
|
|
# enabled by default.
|
|
ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT),)
|
|
define IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_LEGACY
|
|
# [for Linux kernel versions 6.17 and later]
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES_LEGACY)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES_LEGACY)
|
|
endef
|
|
endif
|
|
|
|
define IPTABLES_LINUX_CONFIG_FIXUPS
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER)
|
|
$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES)
|
|
$(IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_LEGACY)
|
|
$(IPTABLES_LINUX_CONFIG_FIXUPS_IPTABLES_NFT)
|
|
endef
|
|
|
|
define IPTABLES_INSTALL_INIT_SYSV
|
|
$(INSTALL) -m 0755 -D package/iptables/S35iptables \
|
|
$(TARGET_DIR)/etc/init.d/S35iptables
|
|
endef
|
|
|
|
ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT),y)
|
|
define IPTABLES_MAKE_NFTABLES_DEFAULT
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables-restore
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables-save
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables-restore
|
|
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables-save
|
|
endef
|
|
IPTABLES_POST_INSTALL_TARGET_HOOKS += IPTABLES_MAKE_NFTABLES_DEFAULT
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|