167 Commits

Author SHA1 Message Date
Peter Marko
4d1817df45
nftables: remove python dependency from main package
The recipe splits python code to nftables-python package, however
setuptools classes add the dependency to main package.
Since nftables-python package already has python3-core explicit
dependency, remove it from the main package.

(From meta-openembedded rev: 331126a6d0a48ebcf12069df554b3abacaeb512a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2025-12-09 07:01:16 +05:30
Ankur Tyagi
b1caeb9438 arno-iptables-firewall: upgrade 2.1.1 -> 2.1.1a
Release Notes:
https://github.com/arno-iptables-firewall/aif/releases/tag/2.1.1a

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2025-11-12 11:14:57 +05:30
Peter Kjellerstedt
dd3dca0d01 ebtables: Remove the dependecy on bash
Rewrite ebtables-legacy-save to avoid using bashisms.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2025-03-03 08:03:37 -05:00
Nikhil R
bd6854fc05 nftables: Conditionally add ${PN}-python as RDEPENDS for ptest
This commit updates the RDEPENDS for the ptest package to include
${PN}-python only when the 'python' PACKAGECONFIG option is enabled.

This fix is required as ptest is enabled in the Distro features,
which was causing the following error:
ERROR: Nothing RPROVIDES 'nftables-python' (but /home/builder/src/base/node0/meta-openembedded/meta-networking/recipes-filter/nftables/nftables_1.0.9.bb RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'nftables-python' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['nftables-python']
ERROR: Required build target 'nftables' has no buildable providers.
Missing or unbuildable dependency chain was: ['nftables', 'nftables-python']

Signed-off-by: Nikhil R <nikhil.r@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-10-06 07:02:34 -04:00
Michael Olbrich
aff78ae800 nftables: avoid python dependencies when building without python
Use inherit_defer instead of inhert. This way, setuptools3 is not
inherited when python is removed from PACKAGECONFIG in a .bbappend file.
This avoids dependencies added by setuptools3.

Don't add nftables-python to PACKAGES if python is disabled. It adds
extra runtime dependencies on python3-core and python3-json.

Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5cf3766cf6395d4bfa5de20cf7427950ca498eaa)
Signed-off-by: Nikhil R <nikhil.r@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-10-06 07:02:28 -04:00
Jiaying Song
80e01188fa nftables: change ptest output format
This change adds a simple format for the skip results.
The format selected is the automake "simple test" format:
"result: testname"

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-23 15:24:57 -04:00
Khem Raj
f6305ba58c
nftables: Fix ptest runs
It gets OOMs with memory < 2G on x86_64 qemu
Export NFT variable in run-ptest script its used by few tests
Add required runtime dependencies for ptests to pass

This also requires changes to kernel config
features/nf_tables/nft_test.scc and CONFIG_VETH

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-04-14 08:38:40 -07:00
William Lyu
04fcbeb562
nftables: Fix failed ptest testcases
There are 2 failed ptest testcases. They fail because they are broken,
but the fix from the upstream is not yet available in version 1.0.9.
These testcases are:
-   tests/shell/testcases/sets/reset_command_0
    Fix from the upstream:
    https://git.netfilter.org/nftables/commit/?id=7a6089a400a573b9a4fd92f29c00a6be7b8ef269
-   tests/shell/testcases/json/0005secmark_objref_0
    Fix from the upstream:
    https://git.netfilter.org/nftables/commit/?id=fff913c1eefbc84eb2d9c52038ef29fe881e9ee9

Signed-off-by: William Lyu <William.Lyu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-04-03 17:44:22 -07:00
William Lyu
32f5f091dd
nftables: Fix ShellCheck violations in ptest wrapper script "run-ptest"
The following ShellCheck violations in "run-ptest" are fixed:
-   line 4:
    SC2164: Use 'cd ... || exit' or 'cd ... || return' in case cd fails.
-   line 7:
    SC2086: Double quote to prevent globbing and word splitting.
-   line 9:
    SC2006: Use $(...) notation instead of legacy backticks `...`.
    SC2086: Double quote to prevent globbing and word splitting.
    SC2126: Consider using 'grep -c' instead of 'grep|wc -l'.
-   line 10:
    SC2006: Use $(...) notation instead of legacy backticks `...`.
    SC2086: Double quote to prevent globbing and word splitting.
    SC2126: Consider using 'grep -c' instead of 'grep|wc -l'.
-   line 17:
    SC2086: Double quote to prevent globbing and word splitting.

Signed-off-by: William Lyu <William.Lyu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-04-03 17:44:22 -07:00
William Lyu
6f723efdc6
nftables: Fix ptest output format issues
Fix the following ptest output format issues:

-   For "sed" command, change "-e" option to "-E" option. I believe the
    previous "-e" option is a typo based on the manual page of "sed":

        -e script, --expression=script
            add the script to the commands to be executed

    "-E" option, on the other hand, makes "sed" "use extended regular
    expressions in the script" according to the manual page.

-   The test result summary line is being treated as both a passed
    testcase and a failed testcase due to this line containing substring
    "[OK]" and "[FAILED]". The following is a sample test result summary
    line:

        I: results: [OK] 379 [SKIPPED] 1 [FAILED] 0 [TOTAL] 380

    The fix is to change run-ptest to look for "I: [OK]" and
    "W: [FAILED]" when determining which lines correspond to
    passed/failed testcases.

-   Previously, only "W: [FAILED]" out of the following testcase failure
    prompts is parsed:

        W: [CHK DUMP]
        W: [VALGRIND]
        W: [TAINTED]
        W: [DUMP FAIL]
        W: [FAILED]

    Adding parsing for all testcase failure prompts.

Signed-off-by: William Lyu <William.Lyu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-04-03 17:44:21 -07:00
Randy MacLeod
83c80dd111
nftables: Add DESCRIPTION and HOMEPAGE
Add DESCRIPTION and HOMEPAGE.

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-03-26 11:34:28 -07:00
Khem Raj
ccff89588a
ipset: Update to 7.21
Fix build with latest musl while here

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2024-03-24 22:52:26 -07:00
Martin Jansa
21f956598d
recipes: drop ${SRCPV} usage
* Drop SRCPV similarly like oe-core did in:
  https://git.openembedded.org/openembedded-core/commit/?h=nanbield&id=843f82a246a535c353e08072f252d1dc78217872

* SRCPV is deferred now from PV to PKGV since:
  https://git.openembedded.org/openembedded-core/commit/?h=nanbield&id=a8e7b0f932b9ea69b3a218fca18041676c65aba0

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
2024-02-09 09:52:12 -08:00
Khem Raj
af5a977053 ipset: upgrade 7.15 -> 7.19
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-11-06 08:48:27 -08:00
Yi Zhao
a48613d396 nftables: upgrade 1.0.8 -> 1.0.9
Changelog:
https://www.netfilter.org/projects/nftables/files/changes-nftables-1.0.9.txt

Drop configure option --disable-python as it has been removed upstream.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-10-23 17:00:49 -07:00
Yi Zhao
67f6c57dcd conntrack-tools: upgrade 1.4.7 -> 1.4.8
This release fixes several regressions in 1.4.7 with the -U/--update and
-D/--delete commands.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-10-23 17:00:48 -07:00
Yi Zhao
63680c8e15 nftables: upgrade 1.0.7 -> 1.0.8
Changelog:
https://netfilter.org/projects/nftables/files/changes-nftables-1.0.8.txt

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-08-22 21:18:05 -07:00
Yi Zhao
0eedaa5461 libnetfilter-queue: enable native build
Required by daq native build.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-07-28 07:28:03 -07:00
Yi Zhao
616e93a557 libnfnetlink: enable native build
Required by libnetfilter-queue native build.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-07-28 07:28:03 -07:00
Wang Mingyu
d358507597 libnftnl: upgrade 1.2.5 -> 1.2.6
Changelog:
=========
tests: nft-rule-test: Add test cases to improve code coverage
tests: nft-table-test: fix typo	shixuantong
expr: meta: introduce broute meta expression

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-07-20 19:08:56 -07:00
Yi Zhao
e580d4f3c9 conntrack-tools: add required kernel modules to RRECOMMENDS
Refer to https://git.netfilter.org/conntrack-tools/tree/INSTALL, add
required kernel modules to RRECOMMENDS.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-06-27 13:44:47 -07:00
Yi Zhao
df866c7a93 conntrack-tools: add systemd unit file
Refer to
https://salsa.debian.org/pkg-netfilter-team/pkg-conntrack-tools/-/blob/master/debian/conntrackd.service,
add systemd unit file conntrackd.service.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-06-27 13:44:47 -07:00
Martin Jansa
be8c765c7c *.patch: add Upstream-Status to all patches
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a

This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).

This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.

This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:

5 (26%) 	meta-xfce
6 (50%) 	meta-perl
15 (42%)        meta-webserver
21 (36%)        meta-gnome
25 (57%)        meta-filesystems
26 (43%)        meta-initramfs
45 (45%)        meta-python
47 (55%)        meta-multimedia
312 (63%)       meta-networking
756 (61%)       meta-oe

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-06-21 09:15:20 -07:00
Khem Raj
88b295625d nfacct: Update SRC_URI to point to valid URL
Update UPSTREAM_CHECK_URI accordingly

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-05-01 23:20:22 -07:00
Petr Gotthard
d7001f534e nftables: upgrade 1.0.6 -> 1.0.7
Changelog:
https://netfilter.org/projects/nftables/files/changes-nftables-1.0.7.txt

The COPYING text changed to highlight that "New code though is moving to
GPL version 2 or any later which is the preferred license for this project
these days." Although the project itself stays GPLv2 only.
https://netfilter.org/licensing.html#terms

The upstream replaced distutils with setuptools, so the nftables-python
is now built using the standard approach. The coexistence of setuptools
and automake is solved in the same way as in meta-oe/recipes-support/libiio.

The removal of *.pyc is no longer necessary.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-04-14 15:38:30 -07:00
Yi Zhao
e9df01df3d libnftnl: upgrade 1.2.4 -> 1.2.5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-03-12 12:34:56 -07:00
Yi Zhao
f1160a81c5 libnetfilter-cttimeout: upgrade 1.0.0 -> 1.0.1
Drop backport patch.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-03-06 08:41:13 -08:00
Yi Zhao
ab9aba9dd2 libnetfilter-cthelper: upgrade 1.0.0 -> 1.0.1
Drop backport patch.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-03-06 08:41:13 -08:00
Yi Zhao
517317de60 libnfnetlink: upgrade 1.0.1 -> 1.0.2
Drop backport patches.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-03-06 08:41:13 -08:00
Niko Mauno
d25967208b nftables: Fix missing leading whitespace with ':append'
Mitigate occurence where ':append' operator is used and leading
whitespace character is obviously missing, risking inadvertent
string concatenation.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-01-25 08:51:25 -08:00
Alexander Kanavin
ddfc9edc20 nftables: fix builds with latest setuptools
Using a private module from setuptools is not a good idea and
no longer works with latest setuptools.

it's actually better to revert to official distutils even if
it is going away in the next python release. Hopefully by
then upstream will transition to something supported.

TMPDIR in .pyc can be addressed by simply not installing the .pyc.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-01-06 11:38:16 -08:00
Khem Raj
b11ebfa37b nftables: Upgrade to 1.0.6
Changes are here [1], change to xz compressed archives

[1] https://www.netfilter.org/projects/nftables/files/changes-nftables-1.0.6.txt

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2023-01-06 11:38:16 -08:00
Wang Mingyu
9afefefac5 libnftnl: upgrade 1.2.3 -> 1.2.4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-11-14 11:55:59 -08:00
Wang Mingyu
ca25528ad3 ulogd2: upgrade 2.0.7 -> 2.0.8
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-11-07 08:40:48 -08:00
Randy MacLeod
66585ce7ca nftables: use automake ptest output format
Make run-ptest use the correct libdir for multilib builds.

Log the ptest output to a date stamped file and append a test summary
to the end of the log.

Munge the log as it is produced to:
 - insert the expected automake keywords: PASS and FAIL.
 - remove escape sequences used for ANSI colours as well as movement commands

Add additional discrete tool dependencies to the nftables-ptest list since
the test suite does not work with the busybox versions.

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-11-07 08:39:05 -08:00
Alex Kiernan
4a0e41431e conntrack-tools: Use canonical shell spacing
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-10-16 18:30:32 -07:00
Alex Kiernan
4d8d56d0e7 conntrack-tools: Add PACKAGECONFIGs for build options
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-10-16 18:30:32 -07:00
Alex Kiernan
80b68df709 conntrack-tools: Upgrade 1.4.6 -> 1.4.7
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-10-16 18:30:32 -07:00
Yi Zhao
b07db09fe8 nftables: upgrade 1.0.4 -> 1.0.5
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-09-29 21:21:11 -07:00
Yi Zhao
333cdd80c6 libnftnl: upgrade 1.2.2 -> 1.2.3
Drop 0001-avoid-naming-local-function-as-one-of-printf-family.patch as
the issue has been fixed upstream.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-09-29 21:21:11 -07:00
Alex Kiernan
7e67fb0a07 nftables: Upgrade 1.0.2 -> 1.0.4
Drop backported patch, switch PACKAGECONFIG assignment to ?= (matches
current practice), add in editline, linenoise CLI options and xtables
option. Switch to --disable-python when building without python to avoid
a configure time warning.

We can drop UPSTREAM_CHECK_REGEX as the version no longer gets confused
by the 0.099 version which exists.

Fix buildpaths warning by switching to setuptools and add dependency on
${PN}-python to ${PN}-ptest so that the embedded paths in the compiled
python files are correct.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-07-12 15:25:00 -07:00
wangmy
6d997c52c5 libnftnl: upgrade 1.2.1 -> 1.2.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-06-30 13:39:27 -04:00
Adrian Freihofer
55fd984483 conntrack-tools: fix postinst script
Fix error caused by postinst script of conntrack-tools:

do_rootfs: Postinstall scriptlets of ['conntrack-tools'] have failed...

Configuring ... rootfs//var/lib/opkg/info/conntrack-tools.postinst:
  line 2: setcap: command not found

conntrack-tools.postinst returned 127, marking as unpacked only...

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-05-28 15:17:04 -07:00
Kai Kang
71e87a5dbc conntrack-tools: fix postinst script
Fix error caused by postinst script of conntrack-tools:

| /var/tmp/rpm-tmp.or09Iq: line 4: unexpected EOF while looking for matching `"'
| %post(conntrack-tools-1.4.6-r0.core2_64): waitpid(1173) rc 1173 status 200
| warning: %post(conntrack-tools-1.4.6-r0.core2_64) scriptlet failed, exit status 2

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-05-10 08:54:21 -07:00
Alex Kiernan
80a5a789fb ulogd2: Add recipe
ulogd-2.x provides a flexible, almost universal logging daemon for
netfilter logging.  This encompasses both packet-based logging (logging
of policy violations) and flow-based logging, e.g. for accounting
purpose.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Alex Kiernan <alexk@zuma.ai>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-05-07 18:47:16 -07:00
Bassem Boubaker
77c2fda04e conntrack-tools: Fix missing capability
The commit fix this error message: Do not forget that you need *root* or CAP_NET_ADMIN capabilities ;-)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-29 19:32:47 -07:00
Khem Raj
2b643dcefe arno-iptables-firewall: Do not use bitbake variable inside S
Location of file inside sourcedir fixed but bitbake variable
systemd_unitdir varies depending on usrmerge feature
hence can not be used here

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-23 20:12:14 -07:00
Trevor Gamblin
611a99c036 nftables: add ptest
Note that (like for nftables itself), the ptests will require the
following added to local.conf (or the kernel configuration):

KERNEL_FEATURES:append = " features/nf_tables/nf_tables.scc"

Current pass/fail results:

I: results: [OK] 271 [FAILED] 29 [TOTAL] 300

I've been investigating the failing tests under the assumption that they
fail because of missing kernel modules, but there are some that suggest
syntax problems (possibly problems with the tests themselves). Example:

W: [FAILED]     ./tests/shell/testcases/listing/0020flowtable_0: got 1
/dev/stdin:2:12-12: Error: Could not process rule: No such file or
directory
        flowtable f {
                  ^
/dev/stdin:6:11-12: Error: Could not process rule: No such file or
directory
flowtable f2 {
          ^^

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-12 09:28:25 -07:00
Yi Zhao
0caf66e939 libnetfilter-conntrack: upgrade 1.0.8 -> 1.0.9
Backport a patch to fix musl build.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-03-31 21:23:05 -07:00
Yi Zhao
03e4ec7184 nftables: upgrade 1.0.1 -> 1.0.2
Backport a patch to fix build error:
../../nftables-1.0.2/examples/nft-buffer.c:3:10: fatal error: nftables/libnftables.h: No such file or directory
    3 | #include <nftables/libnftables.h>
      |          ^~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-03-24 09:45:25 -07:00