* drop unused lenient restore patch
 * instead of statically linking core extensions, build shared libraries
   for reuse in fw3
 * strip outdated match revisions and aliases to trim down library size

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 45758

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45617

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45494

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45481

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 45424

it causes problems with newer iptables when ipv6 is disabled as iptc uncoditionally links ip6tc

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 45350

This patch adds the userspace and kernelspace for

- match NETFILTER_XT_MATCH_CLUSTER
  This match can be used to deploy gateway and back-end load-sharing clusters.
- target IP_NF_TARGET_CLUSTERIP
  This module allows you to configure a simple cluster of nodes
  that share a certain IP and MAC address
  without an explicit load balancer in front of them.
  Connections are statically distributed between the nodes in this cluster.

This is used i.e. by strongswan-ha.

Signed-off-by: Christian Scheele <cs@embedd.com>

SVN-Revision: 43174

turns out that r43155 adds duplicate info.

Signed-off-by: John Crispin <blogic@openwrt.org>

SVN-Revision: 43167

Note, that licensing stuff is a nightmare: many packages does not clearly
state their licenses, and often multiple source files are simply copied
together - each with different licensing information in the file headers.

I tried hard to ensure, that the license information extracted into the OpenWRT's
makefiles fit the "spirit" of the packages, e.g. such small packages which
come without a dedicated source archive "inherites" the OpenWRT's own license
in my opinion.

However, I can not garantee that I always picked the correct information
and/or did not miss license information.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

SVN-Revision: 43155

Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 43151

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

SVN-Revision: 42034

NFLOG and NFQUEUE targets' full support for iptables.

Includes all needed kernel modules (Xtables's and Netlink's)
 and userspace libraries.
All added kernel modules can be individually disabled,
 all other new libraries get their own individual packages.

Reported-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch>
Reported-by: Rainer Poisel <rainer.poisel@fhstp.ac.at>
Reported-by: Derek LaHousse <dlahouss@mtu.edu>
Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com>

SVN-Revision: 42022

This commit implements a new netfilter match "xt_id" which can be used to
attach unsigned 32bit IDs to iptables rules.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 41945

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 41479

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 41458

netfilter: split off header matching modules not used by the default config (reduces rootfs size and memory usage)

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 40983

when disabling ipv6, the iptables build breaks without a manul clean or this patch

Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com>

SVN-Revision: 40916

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 39964

SVN-Revision: 39878

SVN-Revision: 39877

netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration

SVN-Revision: 37866

SVN-Revision: 37865

SVN-Revision: 37329

The reap functionality appears to have been accidentally disabled by
commit 74ded7257e5da5e309844d386290f24ae91950a6 to iptables.git, see:

  git://git.netfilter.org/iptables.git



and subsequently in iptables 1.4.15 and later.  This adds a patch to
restore reap functionality for recent_opts_v1.

Signed-off-by: Russell Senior <russell@personaltelco.net>

SVN-Revision: 37328

SVN-Revision: 36867

SVN-Revision: 36760

netfilter: move time, mark, set matches and MARK, REDIRECT, SET targets into base iptables package - drop iptables-mod-ipset

SVN-Revision: 36683

SVN-Revision: 36680

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36634

libiptc.pc depends on libip[4|6]tc.pc, thus all of those need to be
installed.
Should fix collectd build and thus #13146; which should make collectd
appear in snapshots again.

Signed-off-by: Danny Baumann <dannybaumann@web.de>

SVN-Revision: 36509

SVN-Revision: 36125

SVN-Revision: 35898

SVN-Revision: 35896

Revert "iptables: update to 1.4.18" due to toolchain-issue: binaries cause segfaults when stripped on ar71xx

SVN-Revision: 35894

SVN-Revision: 35892

SVN-Revision: 35569

iptables: add --lenient switch to iptables-restore and ip6tables-restore that allows to skip erroneous lines

SVN-Revision: 35568

SVN-Revision: 35155

Thanks to Frank Meerkötter and Szabolcs Nagy for spotting the issue.

Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 34326

Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 34313