Message ID | 20190303080918.5899-1-ummeegge@ipfire.org |
---|---|
State | Accepted |
Commit | 3f2341da8d3b517466f42338956342fde6e45eec |
Headers |
Return-Path: <development-bounces@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.i.ipfire.org [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 7880788AE0D for <patchwork@web07.i.ipfire.org>; Sun, 3 Mar 2019 08:09:36 +0000 (GMT) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 44Bwmb3tKHz57J65; Sun, 3 Mar 2019 08:09:35 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1551600575; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references:list-id: list-unsubscribe:list-subscribe:list-post; bh=ZXehk3yqQ9k29aZQ0vvsbN+BGpqHIyY9bG4BF7B3BX8=; b=F2nF9h2IM/lfQWlVr444jb4RqMIIzf4x85EmjvLoW1keWA9Qr2wFHcYmayF8aeqJDC17Mt TcYZID2b/QEquOssHHnhausjDOfE0ypLsBtwU3swPsk4FMlC6d5pWOE+Dx1fSJE42279YI NZ9GG/yrAm0Mf0X7DaSVE2dnX9+zcdJ3e5XjUngsFtHBqliPNF2GYNj9Rqwof71MJ6pFD1 rf/X4nlhVV4X89FFZmpAk+eU7euaPQFgYiWrATN1ysF+HNHRlH+CvGiXDdFqInRNm3jWU1 oYNbDrwmVbWbHJofA3WFQW4iVSPrmxSR2DKFh2sIUS5dLPutv2nVfWDRV1UAmA== Received: from ipfire-server.local (i59F4D196.versanet.de [89.244.209.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 44BwmX2lcqz57Hb9; Sun, 3 Mar 2019 08:09:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1551600572; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=ZXehk3yqQ9k29aZQ0vvsbN+BGpqHIyY9bG4BF7B3BX8=; b=su4eSN793SFHGcicbjrzsKWOXSqlK/yg9Y3+YiOpfRV0W/0eZV+qIWsAqzfgl1hldSMyur Ye6l+cNLq60ix8TV6GghQOf5+Jf9s861mhogpy0f8qbxDchQ5Q04DdAsmNop7OhC9W3Rwu Zx392sVR/C6pgebzTIPfCRVSuz3dGbMeH5ZNQYpybjbpsi0AR8trNkijRcPlA9bESHIpcU J9Z7L9Dna0X/NmzWbOu7Abtcy20Lj46JaMEqN583ypTbjD7ApHViD3017nG9ePc0pQhLAj 8WE+xBsl/iRBFg9mpgFD948sXJgD4JUEP2thWWqVYc31dZwWZ8JJ3ShpNjM0ow== From: Erik Kapfer <ummeegge@ipfire.org> To: development@lists.ipfire.org Subject: [PATCH] iptables: Update to 1.8.2 Date: Sun, 3 Mar 2019 09:09:18 +0100 Message-Id: <20190303080918.5899-1-ummeegge@ipfire.org> X-Mailer: git-send-email 2.12.2 Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=ummeegge smtp.mailfrom=ummeegge@ipfire.org X-Spamd-Result: default: False [-5.05 / 11.00]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; DKIM_SIGNED(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM(-2.95)[-0.984,0]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:8881, ipnet:89.244.208.0/20, country:DE]; RCVD_TLS_ALL(0.00)[]; BAYES_HAM(-3.00)[100.00%] X-Spam-Status: No, score=-5.05 X-Rspamd-Server: mail01.i.ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk <development.lists.ipfire.org> List-Unsubscribe: <https://lists.ipfire.org/mailman/options/development>, <mailto:development-request@lists.ipfire.org?subject=unsubscribe> List-Archive: <https://lists.ipfire.org/pipermail/development/> List-Post: <mailto:development@lists.ipfire.org> List-Help: <mailto:development-request@lists.ipfire.org?subject=help> List-Subscribe: <https://lists.ipfire.org/mailman/listinfo/development>, <mailto:development-request@lists.ipfire.org?subject=subscribe> Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org> |
Series |
iptables: Update to 1.8.2
|
|
Commit Message
ummeegge
March 3, 2019, 7:09 p.m. UTC
netfilter-layer7 has also been updated to v2.23 .
Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
---
config/rootfiles/common/iptables | 19 ++++++++++++-------
lfs/iptables | 17 +++++++++--------
2 files changed, 21 insertions(+), 15 deletions(-)
Comments
Hi, This release of iptables has some interesting changes: We now have multiple binaries with -legacy in name. Did you test this? Is there anything we need to think about? -Michael > On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote: > > netfilter-layer7 has also been updated to v2.23 . > > Signed-off-by: Erik Kapfer <ummeegge@ipfire.org> > --- > config/rootfiles/common/iptables | 19 ++++++++++++------- > lfs/iptables | 17 +++++++++-------- > 2 files changed, 21 insertions(+), 15 deletions(-) > > diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables > index d7584c0ad..9aa9e51cb 100644 > --- a/config/rootfiles/common/iptables > +++ b/config/rootfiles/common/iptables > @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 > #lib/libxtables.la > lib/libxtables.so > lib/libxtables.so.12 > -lib/libxtables.so.12.0.0 > +lib/libxtables.so.12.2.0 > #lib/xtables > -lib/xtables/libebt_802_3.so > -lib/xtables/libebt_ip.so > -lib/xtables/libebt_log.so > -lib/xtables/libebt_mark_m.so > lib/xtables/libip6t_DNAT.so > lib/xtables/libip6t_DNPT.so > lib/xtables/libip6t_HL.so > @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so > lib/xtables/libxt_length.so > lib/xtables/libxt_limit.so > lib/xtables/libxt_mac.so > -lib/xtables/libxt_mangle.so > lib/xtables/libxt_mark.so > lib/xtables/libxt_multiport.so > lib/xtables/libxt_nfacct.so > @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so > lib/xtables/libxt_u32.so > lib/xtables/libxt_udp.so > sbin/ip6tables > +sbin/ip6tables-legacy > +sbin/ip6tables-legacy-restore > +sbin/ip6tables-legacy-save > sbin/ip6tables-restore > sbin/ip6tables-save > sbin/iptables > +sbin/iptables-legacy > +sbin/iptables-legacy-restore > +sbin/iptables-legacy-save > sbin/iptables-restore > sbin/iptables-save > sbin/iptables-xml > #sbin/nfnl_osf > -sbin/xtables-multi > +sbin/xtables-legacy-multi > #usr/include/libipq.h > #usr/include/libiptc > #usr/include/libiptc/ipt_kernel_headers.h > @@ -178,5 +179,9 @@ sbin/xtables-multi > #usr/share/man/man8/iptables-save.8 > #usr/share/man/man8/iptables.8 > #usr/share/man/man8/nfnl_osf.8 > +#usr/share/man/man8/xtables-legacy.8 > +#usr/share/man/man8/xtables-monitor.8 > +#usr/share/man/man8/xtables-nft.8 > +#usr/share/man/man8/xtables-translate.8 > #usr/share/xtables > usr/share/xtables/pf.os > diff --git a/lfs/iptables b/lfs/iptables > index b4a2834b8..17817a9ef 100644 > --- a/lfs/iptables > +++ b/lfs/iptables > @@ -1,7 +1,7 @@ > ############################################################################### > # # > # IPFire.org - A linux based firewall # > -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> # > +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> # > # # > # This program is free software: you can redistribute it and/or modify # > # it under the terms of the GNU General Public License as published by # > @@ -24,7 +24,7 @@ > > include Config > > -VER = 1.6.2 > +VER = 1.8.2 > > THISAPP = iptables-$(VER) > DL_FILE = $(THISAPP).tar.bz2 > @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) > # Top-level Rules > ############################################################################### > objects = $(DL_FILE) \ > - netfilter-layer7-v2.22.tar.gz > + netfilter-layer7-v2.23.tar.gz > > $(DL_FILE) = $(DL_FROM)/$(DL_FILE) > -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz > +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz > > -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d > -netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f > +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 > +netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb > > install : $(TARGET) > > @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) > > # Layer7 > - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz > - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz > + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > ./extensions/ > > # imq > @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > --libdir=/lib \ > --includedir=/usr/include \ > --enable-libipq \ > + --with-xtlibdir=/lib/xtables \ > --libexecdir=/lib \ > --bindir=/sbin \ > --sbindir=/sbin \ > -- > 2.12.2 >
Hi Michael, On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote: > Hi, > > This release of iptables has some interesting changes: > > We now have multiple binaries with -legacy in name. Yes i was also a little in wonder about that although it looked a little like a helper tool if nftables and iptables running at the same time. Looking at linuxfromscratch --> http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html if '--disable-nftables' has been set, there are no *-legacy* binaries listed under "Installed Programs:". There is also the xtables-legacy-multi binary and looking into the nftables-wiki --> https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools (please check the 'link to a summary') it appears that all setsockopt based tools are all now considered as 'legacy'. > > Did you test this? Is there anything we need to think about? Am running iptables-1.8.2 currently with a backup of my production machine with ~ 50 rules and a vast IPset configuration (firewall.local) and i haven´t recognized problems. Some other tests i made: Made also a diff between 'iptables-legacy-save' and 'iptables-save' whereby the output seems to be pretty much the same. Moved then also all iptables-legacy* binaries away, restarted the machine and all seems to work as it should. Since it is a little a sensible update, it is great to go for some more overviews/testings/thinking_abouts. Best, Erik > > -Michael > > > On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote: > > > > netfilter-layer7 has also been updated to v2.23 . > > > > Signed-off-by: Erik Kapfer <ummeegge@ipfire.org> > > --- > > config/rootfiles/common/iptables | 19 ++++++++++++------- > > lfs/iptables | 17 +++++++++-------- > > 2 files changed, 21 insertions(+), 15 deletions(-) > > > > diff --git a/config/rootfiles/common/iptables > > b/config/rootfiles/common/iptables > > index d7584c0ad..9aa9e51cb 100644 > > --- a/config/rootfiles/common/iptables > > +++ b/config/rootfiles/common/iptables > > @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 > > #lib/libxtables.la > > lib/libxtables.so > > lib/libxtables.so.12 > > -lib/libxtables.so.12.0.0 > > +lib/libxtables.so.12.2.0 > > #lib/xtables > > -lib/xtables/libebt_802_3.so > > -lib/xtables/libebt_ip.so > > -lib/xtables/libebt_log.so > > -lib/xtables/libebt_mark_m.so > > lib/xtables/libip6t_DNAT.so > > lib/xtables/libip6t_DNPT.so > > lib/xtables/libip6t_HL.so > > @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so > > lib/xtables/libxt_length.so > > lib/xtables/libxt_limit.so > > lib/xtables/libxt_mac.so > > -lib/xtables/libxt_mangle.so > > lib/xtables/libxt_mark.so > > lib/xtables/libxt_multiport.so > > lib/xtables/libxt_nfacct.so > > @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so > > lib/xtables/libxt_u32.so > > lib/xtables/libxt_udp.so > > sbin/ip6tables > > +sbin/ip6tables-legacy > > +sbin/ip6tables-legacy-restore > > +sbin/ip6tables-legacy-save > > sbin/ip6tables-restore > > sbin/ip6tables-save > > sbin/iptables > > +sbin/iptables-legacy > > +sbin/iptables-legacy-restore > > +sbin/iptables-legacy-save > > sbin/iptables-restore > > sbin/iptables-save > > sbin/iptables-xml > > #sbin/nfnl_osf > > -sbin/xtables-multi > > +sbin/xtables-legacy-multi > > #usr/include/libipq.h > > #usr/include/libiptc > > #usr/include/libiptc/ipt_kernel_headers.h > > @@ -178,5 +179,9 @@ sbin/xtables-multi > > #usr/share/man/man8/iptables-save.8 > > #usr/share/man/man8/iptables.8 > > #usr/share/man/man8/nfnl_osf.8 > > +#usr/share/man/man8/xtables-legacy.8 > > +#usr/share/man/man8/xtables-monitor.8 > > +#usr/share/man/man8/xtables-nft.8 > > +#usr/share/man/man8/xtables-translate.8 > > #usr/share/xtables > > usr/share/xtables/pf.os > > diff --git a/lfs/iptables b/lfs/iptables > > index b4a2834b8..17817a9ef 100644 > > --- a/lfs/iptables > > +++ b/lfs/iptables > > @@ -1,7 +1,7 @@ > > ################################################################### > > ############ > > # > > # > > # IPFire.org - A linux based > > firewall # > > -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> > > # > > +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> > > # > > # > > # > > # This program is free software: you can redistribute it and/or > > modify # > > # it under the terms of the GNU General Public License as published > > by # > > @@ -24,7 +24,7 @@ > > > > include Config > > > > -VER = 1.6.2 > > +VER = 1.8.2 > > > > THISAPP = iptables-$(VER) > > DL_FILE = $(THISAPP).tar.bz2 > > @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) > > # Top-level Rules > > ################################################################### > > ############ > > objects = $(DL_FILE) \ > > - netfilter-layer7-v2.22.tar.gz > > + netfilter-layer7-v2.23.tar.gz > > > > $(DL_FILE) = $(DL_FROM)/$(DL_FILE) > > -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7- > > v2.22.tar.gz > > +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7- > > v2.23.tar.gz > > > > -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d > > -netfilter-layer7-v2.22.tar.gz_MD5 = > > 98dff8a3d5a31885b73341633f69501f > > +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 > > +netfilter-layer7-v2.23.tar.gz_MD5 = > > 10910b6173d18e426cb56ae7e1300eeb > > > > install : $(TARGET) > > > > @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > > @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) > > > > # Layer7 > > - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- > > v2.22.tar.gz > > - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- > > v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > > + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- > > v2.23.tar.gz > > + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- > > v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > > ./extensions/ > > > > # imq > > @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > > --libdir=/lib \ > > --includedir=/usr/include \ > > --enable-libipq \ > > + --with-xtlibdir=/lib/xtables \ > > --libexecdir=/lib \ > > --bindir=/sbin \ > > --sbindir=/sbin \ > > -- > > 2.12.2 > > > >
Hi, I will just merge this and then we will see during testing of the Core Update. What could possibly go wrong? Best, -Michael > On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote: > > Hi Michael, > > On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote: >> Hi, >> >> This release of iptables has some interesting changes: >> >> We now have multiple binaries with -legacy in name. > Yes i was also a little in wonder about that although it looked a > little like a helper tool if nftables and iptables running at the same > time. Looking at linuxfromscratch --> > http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html > if '--disable-nftables' has been set, there are no *-legacy* binaries > listed under "Installed Programs:". > There is also the xtables-legacy-multi binary and looking into the > nftables-wiki --> > https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools > (please check the 'link to a summary') it appears that all setsockopt > based tools are all now considered as 'legacy'. > >> >> Did you test this? Is there anything we need to think about? > Am running iptables-1.8.2 currently with a backup of my production > machine with ~ 50 rules and a vast IPset configuration (firewall.local) > and i haven´t recognized problems. > > Some other tests i made: > Made also a diff between 'iptables-legacy-save' and 'iptables-save' > whereby the output seems to be pretty much the same. > Moved then also all iptables-legacy* binaries away, restarted the > machine and all seems to work as it should. > > Since it is a little a sensible update, it is great to go for some more > overviews/testings/thinking_abouts. > > Best, > > > Erik > >> >> -Michael >> >>> On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote: >>> >>> netfilter-layer7 has also been updated to v2.23 . >>> >>> Signed-off-by: Erik Kapfer <ummeegge@ipfire.org> >>> --- >>> config/rootfiles/common/iptables | 19 ++++++++++++------- >>> lfs/iptables | 17 +++++++++-------- >>> 2 files changed, 21 insertions(+), 15 deletions(-) >>> >>> diff --git a/config/rootfiles/common/iptables >>> b/config/rootfiles/common/iptables >>> index d7584c0ad..9aa9e51cb 100644 >>> --- a/config/rootfiles/common/iptables >>> +++ b/config/rootfiles/common/iptables >>> @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 >>> #lib/libxtables.la >>> lib/libxtables.so >>> lib/libxtables.so.12 >>> -lib/libxtables.so.12.0.0 >>> +lib/libxtables.so.12.2.0 >>> #lib/xtables >>> -lib/xtables/libebt_802_3.so >>> -lib/xtables/libebt_ip.so >>> -lib/xtables/libebt_log.so >>> -lib/xtables/libebt_mark_m.so >>> lib/xtables/libip6t_DNAT.so >>> lib/xtables/libip6t_DNPT.so >>> lib/xtables/libip6t_HL.so >>> @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so >>> lib/xtables/libxt_length.so >>> lib/xtables/libxt_limit.so >>> lib/xtables/libxt_mac.so >>> -lib/xtables/libxt_mangle.so >>> lib/xtables/libxt_mark.so >>> lib/xtables/libxt_multiport.so >>> lib/xtables/libxt_nfacct.so >>> @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so >>> lib/xtables/libxt_u32.so >>> lib/xtables/libxt_udp.so >>> sbin/ip6tables >>> +sbin/ip6tables-legacy >>> +sbin/ip6tables-legacy-restore >>> +sbin/ip6tables-legacy-save >>> sbin/ip6tables-restore >>> sbin/ip6tables-save >>> sbin/iptables >>> +sbin/iptables-legacy >>> +sbin/iptables-legacy-restore >>> +sbin/iptables-legacy-save >>> sbin/iptables-restore >>> sbin/iptables-save >>> sbin/iptables-xml >>> #sbin/nfnl_osf >>> -sbin/xtables-multi >>> +sbin/xtables-legacy-multi >>> #usr/include/libipq.h >>> #usr/include/libiptc >>> #usr/include/libiptc/ipt_kernel_headers.h >>> @@ -178,5 +179,9 @@ sbin/xtables-multi >>> #usr/share/man/man8/iptables-save.8 >>> #usr/share/man/man8/iptables.8 >>> #usr/share/man/man8/nfnl_osf.8 >>> +#usr/share/man/man8/xtables-legacy.8 >>> +#usr/share/man/man8/xtables-monitor.8 >>> +#usr/share/man/man8/xtables-nft.8 >>> +#usr/share/man/man8/xtables-translate.8 >>> #usr/share/xtables >>> usr/share/xtables/pf.os >>> diff --git a/lfs/iptables b/lfs/iptables >>> index b4a2834b8..17817a9ef 100644 >>> --- a/lfs/iptables >>> +++ b/lfs/iptables >>> @@ -1,7 +1,7 @@ >>> ################################################################### >>> ############ >>> # >>> # >>> # IPFire.org - A linux based >>> firewall # >>> -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> >>> # >>> +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> >>> # >>> # >>> # >>> # This program is free software: you can redistribute it and/or >>> modify # >>> # it under the terms of the GNU General Public License as published >>> by # >>> @@ -24,7 +24,7 @@ >>> >>> include Config >>> >>> -VER = 1.6.2 >>> +VER = 1.8.2 >>> >>> THISAPP = iptables-$(VER) >>> DL_FILE = $(THISAPP).tar.bz2 >>> @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) >>> # Top-level Rules >>> ################################################################### >>> ############ >>> objects = $(DL_FILE) \ >>> - netfilter-layer7-v2.22.tar.gz >>> + netfilter-layer7-v2.23.tar.gz >>> >>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE) >>> -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7- >>> v2.22.tar.gz >>> +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7- >>> v2.23.tar.gz >>> >>> -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d >>> -netfilter-layer7-v2.22.tar.gz_MD5 = >>> 98dff8a3d5a31885b73341633f69501f >>> +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 >>> +netfilter-layer7-v2.23.tar.gz_MD5 = >>> 10910b6173d18e426cb56ae7e1300eeb >>> >>> install : $(TARGET) >>> >>> @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) >>> @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) >>> >>> # Layer7 >>> - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- >>> v2.22.tar.gz >>> - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- >>> v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ >>> + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- >>> v2.23.tar.gz >>> + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- >>> v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ >>> ./extensions/ >>> >>> # imq >>> @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) >>> --libdir=/lib \ >>> --includedir=/usr/include \ >>> --enable-libipq \ >>> + --with-xtlibdir=/lib/xtables \ >>> --libexecdir=/lib \ >>> --bindir=/sbin \ >>> --sbindir=/sbin \ >>> -- >>> 2.12.2 >>> >> >> >
Hi Michael, On Di, 2019-03-05 at 09:47 +0000, Michael Tremer wrote: > Hi, > > I will just merge this and then we will see during testing of the > Core Update. Have deleted all the *legacy* binaries and as before, no problems at all. Should i send another patch without them ? > > What could possibly go wrong? Have currently no problems in focus. Have build also nftables (with libnftnl with an extended iptables-1.8.2 version which incl. also ebtables, arptables, the translation stuff and a lot more) to check there for some possible usage of the *legacy* stuff. It is currently possible to use both (iptables beneath nftables) which offers some funky new possiblities :D but in there the same, did NOT needed the *legacy* binaries since all known iptables binaries are still presant but possibly i have missed/overseen something. At least all is working. Best, Erik > > Best, > -Michael > > > On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote: > > > > Hi Michael, > > > > On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote: > > > Hi, > > > > > > This release of iptables has some interesting changes: > > > > > > We now have multiple binaries with -legacy in name. > > > > Yes i was also a little in wonder about that although it looked a > > little like a helper tool if nftables and iptables running at the > > same > > time. Looking at linuxfromscratch --> > > http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html > > if '--disable-nftables' has been set, there are no *-legacy* > > binaries > > listed under "Installed Programs:". > > There is also the xtables-legacy-multi binary and looking into the > > nftables-wiki --> > > https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools > > > > (please check the 'link to a summary') it appears that all > > setsockopt > > based tools are all now considered as 'legacy'. > > > > > > > > Did you test this? Is there anything we need to think about? > > > > Am running iptables-1.8.2 currently with a backup of my production > > machine with ~ 50 rules and a vast IPset configuration > > (firewall.local) > > and i haven´t recognized problems. > > > > Some other tests i made: > > Made also a diff between 'iptables-legacy-save' and 'iptables-save' > > whereby the output seems to be pretty much the same. > > Moved then also all iptables-legacy* binaries away, restarted the > > machine and all seems to work as it should. > > > > Since it is a little a sensible update, it is great to go for some > > more > > overviews/testings/thinking_abouts. > > > > Best, > > > > > > Erik > > > > > > > > -Michael > > > > > > > On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> > > > > wrote: > > > > > > > > netfilter-layer7 has also been updated to v2.23 . > > > > > > > > Signed-off-by: Erik Kapfer <ummeegge@ipfire.org> > > > > --- > > > > config/rootfiles/common/iptables | 19 ++++++++++++------- > > > > lfs/iptables | 17 +++++++++-------- > > > > 2 files changed, 21 insertions(+), 15 deletions(-) > > > > > > > > diff --git a/config/rootfiles/common/iptables > > > > b/config/rootfiles/common/iptables > > > > index d7584c0ad..9aa9e51cb 100644 > > > > --- a/config/rootfiles/common/iptables > > > > +++ b/config/rootfiles/common/iptables > > > > @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 > > > > #lib/libxtables.la > > > > lib/libxtables.so > > > > lib/libxtables.so.12 > > > > -lib/libxtables.so.12.0.0 > > > > +lib/libxtables.so.12.2.0 > > > > #lib/xtables > > > > -lib/xtables/libebt_802_3.so > > > > -lib/xtables/libebt_ip.so > > > > -lib/xtables/libebt_log.so > > > > -lib/xtables/libebt_mark_m.so > > > > lib/xtables/libip6t_DNAT.so > > > > lib/xtables/libip6t_DNPT.so > > > > lib/xtables/libip6t_HL.so > > > > @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so > > > > lib/xtables/libxt_length.so > > > > lib/xtables/libxt_limit.so > > > > lib/xtables/libxt_mac.so > > > > -lib/xtables/libxt_mangle.so > > > > lib/xtables/libxt_mark.so > > > > lib/xtables/libxt_multiport.so > > > > lib/xtables/libxt_nfacct.so > > > > @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so > > > > lib/xtables/libxt_u32.so > > > > lib/xtables/libxt_udp.so > > > > sbin/ip6tables > > > > +sbin/ip6tables-legacy > > > > +sbin/ip6tables-legacy-restore > > > > +sbin/ip6tables-legacy-save > > > > sbin/ip6tables-restore > > > > sbin/ip6tables-save > > > > sbin/iptables > > > > +sbin/iptables-legacy > > > > +sbin/iptables-legacy-restore > > > > +sbin/iptables-legacy-save > > > > sbin/iptables-restore > > > > sbin/iptables-save > > > > sbin/iptables-xml > > > > #sbin/nfnl_osf > > > > -sbin/xtables-multi > > > > +sbin/xtables-legacy-multi > > > > #usr/include/libipq.h > > > > #usr/include/libiptc > > > > #usr/include/libiptc/ipt_kernel_headers.h > > > > @@ -178,5 +179,9 @@ sbin/xtables-multi > > > > #usr/share/man/man8/iptables-save.8 > > > > #usr/share/man/man8/iptables.8 > > > > #usr/share/man/man8/nfnl_osf.8 > > > > +#usr/share/man/man8/xtables-legacy.8 > > > > +#usr/share/man/man8/xtables-monitor.8 > > > > +#usr/share/man/man8/xtables-nft.8 > > > > +#usr/share/man/man8/xtables-translate.8 > > > > #usr/share/xtables > > > > usr/share/xtables/pf.os > > > > diff --git a/lfs/iptables b/lfs/iptables > > > > index b4a2834b8..17817a9ef 100644 > > > > --- a/lfs/iptables > > > > +++ b/lfs/iptables > > > > @@ -1,7 +1,7 @@ > > > > ############################################################### > > > > #### > > > > ############ > > > > # > > > > > > > > # > > > > # IPFire.org - A linux based > > > > firewall # > > > > -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> > > > > > > > > # > > > > +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> > > > > > > > > # > > > > # > > > > > > > > # > > > > # This program is free software: you can redistribute it and/or > > > > modify # > > > > # it under the terms of the GNU General Public License as > > > > published > > > > by # > > > > @@ -24,7 +24,7 @@ > > > > > > > > include Config > > > > > > > > -VER = 1.6.2 > > > > +VER = 1.8.2 > > > > > > > > THISAPP = iptables-$(VER) > > > > DL_FILE = $(THISAPP).tar.bz2 > > > > @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) > > > > # Top-level Rules > > > > ############################################################### > > > > #### > > > > ############ > > > > objects = $(DL_FILE) \ > > > > - netfilter-layer7-v2.22.tar.gz > > > > + netfilter-layer7-v2.23.tar.gz > > > > > > > > $(DL_FILE) = $(DL_FROM)/$(DL_FILE) > > > > -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter- > > > > layer7- > > > > v2.22.tar.gz > > > > +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter- > > > > layer7- > > > > v2.23.tar.gz > > > > > > > > -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d > > > > -netfilter-layer7-v2.22.tar.gz_MD5 = > > > > 98dff8a3d5a31885b73341633f69501f > > > > +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 > > > > +netfilter-layer7-v2.23.tar.gz_MD5 = > > > > 10910b6173d18e426cb56ae7e1300eeb > > > > > > > > install : $(TARGET) > > > > > > > > @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst > > > > %,$(DIR_DL)/%,$(objects)) > > > > @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) > > > > > > > > # Layer7 > > > > - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- > > > > v2.22.tar.gz > > > > - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- > > > > v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > > > > + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- > > > > v2.23.tar.gz > > > > + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- > > > > v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ > > > > ./extensions/ > > > > > > > > # imq > > > > @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst > > > > %,$(DIR_DL)/%,$(objects)) > > > > --libdir=/lib \ > > > > --includedir=/usr/include \ > > > > --enable-libipq \ > > > > + --with-xtlibdir=/lib/xtables \ > > > > --libexecdir=/lib \ > > > > --bindir=/sbin \ > > > > --sbindir=/sbin \ > > > > -- > > > > 2.12.2 > > > > > > > > > > > >
Hi, > On 5 Mar 2019, at 12:37, ummeegge <ummeegge@ipfire.org> wrote: > > Hi Michael, > > On Di, 2019-03-05 at 09:47 +0000, Michael Tremer wrote: >> Hi, >> >> I will just merge this and then we will see during testing of the >> Core Update. > Have deleted all the *legacy* binaries and as before, no problems at > all. Should i send another patch without them ? If those are all symlinks, I guess it makes sense to remove them, because they are more confusing than anything else. Please submit another patch. Remember that I have already merged this one. > >> >> What could possibly go wrong? > Have currently no problems in focus. > Have build also nftables (with libnftnl with an extended iptables-1.8.2 > version which incl. also ebtables, arptables, the translation stuff and > a lot more) to check there for some possible usage of the *legacy* > stuff. It is currently possible to use both (iptables beneath nftables) > which offers some funky new possiblities :D but in there the same, did > NOT needed the *legacy* binaries since all known iptables binaries are > still presant but possibly i have missed/overseen something. I do not think that there is any sense to build notables for IPFire 2. It is disabled in the kernel, we are using some extensions that only work for iptables (l7 filter, geoid, ipp2p) and therefore we can never use it. -Michael > > At least all is working. > > Best, > > Erik > >> >> Best, >> -Michael >> >>> On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote: >>> >>> Hi Michael, >>> >>> On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote: >>>> Hi, >>>> >>>> This release of iptables has some interesting changes: >>>> >>>> We now have multiple binaries with -legacy in name. >>> >>> Yes i was also a little in wonder about that although it looked a >>> little like a helper tool if nftables and iptables running at the >>> same >>> time. Looking at linuxfromscratch --> >>> http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html >>> if '--disable-nftables' has been set, there are no *-legacy* >>> binaries >>> listed under "Installed Programs:". >>> There is also the xtables-legacy-multi binary and looking into the >>> nftables-wiki --> >>> > https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools >>> >>> (please check the 'link to a summary') it appears that all >>> setsockopt >>> based tools are all now considered as 'legacy'. >>> >>>> >>>> Did you test this? Is there anything we need to think about? >>> >>> Am running iptables-1.8.2 currently with a backup of my production >>> machine with ~ 50 rules and a vast IPset configuration >>> (firewall.local) >>> and i haven´t recognized problems. >>> >>> Some other tests i made: >>> Made also a diff between 'iptables-legacy-save' and 'iptables-save' >>> whereby the output seems to be pretty much the same. >>> Moved then also all iptables-legacy* binaries away, restarted the >>> machine and all seems to work as it should. >>> >>> Since it is a little a sensible update, it is great to go for some >>> more >>> overviews/testings/thinking_abouts. >>> >>> Best, >>> >>> >>> Erik >>> >>>> >>>> -Michael >>>> >>>>> On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> >>>>> wrote: >>>>> >>>>> netfilter-layer7 has also been updated to v2.23 . >>>>> >>>>> Signed-off-by: Erik Kapfer <ummeegge@ipfire.org> >>>>> --- >>>>> config/rootfiles/common/iptables | 19 ++++++++++++------- >>>>> lfs/iptables | 17 +++++++++-------- >>>>> 2 files changed, 21 insertions(+), 15 deletions(-) >>>>> >>>>> diff --git a/config/rootfiles/common/iptables >>>>> b/config/rootfiles/common/iptables >>>>> index d7584c0ad..9aa9e51cb 100644 >>>>> --- a/config/rootfiles/common/iptables >>>>> +++ b/config/rootfiles/common/iptables >>>>> @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 >>>>> #lib/libxtables.la >>>>> lib/libxtables.so >>>>> lib/libxtables.so.12 >>>>> -lib/libxtables.so.12.0.0 >>>>> +lib/libxtables.so.12.2.0 >>>>> #lib/xtables >>>>> -lib/xtables/libebt_802_3.so >>>>> -lib/xtables/libebt_ip.so >>>>> -lib/xtables/libebt_log.so >>>>> -lib/xtables/libebt_mark_m.so >>>>> lib/xtables/libip6t_DNAT.so >>>>> lib/xtables/libip6t_DNPT.so >>>>> lib/xtables/libip6t_HL.so >>>>> @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so >>>>> lib/xtables/libxt_length.so >>>>> lib/xtables/libxt_limit.so >>>>> lib/xtables/libxt_mac.so >>>>> -lib/xtables/libxt_mangle.so >>>>> lib/xtables/libxt_mark.so >>>>> lib/xtables/libxt_multiport.so >>>>> lib/xtables/libxt_nfacct.so >>>>> @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so >>>>> lib/xtables/libxt_u32.so >>>>> lib/xtables/libxt_udp.so >>>>> sbin/ip6tables >>>>> +sbin/ip6tables-legacy >>>>> +sbin/ip6tables-legacy-restore >>>>> +sbin/ip6tables-legacy-save >>>>> sbin/ip6tables-restore >>>>> sbin/ip6tables-save >>>>> sbin/iptables >>>>> +sbin/iptables-legacy >>>>> +sbin/iptables-legacy-restore >>>>> +sbin/iptables-legacy-save >>>>> sbin/iptables-restore >>>>> sbin/iptables-save >>>>> sbin/iptables-xml >>>>> #sbin/nfnl_osf >>>>> -sbin/xtables-multi >>>>> +sbin/xtables-legacy-multi >>>>> #usr/include/libipq.h >>>>> #usr/include/libiptc >>>>> #usr/include/libiptc/ipt_kernel_headers.h >>>>> @@ -178,5 +179,9 @@ sbin/xtables-multi >>>>> #usr/share/man/man8/iptables-save.8 >>>>> #usr/share/man/man8/iptables.8 >>>>> #usr/share/man/man8/nfnl_osf.8 >>>>> +#usr/share/man/man8/xtables-legacy.8 >>>>> +#usr/share/man/man8/xtables-monitor.8 >>>>> +#usr/share/man/man8/xtables-nft.8 >>>>> +#usr/share/man/man8/xtables-translate.8 >>>>> #usr/share/xtables >>>>> usr/share/xtables/pf.os >>>>> diff --git a/lfs/iptables b/lfs/iptables >>>>> index b4a2834b8..17817a9ef 100644 >>>>> --- a/lfs/iptables >>>>> +++ b/lfs/iptables >>>>> @@ -1,7 +1,7 @@ >>>>> ############################################################### >>>>> #### >>>>> ############ >>>>> # >>>>> >>>>> # >>>>> # IPFire.org - A linux based >>>>> firewall # >>>>> -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> >>>>> >>>>> # >>>>> +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> >>>>> >>>>> # >>>>> # >>>>> >>>>> # >>>>> # This program is free software: you can redistribute it and/or >>>>> modify # >>>>> # it under the terms of the GNU General Public License as >>>>> published >>>>> by # >>>>> @@ -24,7 +24,7 @@ >>>>> >>>>> include Config >>>>> >>>>> -VER = 1.6.2 >>>>> +VER = 1.8.2 >>>>> >>>>> THISAPP = iptables-$(VER) >>>>> DL_FILE = $(THISAPP).tar.bz2 >>>>> @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) >>>>> # Top-level Rules >>>>> ############################################################### >>>>> #### >>>>> ############ >>>>> objects = $(DL_FILE) \ >>>>> - netfilter-layer7-v2.22.tar.gz >>>>> + netfilter-layer7-v2.23.tar.gz >>>>> >>>>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE) >>>>> -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter- >>>>> layer7- >>>>> v2.22.tar.gz >>>>> +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter- >>>>> layer7- >>>>> v2.23.tar.gz >>>>> >>>>> -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d >>>>> -netfilter-layer7-v2.22.tar.gz_MD5 = >>>>> 98dff8a3d5a31885b73341633f69501f >>>>> +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 >>>>> +netfilter-layer7-v2.23.tar.gz_MD5 = >>>>> 10910b6173d18e426cb56ae7e1300eeb >>>>> >>>>> install : $(TARGET) >>>>> >>>>> @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst >>>>> %,$(DIR_DL)/%,$(objects)) >>>>> @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) >>>>> >>>>> # Layer7 >>>>> - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- >>>>> v2.22.tar.gz >>>>> - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- >>>>> v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ >>>>> + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7- >>>>> v2.23.tar.gz >>>>> + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7- >>>>> v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ >>>>> ./extensions/ >>>>> >>>>> # imq >>>>> @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst >>>>> %,$(DIR_DL)/%,$(objects)) >>>>> --libdir=/lib \ >>>>> --includedir=/usr/include \ >>>>> --enable-libipq \ >>>>> + --with-xtlibdir=/lib/xtables \ >>>>> --libexecdir=/lib \ >>>>> --bindir=/sbin \ >>>>> --sbindir=/sbin \ >>>>> -- >>>>> 2.12.2 >>>>> >>>> >>>> >> >> >
diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables index d7584c0ad..9aa9e51cb 100644 --- a/config/rootfiles/common/iptables +++ b/config/rootfiles/common/iptables @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 #lib/libxtables.la lib/libxtables.so lib/libxtables.so.12 -lib/libxtables.so.12.0.0 +lib/libxtables.so.12.2.0 #lib/xtables -lib/xtables/libebt_802_3.so -lib/xtables/libebt_ip.so -lib/xtables/libebt_log.so -lib/xtables/libebt_mark_m.so lib/xtables/libip6t_DNAT.so lib/xtables/libip6t_DNPT.so lib/xtables/libip6t_HL.so @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so lib/xtables/libxt_length.so lib/xtables/libxt_limit.so lib/xtables/libxt_mac.so -lib/xtables/libxt_mangle.so lib/xtables/libxt_mark.so lib/xtables/libxt_multiport.so lib/xtables/libxt_nfacct.so @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so lib/xtables/libxt_u32.so lib/xtables/libxt_udp.so sbin/ip6tables +sbin/ip6tables-legacy +sbin/ip6tables-legacy-restore +sbin/ip6tables-legacy-save sbin/ip6tables-restore sbin/ip6tables-save sbin/iptables +sbin/iptables-legacy +sbin/iptables-legacy-restore +sbin/iptables-legacy-save sbin/iptables-restore sbin/iptables-save sbin/iptables-xml #sbin/nfnl_osf -sbin/xtables-multi +sbin/xtables-legacy-multi #usr/include/libipq.h #usr/include/libiptc #usr/include/libiptc/ipt_kernel_headers.h @@ -178,5 +179,9 @@ sbin/xtables-multi #usr/share/man/man8/iptables-save.8 #usr/share/man/man8/iptables.8 #usr/share/man/man8/nfnl_osf.8 +#usr/share/man/man8/xtables-legacy.8 +#usr/share/man/man8/xtables-monitor.8 +#usr/share/man/man8/xtables-nft.8 +#usr/share/man/man8/xtables-translate.8 #usr/share/xtables usr/share/xtables/pf.os diff --git a/lfs/iptables b/lfs/iptables index b4a2834b8..17817a9ef 100644 --- a/lfs/iptables +++ b/lfs/iptables @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info@ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.6.2 +VER = 1.8.2 THISAPP = iptables-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) # Top-level Rules ############################################################################### objects = $(DL_FILE) \ - netfilter-layer7-v2.22.tar.gz + netfilter-layer7-v2.23.tar.gz $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d -netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 +netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb install : $(TARGET) @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) # Layer7 - cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz - cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ + cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz + cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ ./extensions/ # imq @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --libdir=/lib \ --includedir=/usr/include \ --enable-libipq \ + --with-xtlibdir=/lib/xtables \ --libexecdir=/lib \ --bindir=/sbin \ --sbindir=/sbin \