- Fixes problems with reusing matches or targets from loadable extensions
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36826 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Make the "best" address / prefix the first one being announced
* Only add the "best" address to the hosts-file
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36772 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Announce delegated prefixes using route info according to RFC 6204 L-3
* Enable hybrid stateless + stateful DHCPv6-mode as default
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36738 3c298f89-4303-0410-b956-a3cf2f4a3e73
- allows building without IPv6 support
- uses more robust rules to cope with missing libext.a
- uses better linking strategy to avoid symbol clashes with older iptables
- introduces source compatiblity layer for different libxtables versions
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36736 3c298f89-4303-0410-b956-a3cf2f4a3e73
- allows symbolic notation for src_ip, src_dip and dest_ip options, e.g. option src_ip 'lan' to automatically resolve to "192.168.1.0/24"
- automatically infer destination zone for redirects from target ip, this makes 'dest' optional and nat reflection setup more robust
- properly support output rules with dest '*' to hook directly into delegate_output
- fixes crash when processing rules with unresolved targets
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36721 3c298f89-4303-0410-b956-a3cf2f4a3e73
- Use weak references for instantiating libext*.a matches, makes fw3 independant from the compile time features of iptables
- Do not leak memory when processing rules with unknown targets or matches
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36698 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes reload when firewall is not running already
- fixes crash when ipsets are supported but undeclared
- fixes handling of per zone user chains on reload
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36689 3c298f89-4303-0410-b956-a3cf2f4a3e73
- fixes segfault in flush command if ipset support is not available
- fixes internal rule generation if custom chains are enabled
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36686 3c298f89-4303-0410-b956-a3cf2f4a3e73
* use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions
* make ipset integration more reliable
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36681 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Be more standards-compliant in stateful mode
* Handle hostnames from Windows-clients correctly
* Handle messages from DHCPv6-relays better
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36677 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add management_level option (0: set O-flag, >=1: set M-flag)
* Add support for static DHCPv6-leases
* Various fixes for DHCPv6-PD
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36654 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add interface option to set routing table for protocol routes
* Enabled for IPv6 for source-based filtering, disabled for IPv4
Based on a patch by Kristian Evensen. Thank You.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36653 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add support for IP-in-IPv6 tunnels (DS-Lite)
* Use source-based routing for IPv6 to allow multi-wan
* Various smaller tunnel setup improvements
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36627 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch simply adds support for the "--proxy-dnssec" command in dnsmasq into the init file so it can be used with /etc/config/dhcp.
Signed-off-by: Adam Gensler <openwrt@kristenandadam.net>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36570 3c298f89-4303-0410-b956-a3cf2f4a3e73
Previously if the upstream router did not provide any DHCPv6-service
the wan6 interface would not come up even if RAs were received. The new
behavior allows the wan6 interface to comeup with RA-only configuration
after a timeout of 10s.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36555 3c298f89-4303-0410-b956-a3cf2f4a3e73
- assume "tcp+udp" if no protcol is specified in rules or redirects (#13422, #13386)
- add support for fwmark matches and mark setting targets
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36521 3c298f89-4303-0410-b956-a3cf2f4a3e73
libiptc.pc depends on libip[4|6]tc.pc, thus all of those need to be
installed.
Should fix collectd build and thus #13146; which should make collectd
appear in snapshots again.
Signed-off-by: Danny Baumann <dannybaumann@web.de>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36509 3c298f89-4303-0410-b956-a3cf2f4a3e73
This fixes working behind another router which gives out ULAs.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36416 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Add preliminary support for RFC 6603 prefix exclusion
* Fix reconfigure-support and reconfigure authentication
* Set maximum retransmission timeout for solicitations to 2h
* Fix a segfault when parsing IA_PD in advertise messages
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36382 3c298f89-4303-0410-b956-a3cf2f4a3e73
make the syntax more compatible with kernel menuconfig
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36351 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Fix a memory corruption when updating IPv6 prefixes
* Fix route sorting order (nbd)
* Add support for ip rules (jow)
* Implement support for route / route6 table attribute (jow)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36196 3c298f89-4303-0410-b956-a3cf2f4a3e73
Thanks to Markus Stenberg for investigating and providing a fix
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36132 3c298f89-4303-0410-b956-a3cf2f4a3e73
* fixes parsing of src/dest '*'
* fixes parsing of proto 'all'
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36111 3c298f89-4303-0410-b956-a3cf2f4a3e73
This patch fixes some compile problems with kernel 3.9 and adds some missing linux 3.9 handling into kernel packages.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36098 3c298f89-4303-0410-b956-a3cf2f4a3e73
* fixes reload handling of zones and ipsets that are still running but already deleted from the config
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36092 3c298f89-4303-0410-b956-a3cf2f4a3e73
- support network names in per-zone 'masq_src', 'masq_dest' and 'subnet' options (#13197)
- do not allow src_mac option for SNAT rules
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36090 3c298f89-4303-0410-b956-a3cf2f4a3e73
Supports listing, removing and banning clients, and hooking into
probe/assoc/auth requests via object subscribe.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36081 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Introduce "option reload" for includes to specify whether includes should be processed on reload (e.g. when tapping into internal chains)
* Allow "network" and "device" commands while firewall is running (to make them usable in includes)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36009 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Adds support for emitting hotplug events when creating and clearing zones (fixes miniupnpd)
* Make NAT reflection direction configurable
* Map init script stop action to flush
* Map init script reload action to reload
* Respect init script disabled state in hotplug handler
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35998 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Fixes compilation against eglibc
* Fixes tracking logic when selectively restarting IPv4 or IPv6 firewall
* Fixes tracking logic for user chains by differentiating between reloads and restarts
* Introduces per-zone user chains {input,output,forwarding,prerouting,postrouting}_$zone_rule
* Supports legacy "tcpudp" protocol notation again
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35969 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Don't prematurely send RENEW / REBIND when T1 or T2 is > 1 day
* Add "norelease" option to not send a RELEASE when stopping
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35902 3c298f89-4303-0410-b956-a3cf2f4a3e73
Spurious errors when receiving netlink-messages lead to unhandled errors
which caused SIGBUS. Thanks to tdavis for debugging
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35836 3c298f89-4303-0410-b956-a3cf2f4a3e73
cap preferred and valid lifetimes at more reasonable limits
decrease memory usage (remove unnecessary book-keeping)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35835 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Announce ULA as deprecated if other addresses are available
* Allow the announced DNS-server to be overwritten
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35803 3c298f89-4303-0410-b956-a3cf2f4a3e73
- all uci rules are boxed in custom chains now, so a firewall stop leaves user rules intact
- properly handle selective ipv4 or ipv6 only firewall start/stop/restart actions
- support ip ranges (e.g. option src_ip '!192.168.1.1-192.168.1.100' -> -m iprange ! --src-range 192.168.1.1-192.168.1.100')
- support time options (e.g. option weekdays 'Mon Tue Sat' -> -m time --weekdays 1,2,6')
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35738 3c298f89-4303-0410-b956-a3cf2f4a3e73
Spotted by doing an ARM hard float build.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35685 3c298f89-4303-0410-b956-a3cf2f4a3e73
Based on a patch from НКВД. Closes#12962.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35610 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Don't send undesired suggestions for preferred and valid lifetimes
* Be less verbose in logging
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35553 3c298f89-4303-0410-b956-a3cf2f4a3e73
Jo-Philipp Wich
Felix Fietkau
Steven Barth
Luka Perkov
John Crispin
Hauke Mehrtens
Florian Fainelli
Jonas Gorski