From 0db3c58329ec17ee09ab2abe1b821c55369512a4 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sun, 23 Jan 2022 11:36:08 +0100 Subject: [PATCH 1/2] modules: update OpenWrt base 97b95ef8b918 uci: update to the latest master Replace the downstream UCI patch with a proper OpenWrt 21.02 backport. --- modules | 2 +- ...li-add-option-for-changing-save-path.patch | 83 ------------------- ...ols-allow-generating-private_key-v3.patch} | 0 3 files changed, 1 insertion(+), 84 deletions(-) delete mode 100644 patches/openwrt/0005-package-uci-backport-cli-add-option-for-changing-save-path.patch rename patches/openwrt/{0006-wireguard-tools-allow-generating-private_key-v3.patch => 0005-wireguard-tools-allow-generating-private_key-v3.patch} (100%) diff --git a/modules b/modules index 20b22b3c..5654db74 100644 --- a/modules +++ b/modules @@ -2,7 +2,7 @@ GLUON_FEEDS='packages routing gluon' OPENWRT_REPO=https://github.com/openwrt/openwrt.git OPENWRT_BRANCH=openwrt-21.02 -OPENWRT_COMMIT=1472a8fa4253c0aed5053adffe59463ceb94f139 +OPENWRT_COMMIT=97b95ef8b9186518cda6f2d3cec8a01860fae2e7 PACKAGES_PACKAGES_REPO=https://github.com/openwrt/packages.git PACKAGES_PACKAGES_BRANCH=openwrt-21.02 diff --git a/patches/openwrt/0005-package-uci-backport-cli-add-option-for-changing-save-path.patch b/patches/openwrt/0005-package-uci-backport-cli-add-option-for-changing-save-path.patch deleted file mode 100644 index a3f4f92a..00000000 --- a/patches/openwrt/0005-package-uci-backport-cli-add-option-for-changing-save-path.patch +++ /dev/null @@ -1,83 +0,0 @@ -From: Leonardo Mörlein -Date: Sat, 16 Jan 2021 23:11:01 +0100 -Subject: package/uci: backport: "cli: add option for changing save path" - -This is a backport of - -https://git.openwrt.org/?p=project/uci.git;a=commit;h=4b3db1179747b6a6779029407984bacef851325c - -diff --git a/package/system/uci/Makefile b/package/system/uci/Makefile -index 75fc1bdfad0694aac99830b9b0cc87b42ea16e7d..924d5bb4824f567888e2ffd2954429af8f4fd504 100644 ---- a/package/system/uci/Makefile -+++ b/package/system/uci/Makefile -@@ -9,7 +9,7 @@ - include $(TOPDIR)/rules.mk - - PKG_NAME:=uci --PKG_RELEASE:=5 -+PKG_RELEASE:=6 - - PKG_SOURCE_URL=$(PROJECT_GIT)/project/uci.git - PKG_SOURCE_PROTO:=git -diff --git a/package/system/uci/patches/0001-cli-add-option-for-changin-save-path.patch b/package/system/uci/patches/0001-cli-add-option-for-changin-save-path.patch -new file mode 100644 -index 0000000000000000000000000000000000000000..377aec41fe6928aa26bccdde9fd77576d57ec4ed ---- /dev/null -+++ b/package/system/uci/patches/0001-cli-add-option-for-changin-save-path.patch -@@ -0,0 +1,56 @@ -+From: Rafał Miłecki -+Date: Mon, 12 Apr 2021 14:05:52 +0000 (+0200) -+Subject: cli: add option for changing save path -+X-Git-Url: http://git.openwrt.org/?p=project%2Fuci.git;a=commitdiff_plain;h=4b3db1179747b6a6779029407984bacef851325c;hp=52bbc99f69ea6f67b6fe264f424dac91bde5016c -+ -+cli: add option for changing save path -+ -+Save path is a directory where config change (delta) files are stored. -+Having a custom individual save dir can be used to prevent two (or more) -+"uci" cli callers (e.g. bash scripts) from commiting each other changes. -+ -+In the following example: -+ -+App0 App1 -+---- ---- -+uci set system.@system[0].timezone=UTC -+ uci set system.@system[0].hostname=OpenWrt -+ uci commit system -+ -+App1 would unintentionally commit changes made by App0. This can be -+avoided by at least 1 "uci" cli user specifying a custom -t option. -+ -+Signed-off-by: Rafał Miłecki -+--- -+ -+diff --git a/cli.c b/cli.c -+index 267437d..2fce39d 100644 -+--- a/cli.c -++++ b/cli.c -+@@ -167,6 +167,7 @@ static void uci_usage(void) -+ "\t-N don't name unnamed sections\n" -+ "\t-p add a search path for config change files\n" -+ "\t-P add a search path for config change files and use as default\n" -++ "\t-t set save path for config change files\n" -+ "\t-q quiet mode (don't print error messages)\n" -+ "\t-s force strict mode (stop on parser errors, default)\n" -+ "\t-S disable strict mode\n" -+@@ -706,7 +707,7 @@ int main(int argc, char **argv) -+ return 1; -+ } -+ -+- while((c = getopt(argc, argv, "c:d:f:LmnNp:P:sSqX")) != -1) { -++ while((c = getopt(argc, argv, "c:d:f:LmnNp:P:qsSt:X")) != -1) { -+ switch(c) { -+ case 'c': -+ uci_set_confdir(ctx, optarg); -+@@ -754,6 +755,9 @@ int main(int argc, char **argv) -+ case 'q': -+ flags |= CLI_FLAG_QUIET; -+ break; -++ case 't': -++ uci_set_savedir(ctx, optarg); -++ break; -+ case 'X': -+ flags &= ~CLI_FLAG_SHOW_EXT; -+ break; diff --git a/patches/openwrt/0006-wireguard-tools-allow-generating-private_key-v3.patch b/patches/openwrt/0005-wireguard-tools-allow-generating-private_key-v3.patch similarity index 100% rename from patches/openwrt/0006-wireguard-tools-allow-generating-private_key-v3.patch rename to patches/openwrt/0005-wireguard-tools-allow-generating-private_key-v3.patch From 1e50966b84382be2d3d8addeb5025f282ccd39af Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Sun, 23 Jan 2022 10:56:11 +0100 Subject: [PATCH 2/2] kernel: drop obsolete ebtables patches We are on Linux 5.4, so these patches for Linux 4.14 don't do anything. --- ...d-support-for-ICMP-IGMP-type-matches.patch | 240 ------------------ ...ols-allow-generating-private_key-v3.patch} | 0 2 files changed, 240 deletions(-) delete mode 100644 patches/openwrt/0004-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch rename patches/openwrt/{0005-wireguard-tools-allow-generating-private_key-v3.patch => 0004-wireguard-tools-allow-generating-private_key-v3.patch} (100%) diff --git a/patches/openwrt/0004-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch b/patches/openwrt/0004-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch deleted file mode 100644 index 37698460..00000000 --- a/patches/openwrt/0004-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch +++ /dev/null @@ -1,240 +0,0 @@ -From: Matthias Schiffer -Date: Thu, 12 Apr 2018 07:50:02 +0200 -Subject: kernel: ebtables: add support for ICMP/IGMP type matches - -Signed-off-by: Matthias Schiffer - -diff --git a/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch -new file mode 100644 -index 0000000000000000000000000000000000000000..fe9c479338a7b597be649c761c70a63085b51c5f ---- /dev/null -+++ b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch -@@ -0,0 +1,134 @@ -+From: Matthias Schiffer -+Date: Sat, 3 Mar 2018 11:55:21 +0100 -+Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code -+ -+We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP -+matches in the same way. -+ -+Signed-off-by: Matthias Schiffer -+--- -+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++-- -+ net/bridge/netfilter/ebt_ip.c | 43 +++++++++++++++++++++------- -+ 2 files changed, 43 insertions(+), 13 deletions(-) -+ -+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h -++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h -+@@ -24,8 +24,9 @@ -+ #define EBT_IP_PROTO 0x08 -+ #define EBT_IP_SPORT 0x10 -+ #define EBT_IP_DPORT 0x20 -++#define EBT_IP_ICMP 0x40 -+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\ -+- EBT_IP_SPORT | EBT_IP_DPORT ) -++ EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP) -+ #define EBT_IP_MATCH "ip" -+ -+ /* the same values are used for the invflags */ -+@@ -38,8 +39,14 @@ struct ebt_ip_info { -+ __u8 protocol; -+ __u8 bitmask; -+ __u8 invflags; -+- __u16 sport[2]; -+- __u16 dport[2]; -++ union { -++ __u16 sport[2]; -++ __u8 icmp_type[2]; -++ }; -++ union { -++ __u16 dport[2]; -++ __u8 icmp_code[2]; -++ }; -+ }; -+ -+ #endif -+--- a/net/bridge/netfilter/ebt_ip.c -++++ b/net/bridge/netfilter/ebt_ip.c -+@@ -19,9 +19,15 @@ -+ #include -+ #include -+ -+-struct tcpudphdr { -+- __be16 src; -+- __be16 dst; -++union pkthdr { -++ struct { -++ __be16 src; -++ __be16 dst; -++ } tcpudphdr; -++ struct { -++ u8 type; -++ u8 code; -++ } icmphdr; -+ }; -+ -+ static bool -+@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, str -+ const struct ebt_ip_info *info = par->matchinfo; -+ const struct iphdr *ih; -+ struct iphdr _iph; -+- const struct tcpudphdr *pptr; -+- struct tcpudphdr _ports; -++ const union pkthdr *pptr; -++ union pkthdr _pkthdr; -+ -+ ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); -+ if (ih == NULL) -+@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, str -+ if (info->bitmask & EBT_IP_PROTO) { -+ if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol)) -+ return false; -+- if (!(info->bitmask & EBT_IP_DPORT) && -+- !(info->bitmask & EBT_IP_SPORT)) -++ if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT | -++ EBT_IP_ICMP))) -+ return true; -+ if (ntohs(ih->frag_off) & IP_OFFSET) -+ return false; -++ -++ /* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */ -+ pptr = skb_header_pointer(skb, ih->ihl*4, -+- sizeof(_ports), &_ports); -++ sizeof(_pkthdr), &_pkthdr); -+ if (pptr == NULL) -+ return false; -+ if (info->bitmask & EBT_IP_DPORT) { -+- u32 dst = ntohs(pptr->dst); -++ u32 dst = ntohs(pptr->tcpudphdr.dst); -+ if (NF_INVF(info, EBT_IP_DPORT, -+ dst < info->dport[0] || -+ dst > info->dport[1])) -+ return false; -+ } -+ if (info->bitmask & EBT_IP_SPORT) { -+- u32 src = ntohs(pptr->src); -++ u32 src = ntohs(pptr->tcpudphdr.src); -+ if (NF_INVF(info, EBT_IP_SPORT, -+ src < info->sport[0] || -+ src > info->sport[1])) -+ return false; -+ } -++ if ((info->bitmask & EBT_IP_ICMP) && -++ NF_INVF(info, EBT_IP_ICMP, -++ pptr->icmphdr.type < info->icmp_type[0] || -++ pptr->icmphdr.type > info->icmp_type[1] || -++ pptr->icmphdr.code < info->icmp_code[0] || -++ pptr->icmphdr.code > info->icmp_code[1])) -++ return false; -+ } -+ return true; -+ } -+@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct -+ return -EINVAL; -+ if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1]) -+ return -EINVAL; -++ if (info->bitmask & EBT_IP_ICMP) { -++ if ((info->invflags & EBT_IP_PROTO) || -++ info->protocol != IPPROTO_ICMP) -++ return -EINVAL; -++ if (info->icmp_type[0] > info->icmp_type[1] || -++ info->icmp_code[0] > info->icmp_code[1]) -++ return -EINVAL; -++ } -+ return 0; -+ } -+ -diff --git a/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch -new file mode 100644 -index 0000000000000000000000000000000000000000..4c8144834d87c58ff90363cdc2f2933194e54fdc ---- /dev/null -+++ b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch -@@ -0,0 +1,88 @@ -+From: Matthias Schiffer -+Date: Sat, 3 Mar 2018 12:02:21 +0100 -+Subject: [PATCH 2/2] ebtables: add support for matching IGMP type -+ -+We already have ICMPv6 type/code matches (which can be used to distinguish -+different types of MLD packets). Add support for IPv4 IGMP matches in the -+same way. -+ -+Signed-off-by: Matthias Schiffer -+--- -+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 4 +++- -+ net/bridge/netfilter/ebt_ip.c | 19 +++++++++++++++++-- -+ 2 files changed, 20 insertions(+), 3 deletions(-) -+ -+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h -++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h -+@@ -25,8 +25,9 @@ -+ #define EBT_IP_SPORT 0x10 -+ #define EBT_IP_DPORT 0x20 -+ #define EBT_IP_ICMP 0x40 -++#define EBT_IP_IGMP 0x80 -+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\ -+- EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP) -++ EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP) -+ #define EBT_IP_MATCH "ip" -+ -+ /* the same values are used for the invflags */ -+@@ -42,6 +43,7 @@ struct ebt_ip_info { -+ union { -+ __u16 sport[2]; -+ __u8 icmp_type[2]; -++ __u8 igmp_type[2]; -+ }; -+ union { -+ __u16 dport[2]; -+--- a/net/bridge/netfilter/ebt_ip.c -++++ b/net/bridge/netfilter/ebt_ip.c -+@@ -28,6 +28,9 @@ union pkthdr { -+ u8 type; -+ u8 code; -+ } icmphdr; -++ struct { -++ u8 type; -++ } igmphdr; -+ }; -+ -+ static bool -+@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, str -+ if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol)) -+ return false; -+ if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT | -+- EBT_IP_ICMP))) -++ EBT_IP_ICMP | EBT_IP_IGMP))) -+ return true; -+ if (ntohs(ih->frag_off) & IP_OFFSET) -+ return false; -+ -+- /* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */ -++ /* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */ -+ pptr = skb_header_pointer(skb, ih->ihl*4, -+ sizeof(_pkthdr), &_pkthdr); -+ if (pptr == NULL) -+@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, str -+ pptr->icmphdr.code < info->icmp_code[0] || -+ pptr->icmphdr.code > info->icmp_code[1])) -+ return false; -++ if ((info->bitmask & EBT_IP_IGMP) && -++ NF_INVF(info, EBT_IP_IGMP, -++ pptr->igmphdr.type < info->igmp_type[0] || -++ pptr->igmphdr.type > info->igmp_type[1])) -++ return false; -+ } -+ return true; -+ } -+@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct -+ info->icmp_code[0] > info->icmp_code[1]) -+ return -EINVAL; -+ } -++ if (info->bitmask & EBT_IP_IGMP) { -++ if ((info->invflags & EBT_IP_PROTO) || -++ info->protocol != IPPROTO_IGMP) -++ return -EINVAL; -++ if (info->igmp_type[0] > info->igmp_type[1]) -++ return -EINVAL; -++ } -+ return 0; -+ } -+ diff --git a/patches/openwrt/0005-wireguard-tools-allow-generating-private_key-v3.patch b/patches/openwrt/0004-wireguard-tools-allow-generating-private_key-v3.patch similarity index 100% rename from patches/openwrt/0005-wireguard-tools-allow-generating-private_key-v3.patch rename to patches/openwrt/0004-wireguard-tools-allow-generating-private_key-v3.patch