ipset: use in-tree kernel modules to fix crash issues

[openwrt/staging/rmilecki.git] / package / kernel / linux / modules / netfilter.mk

diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index a25274efce4c830d39a01bd131a26fc1f8b5be52..8dfb1a321b3d7a954b998edb91b8fdd1cd1a2686 100644 (file)
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -223,6 +223,54 @@ endef
 
 $(eval $(call KernelPackage,ipt-ipsec))
 
+IPSET_MODULES:= \
+       ipset/ip_set \
+       ipset/ip_set_bitmap_ip \
+       ipset/ip_set_bitmap_ipmac \
+       ipset/ip_set_bitmap_port \
+       ipset/ip_set_hash_ip \
+       ipset/ip_set_hash_ipmark \
+       ipset/ip_set_hash_ipport \
+       ipset/ip_set_hash_ipportip \
+       ipset/ip_set_hash_ipportnet \
+       ipset/ip_set_hash_mac \
+       ipset/ip_set_hash_netportnet \
+       ipset/ip_set_hash_net \
+       ipset/ip_set_hash_netnet \
+       ipset/ip_set_hash_netport \
+       ipset/ip_set_hash_netiface \
+       ipset/ip_set_list_set \
+       xt_set
+
+define KernelPackage/ipt-ipset
+  SUBMENU:=Netfilter Extensions
+  TITLE:=IPset netfilter modules
+  DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
+  KCONFIG:= \
+       CONFIG_IP_SET \
+       CONFIG_IP_SET_MAX=256 \
+       CONFIG_NETFILTER_XT_SET \
+       CONFIG_IP_SET_BITMAP_IP \
+       CONFIG_IP_SET_BITMAP_IPMAC \
+       CONFIG_IP_SET_BITMAP_PORT \
+       CONFIG_IP_SET_HASH_IP \
+       CONFIG_IP_SET_HASH_IPMARK \
+       CONFIG_IP_SET_HASH_IPPORT \
+       CONFIG_IP_SET_HASH_IPPORTIP \
+       CONFIG_IP_SET_HASH_IPPORTNET \
+       CONFIG_IP_SET_HASH_MAC \
+       CONFIG_IP_SET_HASH_NET \
+       CONFIG_IP_SET_HASH_NETNET \
+       CONFIG_IP_SET_HASH_NETIFACE \
+       CONFIG_IP_SET_HASH_NETPORT \
+       CONFIG_IP_SET_HASH_NETPORTNET \
+       CONFIG_IP_SET_LIST_SET \
+       CONFIG_NET_EMATCH_IPSET=n
+  FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
+  AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
+endef
+$(eval $(call KernelPackage,ipt-ipset))
+
 
 define KernelPackage/ipt-nat
   TITLE:=Basic NAT targets
@@ -247,6 +295,9 @@ define KernelPackage/ipt-nat6
   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
   $(call AddDepends/ipt,+kmod-nf-nat6)
+  $(call AddDepends/ipt,+kmod-ipt-conntrack)
+  $(call AddDepends/ipt,+kmod-ipt-nat)
+  $(call AddDepends/ipt,+kmod-ip6tables)
 endef
 
 define KernelPackage/ipt-nat6/description
@@ -493,6 +544,54 @@ endef
 
 $(eval $(call KernelPackage,ipt-iprange))
 
+define KernelPackage/ipt-cluster
+  TITLE:=Module for matching cluster
+  KCONFIG:=$(KCONFIG_IPT_CLUSTER)
+  FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
+  $(call AddDepends/ipt)
+endef
+
+define KernelPackage/ipt-cluster/description
+ Netfilter (IPv4/IPv6) module for matching cluster
+ This option allows you to build work-load-sharing clusters of
+ network servers/stateful firewalls without having a dedicated
+ load-balancing router/server/switch. Basically, this match returns
+ true when the packet must be handled by this cluster node. Thus,
+ all nodes see all packets and this match decides which node handles
+ what packets. The work-load sharing algorithm is based on source
+ address hashing.
+
+ This module is usable for ipv4 and ipv6.
+
+ To use it also enable iptables-mod-cluster
+
+ see `iptables -m cluster --help` for more information.
+endef
+
+$(eval $(call KernelPackage,ipt-cluster))
+
+define KernelPackage/ipt-clusterip
+  TITLE:=Module for CLUSTERIP
+  KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
+  FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
+  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
+  $(call AddDepends/ipt,+kmod-nf-conntrack)
+endef
+
+define KernelPackage/ipt-clusterip/description
+ Netfilter (IPv4-only) module for CLUSTERIP
+ The CLUSTERIP target allows you to build load-balancing clusters of
+ network servers without having a dedicated load-balancing
+ router/server/switch.
+
+ To use it also enable iptables-mod-clusterip
+
+ see `iptables -j CLUSTERIP --help` for more information.
+endef
+
+$(eval $(call KernelPackage,ipt-clusterip))
+
 
 define KernelPackage/ipt-extra
   TITLE:=Extra modules