Use new strongSwan HA kernel patchset keeping iptables ABI
Allows us to install stock debian iptables without the need for patching and compiling our own.
This commit is contained in:
parent
b5f3c1f785
commit
c59f3dcb68
|
@ -20,7 +20,6 @@ INC=$INC,gnat,gprbuild,libahven3-dev,libxmlada4.1-dev,libgmpada3-dev
|
|||
INC=$INC,libalog0.4.1-base-dev,hostapd
|
||||
SERVICES="apache2 dbus isc-dhcp-server slapd bind9"
|
||||
INC=$INC,${SERVICES// /,}
|
||||
EXC=iptables
|
||||
|
||||
CACHEDIR=$BUILDDIR/cache
|
||||
APTCACHE=$LOOPDIR/var/cache/apt/archives
|
||||
|
@ -67,7 +66,7 @@ execute "mount -o bind $CACHEDIR $APTCACHE"
|
|||
do_on_exit graceful_umount $APTCACHE
|
||||
|
||||
log_action "Running debootstrap ($BASEIMGSUITE, $BASEIMGARCH)"
|
||||
execute "debootstrap --arch=$BASEIMGARCH --include=$INC --exclude $EXC $BASEIMGSUITE $LOOPDIR $BASEIMGMIRROR"
|
||||
execute "debootstrap --arch=$BASEIMGARCH --include=$INC $BASEIMGSUITE $LOOPDIR $BASEIMGMIRROR"
|
||||
|
||||
execute "mount -t proc none $LOOPDIR/proc"
|
||||
do_on_exit graceful_umount $LOOPDIR/proc
|
||||
|
|
|
@ -1,37 +0,0 @@
|
|||
#!/usr/bin/make
|
||||
|
||||
PV = 1.4.16.3
|
||||
PKG = iptables-$(PV)
|
||||
TAR = $(PKG).tar.bz2
|
||||
SRC = http://www.netfilter.org/projects/iptables/files/$(TAR)
|
||||
|
||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
||||
|
||||
CONFIG_OPTS =
|
||||
|
||||
PATCHES = \
|
||||
iptables-xfrm-hooks
|
||||
|
||||
all: install
|
||||
|
||||
$(TAR):
|
||||
wget $(SRC)
|
||||
|
||||
.$(PKG)-unpacked: $(TAR)
|
||||
tar xfj $(TAR)
|
||||
@touch $@
|
||||
|
||||
.$(PKG)-patches-applied: .$(PKG)-unpacked
|
||||
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
|
||||
@touch $@
|
||||
|
||||
.$(PKG)-configured: .$(PKG)-patches-applied
|
||||
cd $(PKG) && ./configure $(CONFIG_OPTS)
|
||||
@touch $@
|
||||
|
||||
.$(PKG)-built: .$(PKG)-configured
|
||||
cd $(PKG) && make -j $(NUM_CPUS)
|
||||
@touch $@
|
||||
|
||||
install: .$(PKG)-built
|
||||
cd $(PKG) && make install
|
|
@ -1,61 +0,0 @@
|
|||
From 4553ba0130bb9f0aa266cc1e4c3288a52f34eed6 Mon Sep 17 00:00:00 2001
|
||||
From: Martin Willi <martin@revosec.ch>
|
||||
Date: Wed, 7 Apr 2010 11:40:15 +0200
|
||||
Subject: [PATCH] Added XFRM hooks to iptables headers
|
||||
|
||||
---
|
||||
include/linux/netfilter.h | 2 ++
|
||||
include/linux/netfilter_ipv4.h | 6 +++++-
|
||||
include/linux/netfilter_ipv6.h | 6 +++++-
|
||||
3 files changed, 12 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
|
||||
index 2eb00b6..b692c67 100644
|
||||
--- a/include/linux/netfilter.h
|
||||
+++ b/include/linux/netfilter.h
|
||||
@@ -35,6 +35,8 @@ enum nf_inet_hooks {
|
||||
NF_INET_FORWARD,
|
||||
NF_INET_LOCAL_OUT,
|
||||
NF_INET_POST_ROUTING,
|
||||
+ NF_INET_XFRM_IN,
|
||||
+ NF_INET_XFRM_OUT,
|
||||
NF_INET_NUMHOOKS
|
||||
};
|
||||
|
||||
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
|
||||
index 4d7ba3e..28d3ca9 100644
|
||||
--- a/include/linux/netfilter_ipv4.h
|
||||
+++ b/include/linux/netfilter_ipv4.h
|
||||
@@ -47,7 +47,11 @@
|
||||
#define NF_IP_LOCAL_OUT 3
|
||||
/* Packets about to hit the wire. */
|
||||
#define NF_IP_POST_ROUTING 4
|
||||
-#define NF_IP_NUMHOOKS 5
|
||||
+/* Packets going into XFRM input transformation. */
|
||||
+#define NF_IP_XFRM_IN 5
|
||||
+/* Packets going into XFRM output transformation. */
|
||||
+#define NF_IP_XFRM_OUT 6
|
||||
+#define NF_IP_NUMHOOKS 7
|
||||
|
||||
enum nf_ip_hook_priorities {
|
||||
NF_IP_PRI_FIRST = INT_MIN,
|
||||
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
|
||||
index 7430b39..18590a5 100644
|
||||
--- a/include/linux/netfilter_ipv6.h
|
||||
+++ b/include/linux/netfilter_ipv6.h
|
||||
@@ -51,7 +51,11 @@
|
||||
#define NF_IP6_LOCAL_OUT 3
|
||||
/* Packets about to hit the wire. */
|
||||
#define NF_IP6_POST_ROUTING 4
|
||||
-#define NF_IP6_NUMHOOKS 5
|
||||
+/* Packets going into XFRM input transformation. */
|
||||
+#define NF_IP6_XFRM_IN 5
|
||||
+/* Packets going into XFRM output transformation. */
|
||||
+#define NF_IP6_XFRM_OUT 6
|
||||
+#define NF_IP6_NUMHOOKS 7
|
||||
|
||||
|
||||
enum nf_ip6_hook_priorities {
|
||||
--
|
||||
1.6.3.3
|
||||
|
|
@ -22,7 +22,7 @@ KERNELVERSION=3.8.1
|
|||
KERNEL=linux-$KERNELVERSION
|
||||
KERNELTARBALL=$KERNEL.tar.bz2
|
||||
KERNELCONFIG=$DIR/../config/kernel/config-3.8
|
||||
KERNELPATCH=ha-3.8.patch.bz2
|
||||
KERNELPATCH=ha-3.8-abicompat.patch.bz2
|
||||
|
||||
# strongSwan version used in tests
|
||||
SWANVERSION=5.0.3
|
||||
|
|
Loading…
Reference in New Issue