From 0e2dcfc4f488ecd7acf31e01bd10624d8a273cde Mon Sep 17 00:00:00 2001 From: Joel Low Date: Sat, 14 Dec 2024 21:39:36 +0800 Subject: [PATCH] netfilter: add kmod-nfnetlink-ct{helper,timeout} Add kmod-nfnetlink-ct{helper,timeout} to allow handling firewall rules in userspace (together with conntrackd). The timeout module allows specifying custom expiration rules. Signed-off-by: Joel Low Link: https://github.com/openwrt/openwrt/pull/17267 Signed-off-by: Hauke Mehrtens --- config/Config-kernel.in | 7 +++++ package/kernel/linux/modules/netfilter.mk | 34 +++++++++++++++++++++++ 2 files changed, 41 insertions(+) diff --git a/config/Config-kernel.in b/config/Config-kernel.in index 91678cf2a6..64c8c63466 100644 --- a/config/Config-kernel.in +++ b/config/Config-kernel.in @@ -1239,6 +1239,13 @@ config KERNEL_MPTCP_IPV6 default KERNEL_MPTCP endif +config KERNEL_NF_CONNTRACK_TIMEOUT + bool "Per-connection connection tracking timeout" + default y if !SMALL_FLASH + help + Select this option to enable support for per-connection conntrack timeouts. + Increases the (uncompressed) size of nf_conntrack.ko by ~8kB. + # # NFS related symbols # diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk index cf66bd8cd8..30ff35ca6b 100644 --- a/package/kernel/linux/modules/netfilter.mk +++ b/package/kernel/linux/modules/netfilter.mk @@ -1048,6 +1048,40 @@ endef $(eval $(call KernelPackage,nfnetlink-queue)) +define KernelPackage/nfnetlink-cthelper + TITLE:=Netfilter User space conntrack helpers + FILES:=$(LINUX_DIR)/net/netfilter/nfnetlink_cthelper.ko + KCONFIG:=CONFIG_NF_CT_NETLINK_HELPER + AUTOLOAD:=$(call AutoProbe,nfnetlink_cthelper) + $(call AddDepends/nfnetlink,+kmod-nfnetlink-queue +kmod-nf-conntrack-netlink) +endef + +define KernelPackage/nfnetlink-cthelper/description + Kernel modules support for a netlink-based connection tracking + userspace helpers interface +endef + +$(eval $(call KernelPackage,nfnetlink-cthelper)) + + +define KernelPackage/nfnetlink-cttimeout + TITLE:=Netfilter conntrack expectation timeout + FILES:=$(LINUX_DIR)/net/netfilter/nfnetlink_cttimeout.ko + KCONFIG:=CONFIG_NF_CT_NETLINK_TIMEOUT + AUTOLOAD:=$(call AutoProbe,nfnetlink_cttimeout) + $(call AddDepends/nfnetlink,+kmod-nf-conntrack +kmod-nf-conntrack-timeout @KERNEL_NF_CONNTRACK_TIMEOUT) +endef + +define KernelPackage/nfnetlink-cttimeout/description + Kernel modules support for a netlink-based connection tracking + userspace timeout interface + + Requires CONFIG_NF_CONNTRACK_TIMEOUT (only enabled for non-small flash devices) +endef + +$(eval $(call KernelPackage,nfnetlink-cttimeout)) + + define KernelPackage/nf-conntrack-netlink TITLE:=Connection tracking netlink interface FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko -- 2.30.2