rpms/iptables/devel iptables-1.3.5-secmark.patch, NONE, 1.1 iptables.spec, 1.42, 1.43
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Sep 19 15:36:45 UTC 2006
Author: twoerner
Update of /cvs/dist/rpms/iptables/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv31858
Modified Files:
iptables.spec
Added Files:
iptables-1.3.5-secmark.patch
Log Message:
[tw]
- added secmark iptables patches (#201573)
iptables-1.3.5-secmark.patch:
Makefile | 12 +++
Rules.make | 11 ++-
extensions/Makefile | 15 ++++
extensions/libip6t_CONNSECMARK.c | 124 ++++++++++++++++++++++++++++++++++++
extensions/libip6t_CONNSECMARK.man | 15 ++++
extensions/libip6t_SECMARK.c | 125 ++++++++++++++++++++++++++++++++++++
extensions/libip6t_SECMARK.man | 7 ++
extensions/libipt_CONNSECMARK.c | 126 +++++++++++++++++++++++++++++++++++++
extensions/libipt_CONNSECMARK.man | 15 ++++
extensions/libipt_SECMARK.c | 125 ++++++++++++++++++++++++++++++++++++
extensions/libipt_SECMARK.man | 7 ++
11 files changed, 579 insertions(+), 3 deletions(-)
--- NEW FILE iptables-1.3.5-secmark.patch ---
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c iptables-1.3.5/extensions/libip6t_CONNSECMARK.c
--- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.c 2006-09-07 15:09:40.000000000 +0200
@@ -0,0 +1,124 @@
+/*
+ * Shared library add-on to ip6tables to add CONNSECMARK target support.
+ *
+ * Based on the MARK and CONNMARK targets.
+ *
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris at redhat.com>
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ip6tables.h>
+#include <linux/netfilter/xt_CONNSECMARK.h>
+
+#define PFX "CONNSECMARK target: "
+
+static void help(void)
+{
+ printf(
+"CONNSECMARK target v%s options:\n"
+" --save Copy security mark from packet to conntrack\n"
+" --restore Copy security mark from connection to packet\n"
+"\n",
+IPTABLES_VERSION);
+}
+
+static struct option opts[] = {
+ { "save", 0, 0, '1' },
+ { "restore", 0, 0, '2' },
+ { 0 }
+};
+
+static int parse(int c, char **argv, int invert, unsigned int *flags,
+ const struct ip6t_entry *entry, struct ip6t_entry_target **target)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)(*target)->data;
+
+ switch (c) {
+ case '1':
+ if (*flags & CONNSECMARK_SAVE)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --save twice");
+ info->mode = CONNSECMARK_SAVE;
+ *flags |= CONNSECMARK_SAVE;
+ break;
+
+ case '2':
+ if (*flags & CONNSECMARK_RESTORE)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --restore twice");
+ info->mode = CONNSECMARK_RESTORE;
+ *flags |= CONNSECMARK_RESTORE;
+ break;
+
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+static void final_check(unsigned int flags)
+{
+ if (!flags)
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
+
+ if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
+ exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
+ "or --restore is allowed");
+}
+
+static void print_connsecmark(struct xt_connsecmark_target_info *info)
+{
+ switch (info->mode) {
+ case CONNSECMARK_SAVE:
+ printf("save ");
+ break;
+
+ case CONNSECMARK_RESTORE:
+ printf("restore ");
+ break;
+
+ default:
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
+ }
+}
+
+static void print(const struct ip6t_ip6 *ip,
+ const struct ip6t_entry_target *target, int numeric)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)(target)->data;
+
+ printf("CONNSECMARK ");
+ print_connsecmark(info);
+}
+
+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)target->data;
+
+ printf("--");
+ print_connsecmark(info);
+}
+
+static struct ip6tables_target connsecmark = {
+ .name = "CONNSECMARK",
+ .version = IPTABLES_VERSION,
+ .size = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
+ .userspacesize = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
+ .parse = &parse,
+ .help = &help,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+void _init(void)
+{
+ register_target6(&connsecmark);
+}
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man iptables-1.3.5/extensions/libip6t_CONNSECMARK.man
--- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.man 2006-09-07 15:09:40.000000000 +0200
@@ -0,0 +1,15 @@
+This module copies security markings from packets to connections
+(if unlabeled), and from connections back to packets (also only
+if unlabeled). Typically used in conjunction with SECMARK, it is
+only valid in the
+.B mangle
+table.
+.TP
+.B --save
+If the packet has a security marking, copy it to the connection
+if the connection is not marked.
+.TP
+.B --restore
+If the packet does not have a security marking, and the connection
+does, copy the security marking from the connection to the packet.
+
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c iptables-1.3.5/extensions/libip6t_SECMARK.c
--- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libip6t_SECMARK.c 2006-09-07 15:09:32.000000000 +0200
@@ -0,0 +1,125 @@
+/*
+ * Shared library add-on to iptables to add SECMARK target support.
+ *
+ * Based on the MARK target.
+ *
+ * IPv6 version.
+ *
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris at redhat.com>
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ip6tables.h>
+#include <linux/netfilter/xt_SECMARK.h>
+
+#define PFX "SECMARK target: "
+
+static void help(void)
+{
+ printf(
+"SECMARK target v%s options:\n"
+" --selctx value Set the SELinux security context\n"
+"\n",
+IPTABLES_VERSION);
+}
+
+static struct option opts[] = {
+ { "selctx", 1, 0, '1' },
+ { 0 }
+};
+
+/* Initialize the target. */
+static void init(struct ip6t_entry_target *t, unsigned int *nfcache)
+{ }
+
+/*
+ * Function which parses command options; returns true if it
+ * ate an option.
+ */
+static int parse(int c, char **argv, int invert, unsigned int *flags,
+ const struct ip6t_entry *entry, struct ip6t_entry_target **target)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)(*target)->data;
+
+ switch (c) {
+ case '1':
+ if (*flags & SECMARK_MODE_SEL)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --selctx twice");
+ info->mode = SECMARK_MODE_SEL;
+
+ if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Maximum length %u exceeded by --selctx"
+ " parameter (%zu)",
+ SECMARK_SELCTX_MAX-1, strlen(optarg));
+
+ strcpy(info->u.sel.selctx, optarg);
+ *flags |= SECMARK_MODE_SEL;
+ break;
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+static void final_check(unsigned int flags)
+{
+ if (!flags)
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
+}
+
+static void print_secmark(struct xt_secmark_target_info *info)
+{
+ switch (info->mode) {
+ case SECMARK_MODE_SEL:
+ printf("selctx %s ", info->u.sel.selctx);\
+ break;
+
+ default:
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
+ }
+}
+
+static void print(const struct ip6t_ip6 *ip,
+ const struct ip6t_entry_target *target, int numeric)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)(target)->data;
+
+ printf("SECMARK ");
+ print_secmark(info);
+}
+
+/* Saves the target info in parsable form to stdout. */
+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)target->data;
+
+ printf("--");
+ print_secmark(info);
+}
+
+static struct ip6tables_target secmark = {
+ .name = "SECMARK",
+ .version = IPTABLES_VERSION,
+ .size = IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
+ .userspacesize = IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
+ .help = &help,
+ .init = &init,
+ .parse = &parse,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+void _init(void)
+{
+ register_target6(&secmark);
+}
diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man iptables-1.3.5/extensions/libip6t_SECMARK.man
--- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libip6t_SECMARK.man 2006-09-07 15:09:32.000000000 +0200
@@ -0,0 +1,7 @@
+This is used to set the security mark value associated with the
+packet for use by security subsystems such as SELinux. It is only
+valid in the
+.B mangle
+table.
+.TP
+.BI "--selctx " "security_context"
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c iptables-1.3.5/extensions/libipt_CONNSECMARK.c
--- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.c 2006-09-07 15:09:36.000000000 +0200
@@ -0,0 +1,126 @@
+/*
+ * Shared library add-on to iptables to add CONNSECMARK target support.
+ *
+ * Based on the MARK and CONNMARK targets.
+ *
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris at redhat.com>
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <iptables.h>
+#include <linux/netfilter/xt_CONNSECMARK.h>
+
+#define PFX "CONNSECMARK target: "
+
+static void help(void)
+{
+ printf(
+"CONNSECMARK target v%s options:\n"
+" --save Copy security mark from packet to conntrack\n"
+" --restore Copy security mark from connection to packet\n"
+"\n",
+IPTABLES_VERSION);
+}
+
+static struct option opts[] = {
+ { "save", 0, 0, '1' },
+ { "restore", 0, 0, '2' },
+ { 0 }
+};
+
+static int parse(int c, char **argv, int invert, unsigned int *flags,
+ const struct ipt_entry *entry, struct ipt_entry_target **target)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)(*target)->data;
+
+ switch (c) {
+ case '1':
+ if (*flags & CONNSECMARK_SAVE)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --save twice");
+ info->mode = CONNSECMARK_SAVE;
+ *flags |= CONNSECMARK_SAVE;
+ break;
+
+ case '2':
+ if (*flags & CONNSECMARK_RESTORE)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --restore twice");
+ info->mode = CONNSECMARK_RESTORE;
+ *flags |= CONNSECMARK_RESTORE;
+ break;
+
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+static void final_check(unsigned int flags)
+{
+ if (!flags)
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
+
+ if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
+ exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
+ "or --restore is allowed");
+}
+
+static void print_connsecmark(struct xt_connsecmark_target_info *info)
+{
+ switch (info->mode) {
+ case CONNSECMARK_SAVE:
+ printf("save ");
+ break;
+
+ case CONNSECMARK_RESTORE:
+ printf("restore ");
+ break;
+
+ default:
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
+ }
+}
+
+static void print(const struct ipt_ip *ip,
+ const struct ipt_entry_target *target, int numeric)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)(target)->data;
+
+ printf("CONNSECMARK ");
+ print_connsecmark(info);
+}
+
+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
+{
+ struct xt_connsecmark_target_info *info =
+ (struct xt_connsecmark_target_info*)target->data;
+
+ printf("--");
+ print_connsecmark(info);
+}
+
+static struct iptables_target connsecmark = {
+ .next = NULL,
+ .name = "CONNSECMARK",
+ .version = IPTABLES_VERSION,
+ .revision = 0,
+ .size = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
+ .userspacesize = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
+ .parse = &parse,
+ .help = &help,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+void _init(void)
+{
+ register_target(&connsecmark);
+}
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man iptables-1.3.5/extensions/libipt_CONNSECMARK.man
--- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.man 2006-09-07 15:09:36.000000000 +0200
@@ -0,0 +1,15 @@
+This module copies security markings from packets to connections
+(if unlabeled), and from connections back to packets (also only
+if unlabeled). Typically used in conjunction with SECMARK, it is
+only valid in the
+.B mangle
+table.
+.TP
+.B --save
+If the packet has a security marking, copy it to the connection
+if the connection is not marked.
+.TP
+.B --restore
+If the packet does not have a security marking, and the connection
+does, copy the security marking from the connection to the packet.
+
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c iptables-1.3.5/extensions/libipt_SECMARK.c
--- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libipt_SECMARK.c 2006-09-07 15:09:24.000000000 +0200
@@ -0,0 +1,125 @@
+/*
+ * Shared library add-on to iptables to add SECMARK target support.
+ *
+ * Based on the MARK target.
+ *
+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris at redhat.com>
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <iptables.h>
+#include <linux/netfilter/xt_SECMARK.h>
+
+#define PFX "SECMARK target: "
+
+static void help(void)
+{
+ printf(
+"SECMARK target v%s options:\n"
+" --selctx value Set the SELinux security context\n"
+"\n",
+IPTABLES_VERSION);
+}
+
+static struct option opts[] = {
+ { "selctx", 1, 0, '1' },
+ { 0 }
+};
+
+/* Initialize the target. */
+static void init(struct ipt_entry_target *t, unsigned int *nfcache)
+{ }
+
+/*
+ * Function which parses command options; returns true if it
+ * ate an option.
+ */
+static int parse(int c, char **argv, int invert, unsigned int *flags,
+ const struct ipt_entry *entry, struct ipt_entry_target **target)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)(*target)->data;
+
+ switch (c) {
+ case '1':
+ if (*flags & SECMARK_MODE_SEL)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Can't specify --selctx twice");
+ info->mode = SECMARK_MODE_SEL;
+
+ if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
+ exit_error(PARAMETER_PROBLEM, PFX
+ "Maximum length %u exceeded by --selctx"
+ " parameter (%zu)",
+ SECMARK_SELCTX_MAX-1, strlen(optarg));
+
+ strcpy(info->u.sel.selctx, optarg);
+ *flags |= SECMARK_MODE_SEL;
+ break;
+ default:
+ return 0;
+ }
+
+ return 1;
+}
+
+static void final_check(unsigned int flags)
+{
+ if (!flags)
+ exit_error(PARAMETER_PROBLEM, PFX "parameter required");
+}
+
+static void print_secmark(struct xt_secmark_target_info *info)
+{
+ switch (info->mode) {
+ case SECMARK_MODE_SEL:
+ printf("selctx %s ", info->u.sel.selctx);\
+ break;
+
+ default:
+ exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
+ }
+}
+
+static void print(const struct ipt_ip *ip,
+ const struct ipt_entry_target *target, int numeric)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)(target)->data;
+
+ printf("SECMARK ");
+ print_secmark(info);
+}
+
+/* Saves the target info in parsable form to stdout. */
+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
+{
+ struct xt_secmark_target_info *info =
+ (struct xt_secmark_target_info*)target->data;
+
+ printf("--");
+ print_secmark(info);
+}
+
+static struct iptables_target secmark = {
+ .next = NULL,
+ .name = "SECMARK",
+ .version = IPTABLES_VERSION,
+ .revision = 0,
+ .size = IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
+ .userspacesize = IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
+ .help = &help,
+ .init = &init,
+ .parse = &parse,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+void _init(void)
+{
+ register_target(&secmark);
+}
diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man iptables-1.3.5/extensions/libipt_SECMARK.man
--- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man 1970-01-01 01:00:00.000000000 +0100
+++ iptables-1.3.5/extensions/libipt_SECMARK.man 2006-09-07 15:09:24.000000000 +0200
@@ -0,0 +1,7 @@
+This is used to set the security mark value associated with the
+packet for use by security subsystems such as SELinux. It is only
+valid in the
+.B mangle
+table.
+.TP
+.BI "--selctx " "security_context"
diff -urN iptables-1.3.5.no_secmark/extensions/Makefile iptables-1.3.5/extensions/Makefile
--- iptables-1.3.5.no_secmark/extensions/Makefile 2006-09-07 14:48:35.000000000 +0200
+++ iptables-1.3.5/extensions/Makefile 2006-09-07 15:09:40.000000000 +0200
@@ -8,6 +8,11 @@
PF_EXT_SLIB:=ah addrtype comment connlimit connmark conntrack dscp ecn esp hashlimit helper icmp iprange length limit mac mark multiport owner physdev pkttype policy realm rpc sctp standard state tcp tcpmss tos ttl udp unclean CLASSIFY CONNMARK DNAT DSCP ECN LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TRACE TTL ULOG
PF6_EXT_SLIB:=connmark eui64 hl icmpv6 length limit mac mark multiport owner physdev policy standard state tcp udp CONNMARK HL LOG NFQUEUE MARK TRACE
+ifeq ($(DO_SELINUX), 1)
+PF_EXT_SE_SLIB:=SECMARK CONNSECMARK
+PF6_EXT_SE_SLIB:=SECMARK CONNSECMARK
+endif
+
# Optionals
PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
@@ -43,26 +48,34 @@
ifndef NO_SHARED_LIBS
SHARED_LIBS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).so)
+SHARED_SE_LIBS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).so)
EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
+EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
ifeq ($(DO_IPV6), 1)
SHARED_LIBS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).so)
+SHARED_SE_LIBS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).so)
EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
+EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
endif
else # NO_SHARED_LIBS
EXT_OBJS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).o)
+EXT_OBJS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).o)
EXT_FUNC+=$(foreach T,$(PF_EXT_SLIB),ipt_$(T))
+EXT_FUNC+=$(foreach T,$(PF_EXT_SE_SLIB),ipt_$(T))
EXT_OBJS+= extensions/initext.o
ifeq ($(DO_IPV6), 1)
EXT6_OBJS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).o)
+EXT6_OBJS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).o)
EXT6_FUNC+=$(foreach T,$(PF6_EXT_SLIB),ip6t_$(T))
+EXT6_FUNC+=$(foreach T,$(PF6_EXT_SE_SLIB),ip6t_$(T))
EXT6_OBJS+= extensions/initext6.o
endif # DO_IPV6
endif # NO_SHARED_LIBS
ifndef TOPLEVEL_INCLUDED
local:
- cd .. && $(MAKE) $(SHARED_LIBS)
+ cd .. && $(MAKE) $(SHARED_LIBS) $(SHARED_SE_LIBS)
endif
ifdef NO_SHARED_LIBS
diff -urN iptables-1.3.5.no_secmark/Makefile iptables-1.3.5/Makefile
--- iptables-1.3.5.no_secmark/Makefile 2006-09-07 14:48:34.000000000 +0200
+++ iptables-1.3.5/Makefile 2006-09-07 15:08:41.000000000 +0200
@@ -31,6 +31,11 @@
DO_IPV6:=1
endif
+# Enable linking to libselinux via enviornment 'DO_SELINUX=1'
+ifndef DO_SELINUX
+DO_SELINUX=0
+endif
+
COPT_FLAGS:=-O2
CFLAGS:=$(COPT_FLAGS) -Wall -Wunused -I$(KERNEL_DIR)/include -Iinclude/ -DIPTABLES_VERSION=\"$(IPTABLES_VERSION)\" #-g -DDEBUG #-pg # -DIPTC_DEBUG
@@ -93,17 +98,24 @@
ifndef NO_SHARED_LIBS
DEPFILES = $(SHARED_LIBS:%.so=%.d)
+DEPFILES += $(SHARED_SE_LIBS:%.so=%.d)
SH_CFLAGS:=$(CFLAGS) -fPIC
STATIC_LIBS =
STATIC6_LIBS =
LDFLAGS = -rdynamic
LDLIBS = -ldl
+ifeq ($(DO_SELINUX), 1)
+LDLIBS += -lselinux
+endif
else
DEPFILES = $(EXT_OBJS:%.o=%.d)
STATIC_LIBS = extensions/libext.a
STATIC6_LIBS = extensions/libext6.a
LDFLAGS = -static
LDLIBS =
+ifeq ($(DO_SELINUX), 1)
+LDLIBS += -lselinux
+endif
endif
.PHONY: default
diff -urN iptables-1.3.5.no_secmark/Rules.make iptables-1.3.5/Rules.make
--- iptables-1.3.5.no_secmark/Rules.make 2006-09-07 14:48:36.000000000 +0200
+++ iptables-1.3.5/Rules.make 2006-09-07 15:08:04.000000000 +0200
@@ -1,12 +1,12 @@
#! /usr/bin/make
-all: $(SHARED_LIBS) $(EXTRAS)
+all: $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS)
experimental: $(EXTRAS_EXP)
# Have to handle extensions which no longer exist.
clean: $(EXTRA_CLEANS)
- rm -f $(SHARED_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o)
+ rm -f $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o) $(SHARED_SE_LIBS:%.so=%_sh.o)
rm -f extensions/initext.c extensions/initext6.c
@find . -name '*.[ao]' -o -name '*.so' | xargs rm -f
@@ -33,6 +33,13 @@
$(SHARED_LIBS): %.so : %_sh.o
$(CC) -shared $(EXT_LDFLAGS) -o $@ $<
+$(SHARED_SE_LIBS:%.so=%.d): %.d: %.c
+ @-$(CC) -M -MG $(CFLAGS) $< | \
+ sed -e 's@^.*\.o:@$*.d $*_sh.o:@' > $@
+
+$(SHARED_SE_LIBS): %.so : %_sh.o
+ $(LD) -shared $(EXT_LDFLAGS) -o $@ $< $(LDLIBS)
+
%_sh.o : %.c
$(CC) $(SH_CFLAGS) -o $@ -c $<
Index: iptables.spec
===================================================================
RCS file: /cvs/dist/rpms/iptables/devel/iptables.spec,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -r1.42 -r1.43
--- iptables.spec 12 Jul 2006 06:25:39 -0000 1.42
+++ iptables.spec 19 Sep 2006 15:36:43 -0000 1.43
@@ -3,7 +3,7 @@
Name: iptables
Summary: Tools for managing Linux kernel packet filtering capabilities.
Version: 1.3.5
-Release: 1.2.1
+Release: 2
Source: http://www.netfilter.org/%{name}-%{version}.tar.bz2
Source1: iptables.init
Source2: iptables-config
@@ -14,11 +14,13 @@
Patch8: iptables-1.3.0-cleanup.patch
Patch9: iptables-1.3.0-autoload.patch
Patch10: iptables-1.3.0-no_root.patch
+Patch11: iptables-1.3.5-secmark.patch
Group: System Environment/Base
URL: http://www.netfilter.org/
BuildRoot: %{_tmppath}/%{name}-buildroot
License: GPL
-BuildPrereq: /usr/bin/perl
+BuildRequires: /usr/bin/perl
+BuildRequires: libselinux-devel
Conflicts: kernel < 2.4.20
Requires(post,postun): chkconfig
Prefix: %{_prefix}
@@ -67,6 +69,7 @@
%patch8 -p1 -b .cleanup
%patch9 -p1 -b .autoload
%patch10 -p1 -b .no_root
+%patch11 -p1 -b .secmark
# Put it to a reasonable place
find . -type f -exec perl -pi -e "s,/usr/local,%{prefix},g" {} \;
@@ -79,6 +82,7 @@
%build
TOPDIR=`pwd`
OPT="$RPM_OPT_FLAGS -I$TOPDIR/include -fPIC"
+export DO_SELINUX=1
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib}
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} iptables-save iptables-restore
make COPT_FLAGS="$OPT" KERNEL_DIR=/usr LIBDIR=/%{_lib} ip6tables-save ip6tables-restore
@@ -151,6 +155,9 @@
%endif
%changelog
+* Thu Sep 19 2006 Thomas Woerner <twoerner at redhat.com> 1.3.5-2
+- added secmark iptables patches (#201573)
+
* Wed Jul 12 2006 Jesse Keating <jkeating at redhat.com> - 1.3.5-1.2.1
- rebuild
More information about the fedora-cvs-commits
mailing list