Merge pull request #17094 from stintel/miniupnpd

miniupnpd: drop igdv1 variant, add nftables support

net/miniupnpd/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=miniupnpd
 PKG_VERSION:=2.2.3
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=https://miniupnp.tuxfamily.org/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
@@ -30,38 +30,42 @@ define Package/miniupnpd/Default
   SECTION:=net
   CATEGORY:=Network
   DEPENDS:= \
-	+IPV6:ip6tables \
-	+IPV6:libip6tc \
-	+iptables \
 	+libcap-ng \
-	+libip4tc \
 	+libmnl \
-	+libnetfilter-conntrack \
 	+libuuid
+  PROVIDES:=miniupnpd
   TITLE:=Lightweight UPnP IGD, NAT-PMP & PCP daemon
   SUBMENU:=Firewall
   URL:=https://miniupnp.tuxfamily.org/
 endef
 
-define Package/miniupnpd
+define Package/miniupnpd-iptables
   $(call Package/miniupnpd/Default)
-  TITLE+= (IGDv2)
-  CONFLICTS:=miniupnpd-igdv1
-  VARIANT:=igdv2
+  CONFLICTS:=miniupnpd-nftables
+  DEPENDS+= \
+	+IPV6:ip6tables \
+	+IPV6:libip6tc \
+	+iptables \
+	+libip4tc \
+	+libnetfilter-conntrack
+  TITLE+= (iptables)
+  VARIANT:=iptables
 endef
 
-define Package/miniupnpd-igdv1
+define Package/miniupnpd-nftables
   $(call Package/miniupnpd/Default)
-  TITLE+= (IGDv1)
-  PROVIDES:=miniupnpd
-  VARIANT:=igdv1
+  DEPENDS+= \
+	+libnftnl
+  TITLE+= (nftables)
+  VARIANT:=nftables
 endef
 
-define Package/miniupnpd/conffiles
+define Package/miniupnpd/conffiles/Default
 /etc/config/upnpd
 endef
 
-Package/miniupnpd-igdv1/conffiles = $(Package/miniupnpd/conffiles)
+Package/miniupnpd-iptables/conffiles = $(Package/miniupnpd/conffiles/Default)
+Package/miniupnpd-nftables/conffiles = $(Package/miniupnpd/conffiles/Default)
 
 define Build/Prepare
 	$(call Build/Prepare/Default)
@@ -70,35 +74,41 @@ endef
 
 CONFIGURE_ARGS = \
 	$(if $(CONFIG_IPV6),--ipv6) \
+	--igd2 \
 	--leasefile \
 	--portinuse \
-	--firewall=iptables \
+	--firewall=$(BUILD_VARIANT) \
 	--disable-fork
 
-ifeq ($(BUILD_VARIANT),igdv2)
-	CONFIGURE_ARGS += --igd2
-endif
-
-TARGET_CFLAGS += $(FPIC) -flto
+TARGET_CFLAGS += $(FPIC)
 TARGET_LDFLAGS += -Wl,--gc-sections,--as-needed
 
-define Package/miniupnpd/install
+ifeq ($(BUILD_VARIANT),iptables)
+	TARGET_CFLAGS += -flto
+endif
+
+define Package/miniupnpd/install/Default
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
-
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/miniupnpd $(1)/usr/sbin/miniupnpd
 	$(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd
 	$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
 	$(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
-	$(INSTALL_BIN) ./files/miniupnpd.defaults $(1)/etc/uci-defaults/99-miniupnpd
-	$(INSTALL_DATA) ./files/firewall.include $(1)/usr/share/miniupnpd/firewall.include
 endef
 
-Package/miniupnpd-igdv1/install = $(Package/miniupnpd/install)
+define Package/miniupnpd-iptables/install
+	$(call Package/miniupnpd/install/Default,$1)
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
+	$(INSTALL_BIN) ./files/miniupnpd.defaults.iptables $(1)/etc/uci-defaults/99-miniupnpd
+	$(INSTALL_DATA) ./files/firewall3.include $(1)/usr/share/miniupnpd/firewall.include
+endef
+
+define Package/miniupnpd-nftables/install
+	$(call Package/miniupnpd/install/Default,$1)
+endef
 
-$(eval $(call BuildPackage,miniupnpd))
-$(eval $(call BuildPackage,miniupnpd-igdv1))
+$(eval $(call BuildPackage,miniupnpd-iptables))
+$(eval $(call BuildPackage,miniupnpd-nftables))

net/miniupnpd/patches/100-miniupnpd-configure-don-t-hardcode-iptables.patch

@@ -0,0 +1,25 @@
+From 51a422407b22f0cb7188ea4bfb3867b2bbfcfe68 Mon Sep 17 00:00:00 2001
+From: Stijn Tintel <stijn@linux-ipv6.be>
+Date: Sun, 7 Nov 2021 20:24:29 +0200
+Subject: [PATCH] miniupnpd/configure: don't hardcode iptables
+
+The OpenWrt Makefile that builds miniupnpd passes the firewall argument
+to the configure script, so this is not needed and it is blocking us
+from using nftables instead, which will be the default backend for
+firewall4 to be used in the next OpenWrt stable release.
+
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ configure | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/configure
++++ b/configure
+@@ -387,7 +387,6 @@ case $OS_NAME in
+ 	OpenWRT)
+ 		OS_URL=http://www.openwrt.org/
+ 		echo "#define USE_IFACEWATCHER 1" >> ${CONFIGFILE}
+-		FW=iptables
+ 		;;
+ 	OpenEmbedded)
+ 		OS_URL=http://www.openembedded.org/