$(eval $(if $(NF_KMOD),$(call nf_add,IPT_CORE,CONFIG_IP_NF_MANGLE, $(P_V4)iptable_mangle),))
# userland only
-$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_set xt_SET)))
+$(eval $(if $(NF_KMOD),,$(call nf_add,IPT_CORE,CONFIG_IP_NF_IPTABLES, xt_standard ipt_icmp xt_tcp xt_udp xt_comment xt_id xt_set xt_SET)))
$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_LIMIT, $(P_XT)xt_limit))
$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MAC, $(P_XT)xt_mac))
$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_MULTIPORT, $(P_XT)xt_multiport))
$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_COMMENT, $(P_XT)xt_comment))
+$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_MATCH_ID, $(P_XT)xt_id))
$(eval $(call nf_add,IPT_CORE,CONFIG_NETFILTER_XT_TARGET_LOG, $(P_XT)xt_LOG, ge 3.4.0))
$(eval $(call nf_add,IPT_CORE,CONFIG_IP_NF_TARGET_LOG, $(P_V4)ipt_LOG, lt 3.4.0))
--- /dev/null
+--- /dev/null
++++ b/extensions/libxt_id.c
+@@ -0,0 +1,45 @@
++/* Shared library add-on to iptables to add id match support. */
++
++#include <stdio.h>
++#include <xtables.h>
++#include <linux/netfilter/xt_id.h>
++
++enum {
++ O_ID = 0,
++};
++
++static const struct xt_option_entry id_opts[] = {
++ {
++ .name = "id",
++ .id = O_ID,
++ .type = XTTYPE_UINT32,
++ .flags = XTOPT_MAND | XTOPT_PUT,
++ XTOPT_POINTER(struct xt_id_info, id)
++ },
++ XTOPT_TABLEEND,
++};
++
++/* Saves the union ipt_matchinfo in parsable form to stdout. */
++static void
++id_save(const void *ip, const struct xt_entry_match *match)
++{
++ struct xt_id_info *idinfo = (void *)match->data;
++
++ printf(" --id %lu", idinfo->id);
++}
++
++static struct xtables_match id_match = {
++ .family = NFPROTO_UNSPEC,
++ .name = "id",
++ .version = XTABLES_VERSION,
++ .size = XT_ALIGN(sizeof(struct xt_id_info)),
++ .userspacesize = XT_ALIGN(sizeof(struct xt_id_info)),
++ .save = id_save,
++ .x6_parse = xtables_option_parse,
++ .x6_options = id_opts,
++};
++
++void _init(void)
++{
++ xtables_register_match(&id_match);
++}
+--- /dev/null
++++ b/include/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ __u32 id;
++};
++
++#endif /* XT_ID_H */
--- /dev/null
+--- a/include/uapi/linux/netfilter/Kbuild
++++ b/include/uapi/linux/netfilter/Kbuild
+@@ -51,6 +51,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+ header-y += xt_layer7.h
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -989,6 +989,13 @@ config NETFILTER_XT_MATCH_HL
+ in the IPv6 header, or the time-to-live field in the IPv4
+ header of the packet.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -115,6 +115,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
--- /dev/null
+--- a/include/uapi/linux/netfilter/Kbuild
++++ b/include/uapi/linux/netfilter/Kbuild
+@@ -54,6 +54,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+ header-y += xt_layer7.h
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1033,6 +1033,13 @@ config NETFILTER_XT_MATCH_HL
+ in the IPv6 header, or the time-to-live field in the IPv4
+ header of the packet.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -133,6 +133,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
--- /dev/null
+--- a/include/uapi/linux/netfilter/Kbuild
++++ b/include/uapi/linux/netfilter/Kbuild
+@@ -55,6 +55,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_ipcomp.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1121,6 +1121,13 @@ config NETFILTER_XT_MATCH_IPCOMP
+
+ To compile it as a module, choose M here. If unsure, say N.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -136,6 +136,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPCOMP) += xt_ipcomp.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
--- /dev/null
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -837,6 +837,13 @@ config NETFILTER_XT_MATCH_HL
+ in the IPv6 header, or the time-to-live field in the IPv4
+ header of the packet.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -86,6 +86,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
+--- a/include/linux/netfilter/Kbuild
++++ b/include/linux/netfilter/Kbuild
+@@ -47,6 +47,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+ header-y += xt_layer7.h
+--- /dev/null
++++ b/include/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
--- /dev/null
+--- a/include/uapi/linux/netfilter/Kbuild
++++ b/include/uapi/linux/netfilter/Kbuild
+@@ -49,6 +49,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+ header-y += xt_layer7.h
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -967,6 +967,13 @@ config NETFILTER_XT_MATCH_HL
+ in the IPv6 header, or the time-to-live field in the IPv4
+ header of the packet.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -112,6 +112,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
--- /dev/null
+--- a/include/uapi/linux/netfilter/Kbuild
++++ b/include/uapi/linux/netfilter/Kbuild
+@@ -51,6 +51,7 @@ header-y += xt_ecn.h
+ header-y += xt_esp.h
+ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
++header-y += xt_id.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
+ header-y += xt_layer7.h
+--- /dev/null
++++ b/include/uapi/linux/netfilter/xt_id.h
+@@ -0,0 +1,8 @@
++#ifndef _XT_ID_H
++#define _XT_ID_H
++
++struct xt_id_info {
++ u32 id;
++};
++
++#endif /* XT_ID_H */
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -989,6 +989,13 @@ config NETFILTER_XT_MATCH_HL
+ in the IPv6 header, or the time-to-live field in the IPv4
+ header of the packet.
+
++config NETFILTER_XT_MATCH_ID
++ tristate '"id" match support'
++ depends on NETFILTER_ADVANCED
++ ---help---
++ This option adds a `id' dummy-match, which allows you to put
++ numeric IDs into your iptables ruleset.
++
+ config NETFILTER_XT_MATCH_IPRANGE
+ tristate '"iprange" address range match support'
+ depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -115,6 +115,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) +=
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_ID) += xt_id.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
+--- /dev/null
++++ b/net/netfilter/xt_id.c
+@@ -0,0 +1,45 @@
++/*
++ * Implements a dummy match to allow attaching IDs to rules
++ *
++ * 2014-08-01 Jo-Philipp Wich <jow@openwrt.org>
++ */
++
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_id.h>
++
++MODULE_AUTHOR("Jo-Philipp Wich <jow@openwrt.org>");
++MODULE_DESCRIPTION("Xtables: No-op match which can be tagged with a 32bit ID");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("ipt_id");
++MODULE_ALIAS("ip6t_id");
++
++static bool
++id_mt(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ /* We always match */
++ return true;
++}
++
++static struct xt_match id_mt_reg __read_mostly = {
++ .name = "id",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .match = id_mt,
++ .matchsize = sizeof(struct xt_id_info),
++ .me = THIS_MODULE,
++};
++
++static int __init id_mt_init(void)
++{
++ return xt_register_match(&id_mt_reg);
++}
++
++static void __exit id_mt_exit(void)
++{
++ xt_unregister_match(&id_mt_reg);
++}
++
++module_init(id_mt_init);
++module_exit(id_mt_exit);
projects / openwrt.git / commitdiff