feat: init small iproute2

2025-01-27 14:40:44 +01:00 · 2025-01-27 14:40:44 +01:00 · 5dc4aab275
commit 5dc4aab275
parent 1322de1ee0
22 changed files with 699 additions and 0 deletions
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@ -66,6 +66,7 @@ in {
  go-l2tp = callPackage ./go-l2tp {};
  hi = callPackage ./hi {};
  ifwait = callPackage ./ifwait {};
+  iproute2-small = callPackage ./iproute2-small {};
  initramfs-peek = callPackage ./initramfs-peek {};
  kernel-backport = callPackage ./kernel-backport {};
  kmodloader = callPackage ./kmodloader {};
--- a/pkgs/iproute2-small/default.nix
+++ b/pkgs/iproute2-small/default.nix
@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  buildPackages,
+  bison,
+  flex,
+  pkg-config,
+  elfutils,
+  libmnl,
+  libbpf,
+  gitUpdater,
+  pkgsStatic,
+breakpointHook,
+
+}:
+
+stdenv.mkDerivation rec {
+  pname = "iproute2";
+  version = "6.11.0";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-H3lTmKBK6qzQao9qziz9kTwz+llTypnaroO7XFNGEcM=";
+  };
+
+  patches = [
+    ./patches/010-bridge-mst-fix-a-musl-build-issue.patch
+    ./patches/011-bridge-mst-fix-a-further-musl-build-issue.patch
+    ./patches/012-libnetlink-fix-build-with-musl-and-gcc-14.patch
+    ./patches/110-darwin_fixes.patch
+    ./patches/115-add-config-xtlibdir.patch
+    ./patches/120-no_arpd_ifstat_rtacct_lnstat.patch
+    ./patches/130-no_netem_tipc_dcb_man_vdpa.patch
+    ./patches/140-allow_pfifo_fast.patch
+    ./patches/140-keep_libmnl_optional.patch
+    ./patches/145-keep_libelf_optional.patch
+    ./patches/150-keep_libcap_optional.patch
+    ./patches/155-keep_tirpc_optional.patch
+    ./patches/160-libnetlink-pic.patch
+    ./patches/170-ip_tiny.patch
+    ./patches/180-drop_FAILED_POLICY.patch
+    ./patches/190-fix-nls-rpath-link.patch
+    ./patches/195-build_variant_ip_tc.patch
+    ./patches/200-drop_libbsd_dependency.patch
+    ./patches/300-selinux-configurable.patch
+    ./patches/400-rdma-include-libgen.h-for-basename.patch
+    (fetchurl {
+      name = "musl-endian.patch";
+      url = "https://lore.kernel.org/netdev/20240712191209.31324-1-contact@hacktivis.me/raw";
+      hash = "sha256-MX+P+PSEh6XlhoWgzZEBlOV9aXhJNd20Gi0fJCcSZ5E=";
+    })
+    (fetchurl {
+      name = "musl-msghdr.patch";
+      url = "https://lore.kernel.org/netdev/20240712191209.31324-2-contact@hacktivis.me/raw";
+      hash = "sha256-X5BYSZBxcvdjtX1069a1GfcpdoVd0loSAe4xTpbCipA=";
+    })
+    (fetchurl {
+      name = "musl-basename.patch";
+      url = "https://lore.kernel.org/netdev/20240804161054.942439-1-dilfridge@gentoo.org/raw";
+      hash = "sha256-47obv6mIn/HO47lt47slpTAFDxiQ3U/voHKzIiIGCTM=";
+    })
+    # Duplicate
+    # (fetchpatch {
+    #   name = "musl-mst.patch";
+    #   url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/patch/?id=6a77abab92516e65f07f8657fc4e384c4541ce0e";
+    #   hash = "sha256-19FzTDvgnmqVFBykVgXl4VIsHs8Cy9NWGOLpxifxVlI=";
+    # })
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "CC := gcc" "CC ?= $CC"
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  configureFlags = [
+    "--color"
+    "auto"
+  ];
+
+  makeFlags =
+    [
+      "PREFIX=$(out)"
+      "SBINDIR=$(out)/sbin"
+      "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
+      "HDRDIR=$(dev)/include/iproute2"
+
+      ### openwrt
+
+      "BUILD_VARIANT=ip-full"
+      "LIBBPF_FORCE=on"
+      "HAVE_LIBBPF=y"
+      "HAVE_ELF=y"
+      "HAVE_MNL=y"
+      "HAVE_CAP=n"
+      "HAVE_TIRPC=n"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isStatic [
+      "SHARED_LIBS=n"
+    ]
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+      "HOSTCC=$(CC_FOR_BUILD)"
+    ];
+
+  buildFlags = [
+    "CONFDIR=/etc/iproute2"
+  ];
+
+  installFlags = [
+    "CONFDIR=$(out)/etc/iproute2"
+  ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
+  nativeBuildInputs = [
+breakpointHook
+    bison
+    flex
+    pkg-config
+  ];
+  buildInputs =
+    [
+      libmnl
+      libbpf
+    ]
+    # needed to uploaded bpf programs
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
+      elfutils
+      libbpf
+    ];
+
+  enableParallelBuilding = true;
+
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git";
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    homepage = "https://wiki.linuxfoundation.org/networking/iproute2";
+    description = "Collection of utilities for controlling TCP/IP networking and traffic control in Linux";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+  };
+}
--- a/pkgs/iproute2-small/patches/010-bridge-mst-fix-a-musl-build-issue.patch
+++ b/pkgs/iproute2-small/patches/010-bridge-mst-fix-a-musl-build-issue.patch
@ -0,0 +1,68 @@
+From 6a77abab92516e65f07f8657fc4e384c4541ce0e Mon Sep 17 00:00:00 2001
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Date: Sun, 22 Sep 2024 16:50:10 +0200
+Subject: bridge: mst: fix a musl build issue
+
+This patch fixes a compilation error raised by the bump to version 6.11.0
+in Buildroot using musl as the C library for the cross-compilation
+toolchain.
+
+After setting the CFLGAS
+
+ifeq ($(BR2_TOOLCHAIN_USES_MUSL),y)
+IPROUTE2_CFLAGS += -D__UAPI_DEF_IN6_ADDR=0 -D__UAPI_DEF_SOCKADDR_IN6=0 \
+			-D__UAPI_DEF_IPV6_MREQ=0
+endif
+
+to fix the following errors:
+
+In file included from ../../../host/mips64-buildroot-linux-musl/sysroot/usr/include/arpa/inet.h:9,
+                 from ../include/libnetlink.h:14,
+                 from mst.c:10:
+../../../host/mips64-buildroot-linux-musl/sysroot/usr/include/netinet/in.h:23:8: error: redefinition of 'struct in6_addr'
+   23 | struct in6_addr {
+      |        ^~~~~~~~
+In file included from ../include/uapi/linux/if_bridge.h:19,
+                 from mst.c:7:
+../include/uapi/linux/in6.h:33:8: note: originally defined here
+   33 | struct in6_addr {
+      |        ^~~~~~~~
+../../../host/mips64-buildroot-linux-musl/sysroot/usr/include/netinet/in.h:34:8: error: redefinition of 'struct sockaddr_in6'
+   34 | struct sockaddr_in6 {
+      |        ^~~~~~~~~~~~
+../include/uapi/linux/in6.h:50:8: note: originally defined here
+   50 | struct sockaddr_in6 {
+      |        ^~~~~~~~~~~~
+../../../host/mips64-buildroot-linux-musl/sysroot/usr/include/netinet/in.h:42:8: error: redefinition of 'struct ipv6_mreq'
+   42 | struct ipv6_mreq {
+      |        ^~~~~~~~~
+../include/uapi/linux/in6.h:60:8: note: originally defined here
+   60 | struct ipv6_mreq {
+
+I got this further errors
+
+../include/uapi/linux/in6.h:72:25: error: field 'flr_dst' has incomplete type
+   72 |         struct in6_addr flr_dst;
+      |                         ^~~~~~~
+../include/uapi/linux/if_bridge.h:711:41: error: field 'ip6' has incomplete type
+  711 |                         struct in6_addr ip6;
+      |                                         ^~~
+
+fixed by including the netinet/in.h header.
+
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ bridge/mst.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/bridge/mst.c
+++ b/bridge/mst.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <stdio.h>
+#include <netinet/in.h>
+ #include <linux/if_bridge.h>
+ #include <net/if.h>
+ 
--- a/pkgs/iproute2-small/patches/011-bridge-mst-fix-a-further-musl-build-issue.patch
+++ b/pkgs/iproute2-small/patches/011-bridge-mst-fix-a-further-musl-build-issue.patch
@ -0,0 +1,51 @@
+From 043ef90e2fa94397eb5c85330889ca4146a6d58a Mon Sep 17 00:00:00 2001
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Date: Sun, 22 Sep 2024 16:50:11 +0200
+Subject: bridge: mst: fix a further musl build issue
+
+This patch fixes the following build errors:
+
+In file included from mst.c:11:
+../include/json_print.h:80:30: warning: 'struct timeval' declared inside parameter list will not be visible outside of this definition or declaration
+   80 | _PRINT_FUNC(tv, const struct timeval *)
+      |                              ^~~~~~~
+../include/json_print.h:50:37: note: in definition of macro '_PRINT_FUNC'
+   50 |                                     type value);                        \
+      |                                     ^~~~
+../include/json_print.h:80:30: warning: 'struct timeval' declared inside parameter list will not be visible outside of this definition or declaration
+   80 | _PRINT_FUNC(tv, const struct timeval *)
+      |                              ^~~~~~~
+../include/json_print.h:55:45: note: in definition of macro '_PRINT_FUNC'
+   55 |                                             type value)                 \
+      |                                             ^~~~
+../include/json_print.h: In function 'print_tv':
+../include/json_print.h:58:48: error: passing argument 5 of 'print_color_tv' from incompatible pointer type [-Wincompatible-pointer-types]
+   58 |                                                value);                  \
+      |                                                ^~~~~
+      |                                                |
+      |                                                const struct timeval *
+../include/json_print.h:80:1: note: in expansion of macro '_PRINT_FUNC'
+   80 | _PRINT_FUNC(tv, const struct timeval *)
+      | ^~~~~~~~~~~
+../include/json_print.h:50:42: note: expected 'const struct timeval *' but argument is of type 'const struct timeval *'
+   50 |                                     type value);                        \
+      |                                          ^
+../include/json_print.h:80:1: note: in expansion of macro '_PRINT_FUNC'
+   80 | _PRINT_FUNC(tv, const struct timeval *)
+
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+---
+ bridge/mst.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/bridge/mst.c
+++ b/bridge/mst.c
+@@ -4,6 +4,7 @@
+  */
+ 
+ #include <stdio.h>
+#include <sys/time.h>
+ #include <netinet/in.h>
+ #include <linux/if_bridge.h>
+ #include <net/if.h>
--- a/pkgs/iproute2-small/patches/012-libnetlink-fix-build-with-musl-and-gcc-14.patch
+++ b/pkgs/iproute2-small/patches/012-libnetlink-fix-build-with-musl-and-gcc-14.patch
@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 8 Aug 2024 09:19:01 +0200
+Subject: libnetlink: fix build with musl and gcc 14
+
+Fixes compilation error with musl libc and gcc 14:
+
+../include/libnetlink.h: In function 'rta_getattr_be64':
+../include/libnetlink.h:280:16: error: implicit declaration of function 'htobe64' [-Wimplicit-function-declaration]
+  280 |         return htobe64(rta_getattr_u64(rta));
+      |                ^~~~~~~
+
+Reference: https://man7.org/linux/man-pages/man3/endian.3.html
+Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
+---
+ include/libnetlink.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/libnetlink.h
+++ b/include/libnetlink.h
+@@ -2,6 +2,7 @@
+ #ifndef __LIBNETLINK_H__
+ #define __LIBNETLINK_H__ 1
+ 
+#include <endian.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <asm/types.h>
--- a/pkgs/iproute2-small/patches/110-darwin_fixes.patch
+++ b/pkgs/iproute2-small/patches/110-darwin_fixes.patch
@ -0,0 +1,59 @@
+--- a/netem/maketable.c
+++ b/netem/maketable.c
+@@ -11,7 +11,9 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <math.h>
+#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <malloc.h>
+#endif
+ #include <string.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+--- a/netem/normal.c
+++ b/netem/normal.c
+@@ -9,8 +9,12 @@
+ #include <string.h>
+ #include <limits.h>
+ 
+#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
+#else
+#define NETEM_DIST_SCALE        8192
+#endif
+ 
+ #define TABLESIZE 16384
+ #define TABLEFACTOR NETEM_DIST_SCALE
+--- a/netem/pareto.c
+++ b/netem/pareto.c
+@@ -8,8 +8,12 @@
+ #include <math.h>
+ #include <limits.h>
+ 
+#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
+#else
+#define NETEM_DIST_SCALE        8192
+#endif
+ 
+ static const double a=3.0;
+ #define TABLESIZE	16384
+--- a/netem/paretonormal.c
+++ b/netem/paretonormal.c
+@@ -15,10 +15,13 @@
+ #include <string.h>
+ #include <math.h>
+ #include <limits.h>
+#if !defined(__APPLE__) && !defined(__FreeBSD__)
+ #include <malloc.h>
+-
+ #include <linux/types.h>
+ #include <linux/pkt_sched.h>
+#else
+#define NETEM_DIST_SCALE        8192
+#endif
+ 
+ #define TABLESIZE	16384
+ #define TABLEFACTOR	NETEM_DIST_SCALE
--- a/pkgs/iproute2-small/patches/115-add-config-xtlibdir.patch
+++ b/pkgs/iproute2-small/patches/115-add-config-xtlibdir.patch
@ -0,0 +1,12 @@
+--- a/tc/Makefile
+++ b/tc/Makefile
+@@ -107,6 +107,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
+ ifneq ($(IPT_LIB_DIR),)
+ 	CFLAGS += -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\"
+ endif
+ifneq ($(XT_LIB_DIR),)
+	CFLAGS += -DXT_LIB_DIR=\"$(XT_LIB_DIR)\"
+endif
+ 
+ LEX := flex
+ CFLAGS += -DYY_NO_INPUT
--- a/pkgs/iproute2-small/patches/120-no_arpd_ifstat_rtacct_lnstat.patch
+++ b/pkgs/iproute2-small/patches/120-no_arpd_ifstat_rtacct_lnstat.patch
@ -0,0 +1,20 @@
+--- a/misc/Makefile
+++ b/misc/Makefile
+@@ -2,13 +2,13 @@
+ SSOBJ=ss.o ssfilter_check.o ssfilter.tab.o
+ LNSTATOBJ=lnstat.o lnstat_util.o
+ 
+-TARGETS=ss nstat ifstat rtacct lnstat
+TARGETS=ss nstat
+ 
+ include ../config.mk
+ 
+-ifeq ($(HAVE_BERKELEY_DB),y)
+-	TARGETS += arpd
+-endif
+#ifeq ($(HAVE_BERKELEY_DB),y)
+#	TARGETS += arpd
+#endif
+ 
+ all: $(TARGETS)
+ 
--- a/pkgs/iproute2-small/patches/130-no_netem_tipc_dcb_man_vdpa.patch
+++ b/pkgs/iproute2-small/patches/130-no_netem_tipc_dcb_man_vdpa.patch
@ -0,0 +1,14 @@
+--- a/Makefile
+++ b/Makefile
+@@ -69,9 +69,9 @@ WFLAGS += -Wmissing-declarations -Wold-s
+ CFLAGS := $(WFLAGS) $(CCOPTS) -I../include -I../include/uapi $(DEFINES) $(CFLAGS)
+ YACCFLAGS = -d -t -v
+ 
+-SUBDIRS=lib ip tc bridge misc netem genl man
+SUBDIRS=lib ip tc bridge misc genl
+ ifeq ($(HAVE_MNL),y)
+-SUBDIRS += tipc devlink rdma dcb vdpa
+SUBDIRS += devlink rdma
+ endif
+ 
+ LIBNETLINK=../lib/libutil.a ../lib/libnetlink.a
--- a/pkgs/iproute2-small/patches/140-allow_pfifo_fast.patch
+++ b/pkgs/iproute2-small/patches/140-allow_pfifo_fast.patch
@ -0,0 +1,9 @@
+--- a/tc/q_fifo.c
+++ b/tc/q_fifo.c
+@@ -90,5 +90,6 @@ struct qdisc_util pfifo_head_drop_qdisc_
+ 
+ struct qdisc_util pfifo_fast_qdisc_util = {
+ 	.id = "pfifo_fast",
+	.parse_qopt = fifo_parse_opt,
+ 	.print_qopt = prio_print_opt,
+ };
--- a/pkgs/iproute2-small/patches/140-keep_libmnl_optional.patch
+++ b/pkgs/iproute2-small/patches/140-keep_libmnl_optional.patch
@ -0,0 +1,11 @@
+--- a/configure
+++ b/configure
+@@ -368,7 +368,7 @@ check_tirpc()
+ 
+ check_mnl()
+ {
+-	if ${PKG_CONFIG} libmnl --exists; then
+	if [ "${HAVE_MNL}" = "y" ] && ${PKG_CONFIG} libmnl --exists; then
+ 		echo "HAVE_MNL:=y" >>$CONFIG
+ 		echo "yes"
+ 
--- a/pkgs/iproute2-small/patches/145-keep_libelf_optional.patch
+++ b/pkgs/iproute2-small/patches/145-keep_libelf_optional.patch
@ -0,0 +1,11 @@
+--- a/configure
+++ b/configure
+@@ -217,7 +217,7 @@ EOF
+ 
+ check_elf()
+ {
+-    if ${PKG_CONFIG} libelf --exists; then
+    if [ "${HAVE_ELF}" = "y" ] && ${PKG_CONFIG} libelf --exists; then
+ 	echo "HAVE_ELF:=y" >>$CONFIG
+ 	echo "yes"
+ 
--- a/pkgs/iproute2-small/patches/150-keep_libcap_optional.patch
+++ b/pkgs/iproute2-small/patches/150-keep_libcap_optional.patch
@ -0,0 +1,11 @@
+--- a/configure
+++ b/configure
+@@ -427,7 +427,7 @@ EOF
+ 
+ check_cap()
+ {
+-	if ${PKG_CONFIG} libcap --exists; then
+	if [ "${HAVE_CAP}" = "y" ] && ${PKG_CONFIG} libcap --exists; then
+ 		echo "HAVE_CAP:=y" >>$CONFIG
+ 		echo "yes"
+ 
--- a/pkgs/iproute2-small/patches/155-keep_tirpc_optional.patch
+++ b/pkgs/iproute2-small/patches/155-keep_tirpc_optional.patch
@ -0,0 +1,11 @@
+--- a/configure
+++ b/configure
+@@ -355,7 +355,7 @@ check_selinux()
+ 
+ check_tirpc()
+ {
+-	if ${PKG_CONFIG} libtirpc --exists; then
+	if [ "${HAVE_TIRPC}" = "y" ] && ${PKG_CONFIG} libtirpc --exists; then
+ 		echo "HAVE_RPC:=y" >>$CONFIG
+ 		echo "yes"
+ 
--- a/pkgs/iproute2-small/patches/160-libnetlink-pic.patch
+++ b/pkgs/iproute2-small/patches/160-libnetlink-pic.patch
@ -0,0 +1,11 @@
+--- a/lib/Makefile
+++ b/lib/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
+ 
+-CFLAGS += -fPIC
+CFLAGS += $(FPIC)
+ 
+ UTILOBJ = utils.o utils_math.o rt_names.o ll_map.o ll_types.o ll_proto.o ll_addr.o \
+ 	inet_proto.o namespace.o json_writer.o json_print.o json_print_math.o \
--- a/pkgs/iproute2-small/patches/170-ip_tiny.patch
+++ b/pkgs/iproute2-small/patches/170-ip_tiny.patch
@ -0,0 +1,108 @@
+--- a/ip/Makefile
+++ b/ip/Makefile
+@@ -19,6 +19,13 @@ RTMONOBJ=rtmon.o
+ 
+ include ../config.mk
+ 
+STATIC_SYM_FILTER:=
+ifeq ($(IP_CONFIG_TINY),y)
+  STATIC_SYM_FILTER:=iplink_can.c iplink_ipoib.c iplink_vxlan.c
+  CFLAGS += -DIPROUTE2_TINY
+endif
+STATIC_SYM_SOURCES:=$(filter-out $(STATIC_SYM_FILTER),$(wildcard *.c))
+
+ ALLOBJ=$(IPOBJ) $(RTMONOBJ)
+ SCRIPTS=routel
+ TARGETS=ip rtmon
+@@ -48,7 +55,7 @@ else
+ 
+ ip: static-syms.o
+ static-syms.o: static-syms.h
+-static-syms.h: $(wildcard *.c)
+static-syms.h: $(STATIC_SYM_SOURCES)
+ 	files="$^" ; \
+ 	for s in `grep -B 3 '\<dlsym' $$files | sed -n '/snprintf/{s:.*"\([^"]*\)".*:\1:;s:%s::;p}'` ; do \
+ 		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:extern char \1[] __attribute__((weak)); if (!strcmp(sym, "\1")) return \1;:;p}' $$files ; \
+--- a/ip/ip.c
+++ b/ip/ip.c
+@@ -61,11 +61,17 @@ static void usage(void)
+ 	fprintf(stderr,
+ 		"Usage: ip [ OPTIONS ] OBJECT { COMMAND | help }\n"
+ 		"       ip [ -force ] -batch filename\n"
+#ifndef IPROUTE2_TINY
+ 		"where  OBJECT := { address | addrlabel | fou | help | ila | ioam | l2tp | link |\n"
+ 		"                   macsec | maddress | monitor | mptcp | mroute | mrule |\n"
+ 		"                   neighbor | neighbour | netconf | netns | nexthop | ntable |\n"
+ 		"                   ntbl | route | rule | sr | stats | tap | tcpmetrics |\n"
+ 		"                   token | tunnel | tuntap | vrf | xfrm }\n"
+#else
+		"where  OBJECT := { address | help | link | maddress | monitor |\n"
+		"                   neighbor | neighbour | netns | route |\n"
+		"                   rule | stats | token | tunnel }\n"
+#endif
+ 		"       OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
+ 		"                    -h[uman-readable] | -iec | -j[son] | -p[retty] |\n"
+ 		"                    -f[amily] { inet | inet6 | mpls | bridge | link } |\n"
+@@ -88,37 +94,49 @@ static const struct cmd {
+ 	int (*func)(int argc, char **argv);
+ } cmds[] = {
+ 	{ "address",	do_ipaddr },
+#ifndef IPROUTE2_TINY
+ 	{ "addrlabel",	do_ipaddrlabel },
+#endif
+ 	{ "maddress",	do_multiaddr },
+ 	{ "route",	do_iproute },
+ 	{ "rule",	do_iprule },
+ 	{ "neighbor",	do_ipneigh },
+ 	{ "neighbour",	do_ipneigh },
+#ifndef IPROUTE2_TINY
+ 	{ "ntable",	do_ipntable },
+ 	{ "ntbl",	do_ipntable },
+#endif
+ 	{ "link",	do_iplink },
+#ifndef IPROUTE2_TINY
+ 	{ "l2tp",	do_ipl2tp },
+ 	{ "fou",	do_ipfou },
+ 	{ "ila",	do_ipila },
+ 	{ "macsec",	do_ipmacsec },
+#endif
+ 	{ "tunnel",	do_iptunnel },
+ 	{ "tunl",	do_iptunnel },
+#ifndef IPROUTE2_TINY
+ 	{ "tuntap",	do_iptuntap },
+ 	{ "tap",	do_iptuntap },
+ 	{ "token",	do_iptoken },
+ 	{ "tcpmetrics",	do_tcp_metrics },
+ 	{ "tcp_metrics", do_tcp_metrics },
+#endif
+ 	{ "monitor",	do_ipmonitor },
+#ifndef IPROUTE2_TINY
+ 	{ "xfrm",	do_xfrm },
+ 	{ "mroute",	do_multiroute },
+ 	{ "mrule",	do_multirule },
+#endif
+ 	{ "netns",	do_netns },
+#ifndef IPROUTE2_TINY
+ 	{ "netconf",	do_ipnetconf },
+ 	{ "vrf",	do_ipvrf},
+ 	{ "sr",		do_seg6 },
+ 	{ "nexthop",	do_ipnh },
+ 	{ "mptcp",	do_mptcp },
+ 	{ "ioam",	do_ioam6 },
+#endif
+ 	{ "help",	do_help },
+ 	{ "stats",	do_ipstats },
+ 	{ 0 }
+--- a/lib/Makefile
+++ b/lib/Makefile
+@@ -3,6 +3,10 @@ include ../config.mk
+ 
+ CFLAGS += $(FPIC)
+ 
+ifeq ($(IP_CONFIG_TINY),y)
+  CFLAGS += -DIPROUTE2_TINY
+endif
+
+ UTILOBJ = utils.o utils_math.o rt_names.o ll_map.o ll_types.o ll_proto.o ll_addr.o \
+ 	inet_proto.o namespace.o json_writer.o json_print.o json_print_math.o \
+ 	names.o color.o bpf_legacy.o bpf_glue.o exec.o fs.o cg_map.o ppp_proto.o
--- a/pkgs/iproute2-small/patches/180-drop_FAILED_POLICY.patch
+++ b/pkgs/iproute2-small/patches/180-drop_FAILED_POLICY.patch
@ -0,0 +1,41 @@
+From 4e7dbf76227e8c7be7897dc81def3011f637864d Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Thu, 30 May 2013 11:54:04 +0200
+Subject: [PATCH] add support for dropping with FAILED_POLICY
+
+---
+ include/linux/fib_rules.h |    4 ++++
+ include/linux/rtnetlink.h |    1 +
+ ip/rtm_map.c              |    4 ++++
+ 3 files changed, 9 insertions(+)
+
+--- a/ip/rtm_map.c
+++ b/ip/rtm_map.c
+@@ -49,6 +49,8 @@ char *rtnl_rtntype_n2a(int id, char *buf
+ 		return "nat";
+ 	case RTN_XRESOLVE:
+ 		return "xresolve";
+	case RTN_FAILED_POLICY:
+		return "failed_policy";
+ 	default:
+ 		snprintf(buf, len, "%d", id);
+ 		return buf;
+@@ -84,6 +86,8 @@ int rtnl_rtntype_a2n(int *id, char *arg)
+ 		res = RTN_UNICAST;
+ 	else if (strcmp(arg, "throw") == 0)
+ 		res = RTN_THROW;
+	else if (strcmp(arg, "failed_policy") == 0)
+		res = RTN_FAILED_POLICY;
+ 	else {
+ 		res = strtoul(arg, &end, 0);
+ 		if (!end || end == arg || *end || res > 255)
+--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
+@@ -265,6 +265,7 @@ enum {
+ 	RTN_THROW,		/* Not in this table		*/
+ 	RTN_NAT,		/* Translate this address	*/
+ 	RTN_XRESOLVE,		/* Use external resolver	*/
+	RTN_FAILED_POLICY,      /* Source address failed policy */
+ 	__RTN_MAX
+ };
+ 
--- a/pkgs/iproute2-small/patches/190-fix-nls-rpath-link.patch
+++ b/pkgs/iproute2-small/patches/190-fix-nls-rpath-link.patch
@ -0,0 +1,20 @@
+--- a/configure
+++ b/configure
+@@ -241,7 +241,7 @@ int main(int argc, char **argv) {
+ }
+ EOF
+ 
+-    $CC -o $TMPDIR/libbpf_test $TMPDIR/libbpf_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS >/dev/null 2>&1
+    $CC -o $TMPDIR/libbpf_test $TMPDIR/libbpf_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS $LDFLAGS >/dev/null 2>&1
+     local ret=$?
+ 
+     rm -f $TMPDIR/libbpf_test.c $TMPDIR/libbpf_test
+@@ -259,7 +259,7 @@ int main(int argc, char **argv) {
+ }
+ EOF
+ 
+-    $CC -o $TMPDIR/libbpf_sec_test $TMPDIR/libbpf_sec_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS >/dev/null 2>&1
+    $CC -o $TMPDIR/libbpf_sec_test $TMPDIR/libbpf_sec_test.c $LIBBPF_CFLAGS $LIBBPF_LDLIBS $LDFLAGS >/dev/null 2>&1
+     local ret=$?
+ 
+     rm -f $TMPDIR/libbpf_sec_test.c $TMPDIR/libbpf_sec_test
--- a/pkgs/iproute2-small/patches/195-build_variant_ip_tc.patch
+++ b/pkgs/iproute2-small/patches/195-build_variant_ip_tc.patch
@ -0,0 +1,22 @@
+--- a/ip/Makefile
+++ b/ip/Makefile
+@@ -28,7 +28,7 @@ STATIC_SYM_SOURCES:=$(filter-out $(STATI
+ 
+ ALLOBJ=$(IPOBJ) $(RTMONOBJ)
+ SCRIPTS=routel
+-TARGETS=ip rtmon
+TARGETS=$(findstring ip,$(BUILD_VARIANT)) rtmon
+ 
+ all: $(TARGETS) $(SCRIPTS)
+ 
+--- a/tc/Makefile
+++ b/tc/Makefile
+@@ -120,7 +120,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
+ 	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic $< -o $@
+ 
+ 
+-all: tc $(TCSO)
+all: $(findstring tc,$(BUILD_VARIANT)) $(TCSO)
+ 
+ tc: $(TCOBJ) $(LIBNETLINK) libtc.a
+ 	$(QUIET_LINK)$(CC) $^ $(LDFLAGS) $(LDLIBS) -o $@
--- a/pkgs/iproute2-small/patches/200-drop_libbsd_dependency.patch
+++ b/pkgs/iproute2-small/patches/200-drop_libbsd_dependency.patch
@ -0,0 +1,19 @@
+--- a/configure
+++ b/configure
+@@ -413,14 +413,8 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
+ 	echo "no"
+     else
+-	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'CFLAGS += -DHAVE_LIBBSD' "$(${PKG_CONFIG} libbsd --cflags)" >>$CONFIG
+-		echo 'LDLIBS +=' "$(${PKG_CONFIG} libbsd --libs)" >> $CONFIG
+-		echo "no"
+-	else
+-		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+-		echo "yes"
+-	fi
+	echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+	echo "yes"
+     fi
+     rm -f $TMPDIR/strtest.c $TMPDIR/strtest
+ }
--- a/pkgs/iproute2-small/patches/300-selinux-configurable.patch
+++ b/pkgs/iproute2-small/patches/300-selinux-configurable.patch
@ -0,0 +1,11 @@
+--- a/configure
+++ b/configure
+@@ -342,7 +342,7 @@ check_libbpf()
+ check_selinux()
+ # SELinux is a compile time option in the ss utility
+ {
+-	if ${PKG_CONFIG} libselinux --exists; then
+	if [ "${HAVE_SELINUX}" = "y" ] && ${PKG_CONFIG} libselinux --exists; then
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+ 
--- a/pkgs/iproute2-small/patches/400-rdma-include-libgen.h-for-basename.patch
+++ b/pkgs/iproute2-small/patches/400-rdma-include-libgen.h-for-basename.patch
@ -0,0 +1,10 @@
+--- a/rdma/rdma.h
+++ b/rdma/rdma.h
+@@ -16,6 +16,7 @@
+ #include <rdma/rdma_user_cm.h>
+ #include <time.h>
+ #include <net/if_arp.h>
+#include <libgen.h>
+ 
+ #include "list.h"
+ #include "utils.h"