package/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2012 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.10
  13 PKG_RELEASE:=4
  14
  15 PKG_MD5SUM:=f382fe693f0b59d87bd47bea65eca198
  16 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  17 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  18         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  20         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IPv4 firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IPv4 firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - limit
  66   - mac
  67   - multiport
  68
  69  Targets:
  70   - ACCEPT
  71   - DROP
  72   - REJECT
  73   - LOG
  74   - TCPMSS
  75
  76  Tables:
  77   - filter
  78   - mangle
  79
  80 endef
  81
  82 define Package/iptables-mod-conntrack
  83 $(call Package/iptables/Module, +kmod-ipt-conntrack)
  84   TITLE:=Basic connection tracking extensions
  85 endef
  86
  87 define Package/iptables-mod-conntrack/description
  88 Basic iptables extensions for connection tracking.
  89
  90  Matches:
  91   - state
  92   - conntrack
  93
  94  Targets:
  95   - NOTRACK
  96
  97  Tables:
  98   - raw
  99
 100 endef
 101
 102 define Package/iptables-mod-conntrack-extra
 103 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
 104   TITLE:=Extra connection tracking extensions
 105 endef
 106
 107 define Package/iptables-mod-conntrack-extra/description
 108 Extra iptables extensions for connection tracking.
 109
 110  Matches:
 111   - connbytes
 112   - connmark
 113   - recent
 114   - helper
 115
 116  Targets:
 117   - CONNMARK
 118
 119 endef
 120
 121 define Package/iptables-mod-filter
 122 $(call Package/iptables/Module, +kmod-ipt-filter)
 123   TITLE:=Content inspection extensions
 124 endef
 125
 126 define Package/iptables-mod-filter/description
 127 iptables extensions for packet content inspection.
 128 Includes support for:
 129
 130  Matches:
 131   - layer7
 132   - string
 133
 134 endef
 135
 136 define Package/iptables-mod-ipopt
 137 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 138   TITLE:=IP/Packet option extensions
 139 endef
 140
 141 define Package/iptables-mod-ipopt/description
 142 iptables extensions for matching/changing IP packet options.
 143
 144  Matches:
 145   - dscp
 146   - ecn
 147   - length
 148   - mark
 149   - statistic
 150   - tcpmss
 151   - time
 152   - unclean
 153   - hl
 154
 155  Targets:
 156   - DSCP
 157   - CLASSIFY
 158   - ECN
 159   - MARK
 160   - HL
 161
 162 endef
 163
 164 define Package/iptables-mod-ipsec
 165 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 166   TITLE:=IPsec extensions
 167 endef
 168
 169 define Package/iptables-mod-ipsec/description
 170 iptables extensions for matching ipsec traffic.
 171
 172  Matches:
 173   - ah
 174   - esp
 175   - policy
 176
 177 endef
 178
 179 define Package/iptables-mod-ipset
 180 $(call Package/iptables/Module,)
 181   TITLE:=IPset iptables extensions
 182 endef
 183
 184 define Package/iptables-mod-ipset/description
 185 IPset iptables extensions.
 186
 187  Matches:
 188   - set
 189
 190  Targets:
 191   - SET
 192
 193 endef
 194
 195 define Package/iptables-mod-nat
 196 $(call Package/iptables/Module, +kmod-ipt-nat)
 197   TITLE:=Basic NAT extensions
 198 endef
 199
 200 define Package/iptables-mod-nat/description
 201 iptables extensions for basic NAT targets.
 202
 203  Targets:
 204   - SNAT
 205   - DNAT
 206   - MASQUERADE
 207
 208  Tables:
 209   - nat
 210
 211 endef
 212
 213 define Package/iptables-mod-nat-extra
 214 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 215   TITLE:=Extra NAT extensions
 216 endef
 217
 218 define Package/iptables-mod-nat-extra/description
 219 iptables extensions for extra NAT targets.
 220
 221  Targets:
 222   - MIRROR
 223   - NETMAP
 224   - REDIRECT
 225 endef
 226
 227 define Package/iptables-mod-ulog
 228 $(call Package/iptables/Module, +kmod-ipt-ulog)
 229   TITLE:=user-space packet logging
 230 endef
 231
 232 define Package/iptables-mod-ulog/description
 233 iptables extensions for user-space packet logging.
 234
 235  Targets:
 236   - ULOG
 237
 238 endef
 239
 240 define Package/iptables-mod-hashlimit
 241 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 242   TITLE:=hashlimit matching
 243 endef
 244
 245 define Package/iptables-mod-hashlimit/description
 246 iptables extensions for hashlimit matching
 247
 248  Matches:
 249   - hashlimit
 250
 251 endef
 252
 253 define Package/iptables-mod-iprange
 254 $(call Package/iptables/Module, +kmod-ipt-iprange)
 255   TITLE:=IP range extension
 256 endef
 257
 258 define Package/iptables-mod-iprange/description
 259 iptables extensions for matching ip ranges.
 260
 261  Matches:
 262   - iprange
 263
 264 endef
 265
 266 define Package/iptables-mod-extra
 267 $(call Package/iptables/Module, +kmod-ipt-extra)
 268   TITLE:=Other extra iptables extensions
 269 endef
 270
 271 define Package/iptables-mod-extra/description
 272 Other extra iptables extensions.
 273
 274  Matches:
 275   - condition
 276   - owner
 277   - physdev (if ebtables is enabled)
 278   - pkttype
 279   - quota
 280
 281 endef
 282
 283 define Package/iptables-mod-led
 284 $(call Package/iptables/Module, +kmod-ipt-led)
 285   TITLE:=LED trigger iptables extension
 286 endef
 287
 288 define Package/iptables-mod-led/description
 289 iptables extension for triggering a LED.
 290
 291  Targets:
 292   - LED
 293
 294 endef
 295
 296 define Package/iptables-mod-tproxy
 297 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 298   TITLE:=Transparent proxy iptables extensions
 299 endef
 300
 301 define Package/iptables-mod-tproxy/description
 302 Transparent proxy iptables extensions.
 303
 304  Matches:
 305   - socket
 306
 307  Targets:
 308   - TPROXY
 309
 310 endef
 311
 312 define Package/iptables-mod-tee
 313 $(call Package/iptables/Module, +kmod-ipt-tee)
 314   TITLE:=TEE iptables extensions
 315 endef
 316
 317 define Package/iptables-mod-tee/description
 318 TEE iptables extensions.
 319
 320  Targets:
 321   - TEE
 322
 323 endef
 324
 325 define Package/iptables-mod-u32
 326 $(call Package/iptables/Module, +kmod-ipt-u32)
 327   TITLE:=U32 iptables extensions
 328 endef
 329
 330 define Package/iptables-mod-u32/description
 331 U32 iptables extensions.
 332
 333  Matches:
 334   - u32
 335
 336 endef
 337
 338 define Package/ip6tables
 339 $(call Package/iptables/Default)
 340   DEPENDS:=+kmod-ip6tables +libip6tc +libxtables
 341   CATEGORY:=IPv6
 342   TITLE:=IPv6 firewall administration tool
 343   MENU:=1
 344 endef
 345
 346 define Package/libiptc
 347 $(call Package/iptables/Default)
 348   SECTION:=libs
 349   CATEGORY:=Libraries
 350   DEPENDS:=+libip4tc +libip6tc
 351   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 352 endef
 353
 354 define Package/libip4tc
 355 $(call Package/iptables/Default)
 356   SECTION:=libs
 357   CATEGORY:=Libraries
 358   TITLE:=IPv4 firewall - shared libiptc library
 359 endef
 360
 361 define Package/libip6tc
 362 $(call Package/iptables/Default)
 363   SECTION:=libs
 364   CATEGORY:=Libraries
 365   TITLE:=IPv6 firewall - shared libiptc library
 366 endef
 367
 368 define Package/libxtables
 369  $(call Package/iptables/Default)
 370  SECTION:=libs
 371  CATEGORY:=Libraries
 372  TITLE:=IPv4/IPv6 firewall - shared xtables library
 373 endef
 374
 375 define Package/libipq
 376   $(call Package/iptables/Default)
 377   SECTION:=libs
 378   CATEGORY:=Libraries
 379   TITLE:=IPv4/IPv6 firewall - shared libipq library
 380 endef
 381
 382 TARGET_CPPFLAGS := \
 383         -I$(PKG_BUILD_DIR)/include \
 384         -I$(LINUX_DIR)/arch/$(LINUX_KARCH)/include \
 385         $(TARGET_CPPFLAGS)
 386
 387 TARGET_CFLAGS += \
 388         -I$(PKG_BUILD_DIR)/include \
 389         -I$(LINUX_DIR)/arch/$(LINUX_KARCH)/include
 390
 391 CONFIGURE_ARGS += \
 392         --enable-shared \
 393         --enable-devel \
 394         $(if $(CONFIG_IPV6),--enable-ipv6,--disable-ipv6) \
 395         --enable-libipq \
 396         --with-kernel="$(LINUX_DIR)" \
 397         --with-xtlibdir=/usr/lib/iptables
 398
 399 MAKE_FLAGS := \
 400         $(TARGET_CONFIGURE_OPTS) \
 401         COPT_FLAGS="$(TARGET_CFLAGS)" \
 402         LDFLAGS="-rdynamic" \
 403         KERNEL_DIR="$(LINUX_DIR)" PREFIX=/usr \
 404         KBUILD_OUTPUT="$(LINUX_DIR)" \
 405
 406 define Build/InstallDev
 407         $(INSTALL_DIR) $(1)/usr/include
 408         $(INSTALL_DIR) $(1)/usr/include/iptables
 409         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 410
 411         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 412         $(CP) $(PKG_BUILD_DIR)/include/net/netfilter/*.h $(1)/usr/include/net/netfilter/
 413         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 414         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 415         $(CP) $(PKG_BUILD_DIR)/include/libipq/libipq.h $(1)/usr/include/
 416         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 417         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 418
 419         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 420         $(INSTALL_DIR) $(1)/usr/lib
 421         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 422         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 423         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libipq.so* $(1)/usr/lib/
 424         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 425         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 426         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libiptc.pc $(1)/usr/lib/pkgconfig/
 427 endef
 428
 429 define Package/iptables/install
 430         $(INSTALL_DIR) $(1)/usr/sbin
 431         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/iptables $(1)/usr/sbin/
 432         $(LN) iptables $(1)/usr/sbin/iptables-save
 433         $(LN) iptables $(1)/usr/sbin/iptables-restore
 434         $(INSTALL_DIR) $(1)/usr/lib/iptables
 435         (cd $(PKG_INSTALL_DIR)/usr/lib/iptables ; \
 436                 for m in $(patsubst xt_%,ipt_%,$(IPT_BUILTIN)) $(patsubst ipt_%,xt_%,$(IPT_BUILTIN)); do \
 437                         if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$${m}.so ]; then \
 438                                 $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$${m}.so $(1)/usr/lib/iptables/ ;\
 439                         fi; \
 440                 done \
 441         )
 442 endef
 443
 444 define Package/ip6tables/install
 445         $(INSTALL_DIR) $(1)/usr/sbin
 446         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables $(1)/usr/sbin/
 447         $(LN) ip6tables $(1)/usr/sbin/ip6tables-save
 448         $(LN) ip6tables $(1)/usr/sbin/ip6tables-restore
 449         $(INSTALL_DIR) $(1)/usr/lib/iptables
 450         (cd $(PKG_INSTALL_DIR)/usr/lib/iptables ; \
 451                 $(CP) libip6t_*.so $(1)/usr/lib/iptables/ \
 452         )
 453 endef
 454
 455 define Package/libiptc/install
 456         $(INSTALL_DIR) $(1)/usr/lib
 457         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 458 endef
 459
 460 define Package/libip4tc/install
 461         $(INSTALL_DIR) $(1)/usr/lib
 462         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 463 endef
 464
 465 define Package/libip6tc/install
 466         $(INSTALL_DIR) $(1)/usr/lib
 467         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 468 endef
 469
 470 define Package/libxtables/install
 471         $(INSTALL_DIR) $(1)/usr/lib
 472         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 473 endef
 474
 475 define Package/libipq/install
 476         $(INSTALL_DIR) $(1)/usr/lib
 477         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libipq.so* $(1)/usr/lib/
 478 endef
 479
 480 define BuildPlugin
 481   define Package/$(1)/install
 482         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 483         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)); do \
 484                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 485                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 486                 fi; \
 487         done
 488         $(3)
 489   endef
 490
 491   $$(eval $$(call BuildPackage,$(1)))
 492 endef
 493
 494 L7_INSTALL:=\
 495         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 496         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 497
 498
 499 $(eval $(call BuildPackage,iptables))
 500 $(eval $(call BuildPlugin,iptables-mod-conntrack,$(IPT_CONNTRACK-m)))
 501 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 502 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 503 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 504 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 505 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 506 $(eval $(call BuildPlugin,iptables-mod-ipset,ipt_set ipt_SET))
 507 $(eval $(call BuildPlugin,iptables-mod-nat,$(IPT_NAT-m)))
 508 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 509 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 510 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 511 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 512 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 513 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 514 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 515 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 516 $(eval $(call BuildPackage,ip6tables))
 517 $(eval $(call BuildPackage,libiptc))
 518 $(eval $(call BuildPackage,libip4tc))
 519 $(eval $(call BuildPackage,libip6tc))
 520 $(eval $(call BuildPackage,libxtables))
 521 $(eval $(call BuildPackage,libipq))