package/kernel/linux/modules/netfilter.mk

   1
   2 #
   3 # Copyright (C) 2006-2010 OpenWrt.org
   4 #
   5 # This is free software, licensed under the GNU General Public License v2.
   6 # See /LICENSE for more information.
   7 #
   8
   9 NF_MENU:=Netfilter Extensions
  10 NF_KMOD:=1
  11 include $(INCLUDE_DIR)/netfilter.mk
  12
  13
  14 define KernelPackage/nf-ipt
  15   SUBMENU:=$(NF_MENU)
  16   TITLE:=Iptables core
  17   KCONFIG:= \
  18         CONFIG_NETFILTER=y \
  19         CONFIG_NETFILTER_ADVANCED=y \
  20         $(KCONFIG_NF_IPT)
  21   FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
  22   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
  23 endef
  24
  25 $(eval $(call KernelPackage,nf-ipt))
  26
  27
  28 define KernelPackage/nf-ipt6
  29   SUBMENU:=$(NF_MENU)
  30   TITLE:=Ip6tables core
  31   KCONFIG:=$(KCONFIG_NF_IPT6)
  32   FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
  33   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
  34   DEPENDS:=+kmod-nf-ipt +kmod-nf-conntrack6
  35 endef
  36
  37 $(eval $(call KernelPackage,nf-ipt6))
  38
  39
  40
  41 define KernelPackage/ipt-core
  42   SUBMENU:=$(NF_MENU)
  43   TITLE:=Iptables core
  44   KCONFIG:=$(KCONFIG_IPT_CORE)
  45   FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
  46   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
  47   DEPENDS:=+kmod-nf-ipt
  48 endef
  49
  50 define KernelPackage/ipt-core/description
  51  Netfilter core kernel modules
  52  Includes:
  53  - comment
  54  - limit
  55  - LOG
  56  - mac
  57  - multiport
  58  - REJECT
  59  - TCPMSS
  60 endef
  61
  62 $(eval $(call KernelPackage,ipt-core))
  63
  64
  65 define KernelPackage/nf-conntrack
  66   SUBMENU:=$(NF_MENU)
  67   TITLE:=Netfilter connection tracking
  68   KCONFIG:= \
  69         CONFIG_NETFILTER=y \
  70         CONFIG_NETFILTER_ADVANCED=y \
  71         $(KCONFIG_NF_CONNTRACK)
  72   FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
  73   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
  74 endef
  75
  76 $(eval $(call KernelPackage,nf-conntrack))
  77
  78
  79 define KernelPackage/nf-conntrack6
  80   SUBMENU:=$(NF_MENU)
  81   TITLE:=Netfilter IPv6 connection tracking
  82   KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
  83   DEPENDS:=+kmod-ipv6 +kmod-nf-conntrack
  84   FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
  85   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
  86 endef
  87
  88 $(eval $(call KernelPackage,nf-conntrack6))
  89
  90
  91 define KernelPackage/nf-nat
  92   SUBMENU:=$(NF_MENU)
  93   TITLE:=Netfilter NAT
  94   KCONFIG:=$(KCONFIG_NF_NAT)
  95   DEPENDS:=+kmod-nf-conntrack +kmod-nf-ipt
  96   FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
  97   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
  98 endef
  99
 100 $(eval $(call KernelPackage,nf-nat))
 101
 102
 103 define KernelPackage/nf-nat6
 104   SUBMENU:=$(NF_MENU)
 105   TITLE:=Netfilter IPV6-NAT
 106   KCONFIG:=$(KCONFIG_NF_NAT6)
 107   DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-ipt6 +kmod-nf-nat
 108   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 109   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 110 endef
 111
 112 $(eval $(call KernelPackage,nf-nat6))
 113
 114
 115 define AddDepends/ipt
 116   SUBMENU:=$(NF_MENU)
 117   DEPENDS+= +kmod-ipt-core $(1)
 118 endef
 119
 120
 121 define KernelPackage/ipt-conntrack
 122   TITLE:=Basic connection tracking modules
 123   KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
 124   FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
 125   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
 126   $(call AddDepends/ipt,+kmod-nf-conntrack)
 127 endef
 128
 129 define KernelPackage/ipt-conntrack/description
 130  Netfilter (IPv4) kernel modules for connection tracking
 131  Includes:
 132  - conntrack
 133  - defrag
 134  - iptables_raw
 135  - NOTRACK
 136  - state
 137 endef
 138
 139 $(eval $(call KernelPackage,ipt-conntrack))
 140
 141
 142 define KernelPackage/ipt-conntrack-extra
 143   TITLE:=Extra connection tracking modules
 144   KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
 145   FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 146   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
 147   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 148 endef
 149
 150 define KernelPackage/ipt-conntrack-extra/description
 151  Netfilter (IPv4) extra kernel modules for connection tracking
 152  Includes:
 153  - connbytes
 154  - connmark/CONNMARK
 155  - conntrack
 156  - helper
 157  - recent
 158 endef
 159
 160 $(eval $(call KernelPackage,ipt-conntrack-extra))
 161
 162
 163 define KernelPackage/ipt-filter
 164   TITLE:=Modules for packet content inspection
 165   KCONFIG:=$(KCONFIG_IPT_FILTER)
 166   FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
 167   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
 168   $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
 169 endef
 170
 171 define KernelPackage/ipt-filter/description
 172  Netfilter (IPv4) kernel modules for packet content inspection
 173  Includes:
 174  - layer7
 175  - string
 176 endef
 177
 178 $(eval $(call KernelPackage,ipt-filter))
 179
 180
 181 define KernelPackage/ipt-ipopt
 182   TITLE:=Modules for matching/changing IP packet options
 183   KCONFIG:=$(KCONFIG_IPT_IPOPT)
 184   FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
 185   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
 186   $(call AddDepends/ipt)
 187 endef
 188
 189 define KernelPackage/ipt-ipopt/description
 190  Netfilter (IPv4) modules for matching/changing IP packet options
 191  Includes:
 192  - CLASSIFY
 193  - dscp/DSCP
 194  - ecn/ECN
 195  - hl/HL
 196  - length
 197  - mark/MARK
 198  - statistic
 199  - tcpmss
 200  - time
 201  - ttl/TTL
 202  - unclean
 203 endef
 204
 205 $(eval $(call KernelPackage,ipt-ipopt))
 206
 207
 208 define KernelPackage/ipt-ipsec
 209   TITLE:=Modules for matching IPSec packets
 210   KCONFIG:=$(KCONFIG_IPT_IPSEC)
 211   FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
 212   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
 213   $(call AddDepends/ipt)
 214 endef
 215
 216 define KernelPackage/ipt-ipsec/description
 217  Netfilter (IPv4) modules for matching IPSec packets
 218  Includes:
 219  - ah
 220  - esp
 221  - policy
 222 endef
 223
 224 $(eval $(call KernelPackage,ipt-ipsec))
 225
 226 IPSET_MODULES:= \
 227         ipset/ip_set \
 228         ipset/ip_set_bitmap_ip \
 229         ipset/ip_set_bitmap_ipmac \
 230         ipset/ip_set_bitmap_port \
 231         ipset/ip_set_hash_ip \
 232         ipset/ip_set_hash_ipmark \
 233         ipset/ip_set_hash_ipport \
 234         ipset/ip_set_hash_ipportip \
 235         ipset/ip_set_hash_ipportnet \
 236         ipset/ip_set_hash_mac \
 237         ipset/ip_set_hash_netportnet \
 238         ipset/ip_set_hash_net \
 239         ipset/ip_set_hash_netnet \
 240         ipset/ip_set_hash_netport \
 241         ipset/ip_set_hash_netiface \
 242         ipset/ip_set_list_set \
 243         xt_set
 244
 245 define KernelPackage/ipt-ipset
 246   SUBMENU:=Netfilter Extensions
 247   TITLE:=IPset netfilter modules
 248   DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
 249   KCONFIG:= \
 250         CONFIG_IP_SET \
 251         CONFIG_IP_SET_MAX=256 \
 252         CONFIG_NETFILTER_XT_SET \
 253         CONFIG_IP_SET_BITMAP_IP \
 254         CONFIG_IP_SET_BITMAP_IPMAC \
 255         CONFIG_IP_SET_BITMAP_PORT \
 256         CONFIG_IP_SET_HASH_IP \
 257         CONFIG_IP_SET_HASH_IPMARK \
 258         CONFIG_IP_SET_HASH_IPPORT \
 259         CONFIG_IP_SET_HASH_IPPORTIP \
 260         CONFIG_IP_SET_HASH_IPPORTNET \
 261         CONFIG_IP_SET_HASH_MAC \
 262         CONFIG_IP_SET_HASH_NET \
 263         CONFIG_IP_SET_HASH_NETNET \
 264         CONFIG_IP_SET_HASH_NETIFACE \
 265         CONFIG_IP_SET_HASH_NETPORT \
 266         CONFIG_IP_SET_HASH_NETPORTNET \
 267         CONFIG_IP_SET_LIST_SET \
 268         CONFIG_NET_EMATCH_IPSET=n
 269   FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
 270   AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
 271 endef
 272 $(eval $(call KernelPackage,ipt-ipset))
 273
 274
 275 define KernelPackage/ipt-nat
 276   TITLE:=Basic NAT targets
 277   KCONFIG:=$(KCONFIG_IPT_NAT)
 278   FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 279   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
 280   $(call AddDepends/ipt,+kmod-nf-nat)
 281 endef
 282
 283 define KernelPackage/ipt-nat/description
 284  Netfilter (IPv4) kernel modules for basic NAT targets
 285  Includes:
 286  - MASQUERADE
 287 endef
 288
 289 $(eval $(call KernelPackage,ipt-nat))
 290
 291
 292 define KernelPackage/ipt-nat6
 293   TITLE:=IPv6 NAT targets
 294   KCONFIG:=$(KCONFIG_IPT_NAT6)
 295   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 296   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
 297   $(call AddDepends/ipt,+kmod-nf-nat6)
 298   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 299   $(call AddDepends/ipt,+kmod-ipt-nat)
 300   $(call AddDepends/ipt,+kmod-ip6tables)
 301 endef
 302
 303 define KernelPackage/ipt-nat6/description
 304  Netfilter (IPv6) kernel modules for NAT targets
 305 endef
 306
 307 $(eval $(call KernelPackage,ipt-nat6))
 308
 309
 310 define KernelPackage/ipt-nat-extra
 311   TITLE:=Extra NAT targets
 312   KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
 313   FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 314   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
 315   $(call AddDepends/ipt,+kmod-ipt-nat)
 316 endef
 317
 318 define KernelPackage/ipt-nat-extra/description
 319  Netfilter (IPv4) kernel modules for extra NAT targets
 320  Includes:
 321  - NETMAP
 322  - REDIRECT
 323 endef
 324
 325 $(eval $(call KernelPackage,ipt-nat-extra))
 326
 327
 328 define KernelPackage/nf-nathelper
 329   SUBMENU:=$(NF_MENU)
 330   TITLE:=Basic Conntrack and NAT helpers
 331   KCONFIG:=$(KCONFIG_NF_NATHELPER)
 332   FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
 333   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
 334   DEPENDS:=+kmod-nf-nat
 335 endef
 336
 337 define KernelPackage/nf-nathelper/description
 338  Default Netfilter (IPv4) Conntrack and NAT helpers
 339  Includes:
 340  - ftp
 341  - irc
 342  - tftp
 343 endef
 344
 345 $(eval $(call KernelPackage,nf-nathelper))
 346
 347
 348 define KernelPackage/nf-nathelper-extra
 349   SUBMENU:=$(NF_MENU)
 350   TITLE:=Extra Conntrack and NAT helpers
 351   KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
 352   FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 353   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
 354   DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
 355 endef
 356
 357 define KernelPackage/nf-nathelper-extra/description
 358  Extra Netfilter (IPv4) Conntrack and NAT helpers
 359  Includes:
 360  - amanda
 361  - h323
 362  - mms
 363  - pptp
 364  - proto_gre
 365  - sip
 366  - snmp_basic
 367  - broadcast
 368 endef
 369
 370 $(eval $(call KernelPackage,nf-nathelper-extra))
 371
 372
 373 define KernelPackage/ipt-ulog
 374   TITLE:=Module for user-space packet logging
 375   KCONFIG:=$(KCONFIG_IPT_ULOG)
 376   FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
 377   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
 378   $(call AddDepends/ipt)
 379 endef
 380
 381 define KernelPackage/ipt-ulog/description
 382  Netfilter (IPv4) module for user-space packet logging
 383  Includes:
 384  - ULOG
 385 endef
 386
 387 $(eval $(call KernelPackage,ipt-ulog))
 388
 389
 390 define KernelPackage/ipt-nflog
 391   TITLE:=Module for user-space packet logging
 392   KCONFIG:=$(KCONFIG_IPT_NFLOG)
 393   FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
 394   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
 395   $(call AddDepends/ipt,+kmod-nfnetlink-log)
 396 endef
 397
 398 define KernelPackage/ipt-nflog/description
 399  Netfilter module for user-space packet logging
 400  Includes:
 401  - NFLOG
 402 endef
 403
 404 $(eval $(call KernelPackage,ipt-nflog))
 405
 406
 407 define KernelPackage/ipt-nfqueue
 408   TITLE:=Module for user-space packet queuing
 409   KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
 410   FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 411   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
 412   $(call AddDepends/ipt,+kmod-nfnetlink-queue)
 413 endef
 414
 415 define KernelPackage/ipt-nfqueue/description
 416  Netfilter module for user-space packet queuing
 417  Includes:
 418  - NFQUEUE
 419 endef
 420
 421 $(eval $(call KernelPackage,ipt-nfqueue))
 422
 423
 424 define KernelPackage/ipt-debug
 425   TITLE:=Module for debugging/development
 426   KCONFIG:=$(KCONFIG_IPT_DEBUG)
 427   DEFAULT:=n
 428   FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
 429   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
 430   $(call AddDepends/ipt)
 431 endef
 432
 433 define KernelPackage/ipt-debug/description
 434  Netfilter modules for debugging/development of the firewall
 435  Includes:
 436  - TRACE
 437 endef
 438
 439 $(eval $(call KernelPackage,ipt-debug))
 440
 441
 442 define KernelPackage/ipt-led
 443   TITLE:=Module to trigger a LED with a Netfilter rule
 444   KCONFIG:=$(KCONFIG_IPT_LED)
 445   FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
 446   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
 447   $(call AddDepends/ipt)
 448 endef
 449
 450 define KernelPackage/ipt-led/description
 451  Netfilter target to trigger a LED when a network packet is matched.
 452 endef
 453
 454 $(eval $(call KernelPackage,ipt-led))
 455
 456 define KernelPackage/ipt-tproxy
 457   TITLE:=Transparent proxying support
 458   DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-ipv6 +IPV6:kmod-ip6tables
 459   KCONFIG:= \
 460         CONFIG_NETFILTER_TPROXY \
 461         CONFIG_NETFILTER_XT_MATCH_SOCKET \
 462         CONFIG_NETFILTER_XT_TARGET_TPROXY
 463   FILES:= \
 464         $(if $(call kernel_patchver_lt,3.12),$(LINUX_DIR)/net/netfilter/nf_tproxy_core.ko) \
 465         $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
 466   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tproxy_core $(IPT_TPROXY-m)))
 467   $(call AddDepends/ipt)
 468 endef
 469
 470 define KernelPackage/ipt-tproxy/description
 471   Kernel modules for Transparent Proxying
 472 endef
 473
 474 $(eval $(call KernelPackage,ipt-tproxy))
 475
 476 define KernelPackage/ipt-tee
 477   TITLE:=TEE support
 478   DEPENDS:=+kmod-ipt-conntrack +IPV6:kmod-ipv6
 479   KCONFIG:= \
 480         CONFIG_NETFILTER_XT_TARGET_TEE
 481   FILES:= \
 482         $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
 483         $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
 484   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
 485   $(call AddDepends/ipt)
 486 endef
 487
 488 define KernelPackage/ipt-tee/description
 489   Kernel modules for TEE
 490 endef
 491
 492 $(eval $(call KernelPackage,ipt-tee))
 493
 494
 495 define KernelPackage/ipt-u32
 496   TITLE:=U32 support
 497   KCONFIG:= \
 498         CONFIG_NETFILTER_XT_MATCH_U32
 499   FILES:= \
 500         $(LINUX_DIR)/net/netfilter/xt_u32.ko \
 501         $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
 502   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
 503   $(call AddDepends/ipt)
 504 endef
 505
 506 define KernelPackage/ipt-u32/description
 507   Kernel modules for U32
 508 endef
 509
 510 $(eval $(call KernelPackage,ipt-u32))
 511
 512
 513 define KernelPackage/ipt-iprange
 514   TITLE:=Module for matching ip ranges
 515   KCONFIG:=$(KCONFIG_IPT_IPRANGE)
 516   FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
 517   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
 518   $(call AddDepends/ipt)
 519 endef
 520
 521 define KernelPackage/ipt-iprange/description
 522  Netfilter (IPv4) module for matching ip ranges
 523  Includes:
 524  - iprange
 525 endef
 526
 527 $(eval $(call KernelPackage,ipt-iprange))
 528
 529 define KernelPackage/ipt-cluster
 530   TITLE:=Module for matching cluster
 531   KCONFIG:=$(KCONFIG_IPT_CLUSTER)
 532   FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
 533   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
 534   $(call AddDepends/ipt)
 535 endef
 536
 537 define KernelPackage/ipt-cluster/description
 538  Netfilter (IPv4/IPv6) module for matching cluster
 539  This option allows you to build work-load-sharing clusters of
 540  network servers/stateful firewalls without having a dedicated
 541  load-balancing router/server/switch. Basically, this match returns
 542  true when the packet must be handled by this cluster node. Thus,
 543  all nodes see all packets and this match decides which node handles
 544  what packets. The work-load sharing algorithm is based on source
 545  address hashing.
 546
 547  This module is usable for ipv4 and ipv6.
 548
 549  To use it also enable iptables-mod-cluster
 550
 551  see `iptables -m cluster --help` for more information.
 552 endef
 553
 554 $(eval $(call KernelPackage,ipt-cluster))
 555
 556 define KernelPackage/ipt-clusterip
 557   TITLE:=Module for CLUSTERIP
 558   KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
 559   FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
 560   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
 561   $(call AddDepends/ipt,+kmod-nf-conntrack)
 562 endef
 563
 564 define KernelPackage/ipt-clusterip/description
 565  Netfilter (IPv4-only) module for CLUSTERIP
 566  The CLUSTERIP target allows you to build load-balancing clusters of
 567  network servers without having a dedicated load-balancing
 568  router/server/switch.
 569
 570  To use it also enable iptables-mod-clusterip
 571
 572  see `iptables -j CLUSTERIP --help` for more information.
 573 endef
 574
 575 $(eval $(call KernelPackage,ipt-clusterip))
 576
 577
 578 define KernelPackage/ipt-extra
 579   TITLE:=Extra modules
 580   KCONFIG:=$(KCONFIG_IPT_EXTRA)
 581   FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 582   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
 583   $(call AddDepends/ipt)
 584 endef
 585
 586 define KernelPackage/ipt-extra/description
 587  Other Netfilter (IPv4) kernel modules
 588  Includes:
 589  - addrtype
 590  - owner
 591  - physdev (if bridge support was enabled in kernel)
 592  - pkttype
 593  - quota
 594 endef
 595
 596 $(eval $(call KernelPackage,ipt-extra))
 597
 598
 599 define KernelPackage/ip6tables
 600   SUBMENU:=$(NF_MENU)
 601   TITLE:=IPv6 modules
 602   DEPENDS:=+kmod-nf-ipt6 +kmod-ipt-core +kmod-ipt-conntrack
 603   KCONFIG:=$(KCONFIG_IPT_IPV6)
 604   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
 605   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
 606 endef
 607
 608 define KernelPackage/ip6tables/description
 609  Netfilter IPv6 firewalling support
 610 endef
 611
 612 $(eval $(call KernelPackage,ip6tables))
 613
 614 define KernelPackage/ip6tables-extra
 615   SUBMENU:=$(NF_MENU)
 616   TITLE:=Extra IPv6 modules
 617   DEPENDS:=+kmod-ip6tables
 618   KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
 619   FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 620   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
 621 endef
 622
 623 define KernelPackage/ip6tables-extra/description
 624  Netfilter IPv6 extra header matching modules
 625 endef
 626
 627 $(eval $(call KernelPackage,ip6tables-extra))
 628
 629 ARP_MODULES = arp_tables arpt_mangle arptable_filter
 630 define KernelPackage/arptables
 631   SUBMENU:=$(NF_MENU)
 632   TITLE:=ARP firewalling modules
 633   DEPENDS:=+kmod-ipt-core
 634   FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
 635   KCONFIG:=CONFIG_IP_NF_ARPTABLES \
 636     CONFIG_IP_NF_ARPFILTER \
 637     CONFIG_IP_NF_ARP_MANGLE
 638   AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
 639 endef
 640
 641 define KernelPackage/arptables/description
 642  Kernel modules for ARP firewalling
 643 endef
 644
 645 $(eval $(call KernelPackage,arptables))
 646
 647
 648 define KernelPackage/ebtables
 649   SUBMENU:=$(NF_MENU)
 650   TITLE:=Bridge firewalling modules
 651   DEPENDS:=+kmod-ipt-core +kmod-bridge
 652   FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
 653   KCONFIG:=CONFIG_BRIDGE_NETFILTER=y \
 654         $(KCONFIG_EBTABLES)
 655   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
 656 endef
 657
 658 define KernelPackage/ebtables/description
 659   ebtables is a general, extensible frame/packet identification
 660   framework. It provides you to do Ethernet
 661   filtering/NAT/brouting on the Ethernet bridge.
 662 endef
 663
 664 $(eval $(call KernelPackage,ebtables))
 665
 666
 667 define AddDepends/ebtables
 668   SUBMENU:=$(NF_MENU)
 669   DEPENDS+=kmod-ebtables $(1)
 670 endef
 671
 672
 673 define KernelPackage/ebtables-ipv4
 674   TITLE:=ebtables: IPv4 support
 675   FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
 676   KCONFIG:=$(KCONFIG_EBTABLES_IP4)
 677   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
 678   $(call AddDepends/ebtables)
 679 endef
 680
 681 define KernelPackage/ebtables-ipv4/description
 682  This option adds the IPv4 support to ebtables, which allows basic
 683  IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
 684 endef
 685
 686 $(eval $(call KernelPackage,ebtables-ipv4))
 687
 688
 689 define KernelPackage/ebtables-ipv6
 690   TITLE:=ebtables: IPv6 support
 691   FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
 692   KCONFIG:=$(KCONFIG_EBTABLES_IP6)
 693   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
 694   $(call AddDepends/ebtables)
 695 endef
 696
 697 define KernelPackage/ebtables-ipv6/description
 698  This option adds the IPv6 support to ebtables, which allows basic
 699  IPv6 header field filtering and target support.
 700 endef
 701
 702 $(eval $(call KernelPackage,ebtables-ipv6))
 703
 704
 705 define KernelPackage/ebtables-watchers
 706   TITLE:=ebtables: watchers support
 707   FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
 708   KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
 709   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
 710   $(call AddDepends/ebtables)
 711 endef
 712
 713 define KernelPackage/ebtables-watchers/description
 714  This option adds the log watchers, that you can use in any rule
 715  in any ebtables table.
 716 endef
 717
 718 $(eval $(call KernelPackage,ebtables-watchers))
 719
 720
 721 define KernelPackage/nfnetlink
 722   SUBMENU:=$(NF_MENU)
 723   TITLE:=Netlink-based userspace interface
 724   FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
 725   KCONFIG:=$(KCONFIG_NFNETLINK)
 726   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
 727 endef
 728
 729 define KernelPackage/nfnetlink/description
 730  Kernel modules support for a netlink-based userspace interface
 731 endef
 732
 733 $(eval $(call KernelPackage,nfnetlink))
 734
 735
 736 define AddDepends/nfnetlink
 737   SUBMENU:=$(NF_MENU)
 738   DEPENDS+=+kmod-nfnetlink $(1)
 739 endef
 740
 741
 742 define KernelPackage/nfnetlink-log
 743   TITLE:=Netfilter LOG over NFNETLINK interface
 744   FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
 745   KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
 746   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
 747   $(call AddDepends/nfnetlink)
 748 endef
 749
 750 define KernelPackage/nfnetlink-log/description
 751  Kernel modules support for logging packets via NFNETLINK
 752  Includes:
 753  - NFLOG
 754 endef
 755
 756 $(eval $(call KernelPackage,nfnetlink-log))
 757
 758
 759 define KernelPackage/nfnetlink-queue
 760   TITLE:=Netfilter QUEUE over NFNETLINK interface
 761   FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 762   KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
 763   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
 764   $(call AddDepends/nfnetlink)
 765 endef
 766
 767 define KernelPackage/nfnetlink-queue/description
 768  Kernel modules support for queueing packets via NFNETLINK
 769  Includes:
 770  - NFQUEUE
 771 endef
 772
 773 $(eval $(call KernelPackage,nfnetlink-queue))
 774
 775
 776 define KernelPackage/nf-conntrack-netlink
 777   TITLE:=Connection tracking netlink interface
 778   FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
 779   KCONFIG:=CONFIG_NF_CT_NETLINK
 780   AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
 781   $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
 782 endef
 783
 784 define KernelPackage/nf-conntrack-netlink/description
 785  Kernel modules support for a netlink-based connection tracking
 786  userspace interface
 787 endef
 788
 789 $(eval $(call KernelPackage,nf-conntrack-netlink))
 790
 791 define KernelPackage/ipt-hashlimit
 792   SUBMENU:=$(NF_MENU)
 793   TITLE:=Netfilter hashlimit match
 794   DEPENDS:=+kmod-ipt-core
 795   KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
 796   FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
 797   AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
 798   $(call KernelPackage/ipt)
 799 endef
 800
 801 define KernelPackage/ipt-hashlimit/description
 802  Kernel modules support for the hashlimit bucket match module
 803 endef
 804
 805 $(eval $(call KernelPackage,ipt-hashlimit))
 806
 807
 808 define KernelPackage/nft-core
 809   SUBMENU:=$(NF_MENU)
 810   TITLE:=Netfilter nf_tables support
 811   DEPENDS:=+kmod-nfnetlink +kmod-nf-conntrack6
 812   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
 813   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
 814   KCONFIG:= \
 815         CONFIG_NETFILTER=y \
 816         CONFIG_NETFILTER_ADVANCED=y \
 817         CONFIG_NFT_COMPAT=n \
 818         CONFIG_NFT_QUEUE=n \
 819         CONFIG_NF_TABLES_ARP=n \
 820         CONFIG_NF_TABLES_BRIDGE=n \
 821         $(KCONFIG_NFT_CORE)
 822 endef
 823
 824 define KernelPackage/nft-core/description
 825  Kernel module support for nftables
 826 endef
 827
 828 $(eval $(call KernelPackage,nft-core))
 829
 830
 831 define KernelPackage/nft-nat
 832   SUBMENU:=$(NF_MENU)
 833   TITLE:=Netfilter nf_tables NAT support
 834   DEPENDS:=+kmod-nft-core +kmod-nf-nat
 835   FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 836   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
 837   KCONFIG:=$(KCONFIG_NFT_NAT)
 838 endef
 839
 840 $(eval $(call KernelPackage,nft-nat))
 841
 842
 843 define KernelPackage/nft-nat6
 844   SUBMENU:=$(NF_MENU)
 845   TITLE:=Netfilter nf_tables IPv6-NAT support
 846   DEPENDS:=+kmod-nft-core +kmod-nf-nat6
 847   FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 848   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
 849   KCONFIG:=$(KCONFIG_NFT_NAT6)
 850 endef
 851
 852 $(eval $(call KernelPackage,nft-nat6))
 853