package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.20
  13 PKG_RELEASE:=1
  14
  15 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  16 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  17         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  18         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  20 PKG_MD5SUM:=387b92d3efcf4f07fe31c3bf0f1d18f5
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IP firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IP firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - conntrack
  66   - limit
  67   - mac
  68   - mark
  69   - multiport
  70   - set
  71   - state
  72   - time
  73
  74  Targets:
  75   - ACCEPT
  76   - CT
  77   - DNAT
  78   - DROP
  79   - REJECT
  80   - LOG
  81   - MARK
  82   - MASQUERADE
  83   - REDIRECT
  84   - SET
  85   - SNAT
  86   - TCPMSS
  87
  88  Tables:
  89   - filter
  90   - mangle
  91   - nat
  92   - raw
  93
  94 endef
  95
  96 define Package/iptables-mod-conntrack-extra
  97 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  98   TITLE:=Extra connection tracking extensions
  99 endef
 100
 101 define Package/iptables-mod-conntrack-extra/description
 102 Extra iptables extensions for connection tracking.
 103
 104  Matches:
 105   - connbytes
 106   - connmark
 107   - recent
 108   - helper
 109
 110  Targets:
 111   - CONNMARK
 112
 113 endef
 114
 115 define Package/iptables-mod-filter
 116 $(call Package/iptables/Module, +kmod-ipt-filter)
 117   TITLE:=Content inspection extensions
 118 endef
 119
 120 define Package/iptables-mod-filter/description
 121 iptables extensions for packet content inspection.
 122 Includes support for:
 123
 124  Matches:
 125   - layer7
 126   - string
 127
 128 endef
 129
 130 define Package/iptables-mod-ipopt
 131 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 132   TITLE:=IP/Packet option extensions
 133 endef
 134
 135 define Package/iptables-mod-ipopt/description
 136 iptables extensions for matching/changing IP packet options.
 137
 138  Matches:
 139   - dscp
 140   - ecn
 141   - length
 142   - statistic
 143   - tcpmss
 144   - unclean
 145   - hl
 146
 147  Targets:
 148   - DSCP
 149   - CLASSIFY
 150   - ECN
 151   - HL
 152
 153 endef
 154
 155 define Package/iptables-mod-ipsec
 156 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 157   TITLE:=IPsec extensions
 158 endef
 159
 160 define Package/iptables-mod-ipsec/description
 161 iptables extensions for matching ipsec traffic.
 162
 163  Matches:
 164   - ah
 165   - esp
 166   - policy
 167
 168 endef
 169
 170 define Package/iptables-mod-nat-extra
 171 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 172   TITLE:=Extra NAT extensions
 173 endef
 174
 175 define Package/iptables-mod-nat-extra/description
 176 iptables extensions for extra NAT targets.
 177
 178  Targets:
 179   - MIRROR
 180   - NETMAP
 181 endef
 182
 183 define Package/iptables-mod-ulog
 184 $(call Package/iptables/Module, +kmod-ipt-ulog)
 185   TITLE:=user-space packet logging
 186 endef
 187
 188 define Package/iptables-mod-ulog/description
 189 iptables extensions for user-space packet logging.
 190
 191  Targets:
 192   - ULOG
 193
 194 endef
 195
 196 define Package/iptables-mod-hashlimit
 197 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 198   TITLE:=hashlimit matching
 199 endef
 200
 201 define Package/iptables-mod-hashlimit/description
 202 iptables extensions for hashlimit matching
 203
 204  Matches:
 205   - hashlimit
 206
 207 endef
 208
 209 define Package/iptables-mod-iprange
 210 $(call Package/iptables/Module, +kmod-ipt-iprange)
 211   TITLE:=IP range extension
 212 endef
 213
 214 define Package/iptables-mod-iprange/description
 215 iptables extensions for matching ip ranges.
 216
 217  Matches:
 218   - iprange
 219
 220 endef
 221
 222 define Package/iptables-mod-extra
 223 $(call Package/iptables/Module, +kmod-ipt-extra)
 224   TITLE:=Other extra iptables extensions
 225 endef
 226
 227 define Package/iptables-mod-extra/description
 228 Other extra iptables extensions.
 229
 230  Matches:
 231   - addrtype
 232   - condition
 233   - owner
 234   - physdev (if ebtables is enabled)
 235   - pkttype
 236   - quota
 237
 238 endef
 239
 240 define Package/iptables-mod-led
 241 $(call Package/iptables/Module, +kmod-ipt-led)
 242   TITLE:=LED trigger iptables extension
 243 endef
 244
 245 define Package/iptables-mod-led/description
 246 iptables extension for triggering a LED.
 247
 248  Targets:
 249   - LED
 250
 251 endef
 252
 253 define Package/iptables-mod-tproxy
 254 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 255   TITLE:=Transparent proxy iptables extensions
 256 endef
 257
 258 define Package/iptables-mod-tproxy/description
 259 Transparent proxy iptables extensions.
 260
 261  Matches:
 262   - socket
 263
 264  Targets:
 265   - TPROXY
 266
 267 endef
 268
 269 define Package/iptables-mod-tee
 270 $(call Package/iptables/Module, +kmod-ipt-tee)
 271   TITLE:=TEE iptables extensions
 272 endef
 273
 274 define Package/iptables-mod-tee/description
 275 TEE iptables extensions.
 276
 277  Targets:
 278   - TEE
 279
 280 endef
 281
 282 define Package/iptables-mod-u32
 283 $(call Package/iptables/Module, +kmod-ipt-u32)
 284   TITLE:=U32 iptables extensions
 285 endef
 286
 287 define Package/iptables-mod-u32/description
 288 U32 iptables extensions.
 289
 290  Matches:
 291   - u32
 292
 293 endef
 294
 295 define Package/ip6tables
 296 $(call Package/iptables/Default)
 297   DEPENDS:=@IPV6 +kmod-ip6tables +iptables
 298   CATEGORY:=Network
 299   TITLE:=IPv6 firewall administration tool
 300   MENU:=1
 301 endef
 302
 303 define Package/libiptc
 304 $(call Package/iptables/Default)
 305   SECTION:=libs
 306   CATEGORY:=Libraries
 307   DEPENDS:=+libip4tc +libip6tc
 308   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 309 endef
 310
 311 define Package/libip4tc
 312 $(call Package/iptables/Default)
 313   SECTION:=libs
 314   CATEGORY:=Libraries
 315   TITLE:=IPv4 firewall - shared libiptc library
 316 endef
 317
 318 define Package/libip6tc
 319 $(call Package/iptables/Default)
 320   SECTION:=libs
 321   CATEGORY:=Libraries
 322   TITLE:=IPv6 firewall - shared libiptc library
 323 endef
 324
 325 define Package/libxtables
 326  $(call Package/iptables/Default)
 327  SECTION:=libs
 328  CATEGORY:=Libraries
 329  TITLE:=IPv4/IPv6 firewall - shared xtables library
 330 endef
 331
 332 TARGET_CPPFLAGS := \
 333         -I$(PKG_BUILD_DIR)/include \
 334         -I$(LINUX_DIR)/user_headers/include \
 335         $(TARGET_CPPFLAGS)
 336
 337 TARGET_CFLAGS += \
 338         -I$(PKG_BUILD_DIR)/include \
 339         -I$(LINUX_DIR)/user_headers/include \
 340         -ffunction-sections -fdata-sections
 341
 342 TARGET_LDFLAGS += \
 343         -Wl,--gc-sections
 344
 345 CONFIGURE_ARGS += \
 346         --enable-shared \
 347         --enable-devel \
 348         --with-kernel="$(LINUX_DIR)/user_headers" \
 349         --with-xtlibdir=/usr/lib/iptables \
 350         --enable-static
 351
 352 MAKE_FLAGS := \
 353         $(TARGET_CONFIGURE_OPTS) \
 354         COPT_FLAGS="$(TARGET_CFLAGS)" \
 355         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 356         KBUILD_OUTPUT="$(LINUX_DIR)" \
 357         BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
 358
 359 define Build/InstallDev
 360         $(INSTALL_DIR) $(1)/usr/include
 361         $(INSTALL_DIR) $(1)/usr/include/iptables
 362         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 363
 364         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 365         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 366         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 367         $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
 368         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 369         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 370
 371         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 372         $(INSTALL_DIR) $(1)/usr/lib
 373         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 374         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 375         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 376         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 377         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
 378
 379         # XXX: needed by firewall3
 380         $(INSTALL_DIR) $(1)/usr/lib/iptables
 381         $(CP) $(PKG_BUILD_DIR)/extensions/libext*.a $(1)/usr/lib/iptables/
 382 endef
 383
 384 define Package/iptables/install
 385         $(INSTALL_DIR) $(1)/usr/sbin
 386         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
 387         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
 388         $(INSTALL_DIR) $(1)/usr/lib/iptables
 389 endef
 390
 391 define Package/ip6tables/install
 392         $(INSTALL_DIR) $(1)/usr/sbin
 393         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
 394 endef
 395
 396 define Package/libiptc/install
 397         $(INSTALL_DIR) $(1)/usr/lib
 398         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 399 endef
 400
 401 define Package/libip4tc/install
 402         $(INSTALL_DIR) $(1)/usr/lib
 403         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 404 endef
 405
 406 define Package/libip6tc/install
 407         $(INSTALL_DIR) $(1)/usr/lib
 408         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 409 endef
 410
 411 define Package/libxtables/install
 412         $(INSTALL_DIR) $(1)/usr/lib
 413         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 414 endef
 415
 416 define BuildPlugin
 417   define Package/$(1)/install
 418         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 419         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
 420                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 421                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 422                 fi; \
 423         done
 424         $(3)
 425   endef
 426
 427   $$(eval $$(call BuildPackage,$(1)))
 428 endef
 429
 430 L7_INSTALL:=\
 431         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 432         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 433
 434
 435 $(eval $(call BuildPackage,iptables))
 436 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 437 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 438 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 439 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 440 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 441 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 442 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 443 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 444 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 445 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 446 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 447 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 448 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 449 $(eval $(call BuildPackage,ip6tables))
 450 $(eval $(call BuildPackage,libiptc))
 451 $(eval $(call BuildPackage,libip4tc))
 452 $(eval $(call BuildPackage,libip6tc))
 453 $(eval $(call BuildPackage,libxtables))