package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.21
  13 PKG_RELEASE:=1
  14
  15 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  16 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  17         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  18         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  20 PKG_MD5SUM:=536d048c8e8eeebcd9757d0863ebb0c0
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IP firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IP firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - conntrack
  66   - limit
  67   - mac
  68   - mark
  69   - multiport
  70   - set
  71   - state
  72   - time
  73
  74  Targets:
  75   - ACCEPT
  76   - CT
  77   - DNAT
  78   - DROP
  79   - REJECT
  80   - LOG
  81   - MARK
  82   - MASQUERADE
  83   - REDIRECT
  84   - SET
  85   - SNAT
  86   - TCPMSS
  87
  88  Tables:
  89   - filter
  90   - mangle
  91   - nat
  92   - raw
  93
  94 endef
  95
  96 define Package/iptables-mod-conntrack-extra
  97 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  98   TITLE:=Extra connection tracking extensions
  99 endef
 100
 101 define Package/iptables-mod-conntrack-extra/description
 102 Extra iptables extensions for connection tracking.
 103
 104  Matches:
 105   - connbytes
 106   - connlimit
 107   - connmark
 108   - recent
 109   - helper
 110
 111  Targets:
 112   - CONNMARK
 113
 114 endef
 115
 116 define Package/iptables-mod-filter
 117 $(call Package/iptables/Module, +kmod-ipt-filter)
 118   TITLE:=Content inspection extensions
 119 endef
 120
 121 define Package/iptables-mod-filter/description
 122 iptables extensions for packet content inspection.
 123 Includes support for:
 124
 125  Matches:
 126   - layer7
 127   - string
 128
 129 endef
 130
 131 define Package/iptables-mod-ipopt
 132 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 133   TITLE:=IP/Packet option extensions
 134 endef
 135
 136 define Package/iptables-mod-ipopt/description
 137 iptables extensions for matching/changing IP packet options.
 138
 139  Matches:
 140   - dscp
 141   - ecn
 142   - length
 143   - statistic
 144   - tcpmss
 145   - unclean
 146   - hl
 147
 148  Targets:
 149   - DSCP
 150   - CLASSIFY
 151   - ECN
 152   - HL
 153
 154 endef
 155
 156 define Package/iptables-mod-ipsec
 157 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 158   TITLE:=IPsec extensions
 159 endef
 160
 161 define Package/iptables-mod-ipsec/description
 162 iptables extensions for matching ipsec traffic.
 163
 164  Matches:
 165   - ah
 166   - esp
 167   - policy
 168
 169 endef
 170
 171 define Package/iptables-mod-nat-extra
 172 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 173   TITLE:=Extra NAT extensions
 174 endef
 175
 176 define Package/iptables-mod-nat-extra/description
 177 iptables extensions for extra NAT targets.
 178
 179  Targets:
 180   - MIRROR
 181   - NETMAP
 182 endef
 183
 184 define Package/iptables-mod-ulog
 185 $(call Package/iptables/Module, +kmod-ipt-ulog)
 186   TITLE:=user-space packet logging
 187 endef
 188
 189 define Package/iptables-mod-ulog/description
 190 iptables extensions for user-space packet logging.
 191
 192  Targets:
 193   - ULOG
 194
 195 endef
 196
 197 define Package/iptables-mod-nflog
 198 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
 199   TITLE:=Netfilter NFLOG target
 200 endef
 201
 202 define Package/iptables-mod-nflog/description
 203  iptables extension for user-space logging via NFNETLINK.
 204
 205  Includes:
 206   - libxt_NFLOG
 207
 208 endef
 209
 210 define Package/iptables-mod-nfqueue
 211 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
 212   TITLE:=Netfilter NFQUEUE target
 213 endef
 214
 215 define Package/iptables-mod-nfqueue/description
 216  iptables extension for user-space queuing via NFNETLINK.
 217
 218  Includes:
 219   - libxt_NFQUEUE
 220
 221 endef
 222
 223 define Package/iptables-mod-hashlimit
 224 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 225   TITLE:=hashlimit matching
 226 endef
 227
 228 define Package/iptables-mod-hashlimit/description
 229 iptables extensions for hashlimit matching
 230
 231  Matches:
 232   - hashlimit
 233
 234 endef
 235
 236 define Package/iptables-mod-iprange
 237 $(call Package/iptables/Module, +kmod-ipt-iprange)
 238   TITLE:=IP range extension
 239 endef
 240
 241 define Package/iptables-mod-iprange/description
 242 iptables extensions for matching ip ranges.
 243
 244  Matches:
 245   - iprange
 246
 247 endef
 248
 249 define Package/iptables-mod-extra
 250 $(call Package/iptables/Module, +kmod-ipt-extra)
 251   TITLE:=Other extra iptables extensions
 252 endef
 253
 254 define Package/iptables-mod-extra/description
 255 Other extra iptables extensions.
 256
 257  Matches:
 258   - addrtype
 259   - condition
 260   - owner
 261   - physdev (if ebtables is enabled)
 262   - pkttype
 263   - quota
 264
 265 endef
 266
 267 define Package/iptables-mod-led
 268 $(call Package/iptables/Module, +kmod-ipt-led)
 269   TITLE:=LED trigger iptables extension
 270 endef
 271
 272 define Package/iptables-mod-led/description
 273 iptables extension for triggering a LED.
 274
 275  Targets:
 276   - LED
 277
 278 endef
 279
 280 define Package/iptables-mod-tproxy
 281 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 282   TITLE:=Transparent proxy iptables extensions
 283 endef
 284
 285 define Package/iptables-mod-tproxy/description
 286 Transparent proxy iptables extensions.
 287
 288  Matches:
 289   - socket
 290
 291  Targets:
 292   - TPROXY
 293
 294 endef
 295
 296 define Package/iptables-mod-tee
 297 $(call Package/iptables/Module, +kmod-ipt-tee)
 298   TITLE:=TEE iptables extensions
 299 endef
 300
 301 define Package/iptables-mod-tee/description
 302 TEE iptables extensions.
 303
 304  Targets:
 305   - TEE
 306
 307 endef
 308
 309 define Package/iptables-mod-u32
 310 $(call Package/iptables/Module, +kmod-ipt-u32)
 311   TITLE:=U32 iptables extensions
 312 endef
 313
 314 define Package/iptables-mod-u32/description
 315 U32 iptables extensions.
 316
 317  Matches:
 318   - u32
 319
 320 endef
 321
 322 define Package/ip6tables
 323 $(call Package/iptables/Default)
 324   DEPENDS:=@IPV6 +kmod-ip6tables +iptables
 325   CATEGORY:=Network
 326   TITLE:=IPv6 firewall administration tool
 327   MENU:=1
 328 endef
 329
 330
 331 define Package/ip6tables-extra
 332 $(call Package/iptables/Default)
 333   DEPENDS:=ip6tables +kmod-ip6tables-extra
 334   TITLE:=IPv6 header matching modules
 335 endef
 336
 337 define Package/ip6tables-mod-extra/description
 338 iptables header matching modules for IPv6
 339 endef
 340
 341 define Package/ip6tables-mod-nat
 342 $(call Package/iptables/Default)
 343   DEPENDS:=ip6tables +kmod-ipt-nat6
 344   TITLE:=IPv6 NAT extensions
 345 endef
 346
 347 define Package/ip6tables-mod-nat/description
 348 iptables extensions for IPv6-NAT targets.
 349 endef
 350
 351 define Package/libiptc
 352 $(call Package/iptables/Default)
 353   SECTION:=libs
 354   CATEGORY:=Libraries
 355   DEPENDS:=+libip4tc +IPV6:libip6tc
 356   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 357 endef
 358
 359 define Package/libip4tc
 360 $(call Package/iptables/Default)
 361   SECTION:=libs
 362   CATEGORY:=Libraries
 363   TITLE:=IPv4 firewall - shared libiptc library
 364 endef
 365
 366 define Package/libip6tc
 367 $(call Package/iptables/Default)
 368   SECTION:=libs
 369   CATEGORY:=Libraries
 370   TITLE:=IPv6 firewall - shared libiptc library
 371 endef
 372
 373 define Package/libxtables
 374  $(call Package/iptables/Default)
 375  SECTION:=libs
 376  CATEGORY:=Libraries
 377  TITLE:=IPv4/IPv6 firewall - shared xtables library
 378 endef
 379
 380 TARGET_CPPFLAGS := \
 381         -I$(PKG_BUILD_DIR)/include \
 382         -I$(LINUX_DIR)/user_headers/include \
 383         $(TARGET_CPPFLAGS)
 384
 385 TARGET_CFLAGS += \
 386         -I$(PKG_BUILD_DIR)/include \
 387         -I$(LINUX_DIR)/user_headers/include \
 388         -ffunction-sections -fdata-sections
 389
 390 TARGET_LDFLAGS += \
 391         -Wl,--gc-sections
 392
 393 CONFIGURE_ARGS += \
 394         --enable-shared \
 395         --enable-devel \
 396         --with-kernel="$(LINUX_DIR)/user_headers" \
 397         --with-xtlibdir=/usr/lib/iptables \
 398         --enable-static \
 399         $(if $(CONFIG_IPV6),,--disable-ipv6)
 400
 401 MAKE_FLAGS := \
 402         $(TARGET_CONFIGURE_OPTS) \
 403         COPT_FLAGS="$(TARGET_CFLAGS)" \
 404         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 405         KBUILD_OUTPUT="$(LINUX_DIR)" \
 406         BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
 407
 408 define Build/InstallDev
 409         $(INSTALL_DIR) $(1)/usr/include
 410         $(INSTALL_DIR) $(1)/usr/include/iptables
 411         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 412
 413         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 414         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 415         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 416         $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
 417         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 418         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 419
 420         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 421         $(INSTALL_DIR) $(1)/usr/lib
 422         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 423         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 424         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 425         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 426         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
 427
 428         # XXX: needed by firewall3
 429         $(INSTALL_DIR) $(1)/usr/lib/iptables
 430         $(CP) $(PKG_BUILD_DIR)/extensions/libext*.a $(1)/usr/lib/iptables/
 431 endef
 432
 433 define Package/iptables/install
 434         $(INSTALL_DIR) $(1)/usr/sbin
 435         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
 436         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
 437         $(INSTALL_DIR) $(1)/usr/lib/iptables
 438 endef
 439
 440 define Package/ip6tables/install
 441         $(INSTALL_DIR) $(1)/usr/sbin
 442         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
 443 endef
 444
 445 define Package/libiptc/install
 446         $(INSTALL_DIR) $(1)/usr/lib
 447         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 448 endef
 449
 450 define Package/libip4tc/install
 451         $(INSTALL_DIR) $(1)/usr/lib
 452         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 453 endef
 454
 455 define Package/libip6tc/install
 456         $(INSTALL_DIR) $(1)/usr/lib
 457         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 458 endef
 459
 460 define Package/libxtables/install
 461         $(INSTALL_DIR) $(1)/usr/lib
 462         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 463 endef
 464
 465 define BuildPlugin
 466   define Package/$(1)/install
 467         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 468         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
 469                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 470                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 471                 fi; \
 472         done
 473         $(3)
 474   endef
 475
 476   $$(eval $$(call BuildPackage,$(1)))
 477 endef
 478
 479 L7_INSTALL:=\
 480         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 481         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 482
 483
 484 $(eval $(call BuildPackage,iptables))
 485 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 486 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 487 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 488 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 489 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 490 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 491 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 492 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 493 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 494 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 495 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 496 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 497 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 498 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
 499 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
 500 $(eval $(call BuildPackage,ip6tables))
 501 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
 502 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
 503 $(eval $(call BuildPackage,libiptc))
 504 $(eval $(call BuildPackage,libip4tc))
 505 $(eval $(call BuildPackage,libip6tc))
 506 $(eval $(call BuildPackage,libxtables))