package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.18
  13 PKG_RELEASE:=3
  14
  15 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  16 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  17         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  18         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  20 PKG_MD5SUM:=a819199d5ec013b82da13a8ffbba857e
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IP firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IP firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - limit
  66   - mac
  67   - multiport
  68
  69  Targets:
  70   - ACCEPT
  71   - DROP
  72   - REJECT
  73   - LOG
  74   - TCPMSS
  75
  76  Tables:
  77   - filter
  78   - mangle
  79
  80 endef
  81
  82 define Package/iptables-mod-conntrack-extra
  83 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  84   TITLE:=Extra connection tracking extensions
  85 endef
  86
  87 define Package/iptables-mod-conntrack-extra/description
  88 Extra iptables extensions for connection tracking.
  89
  90  Matches:
  91   - connbytes
  92   - connmark
  93   - recent
  94   - helper
  95
  96  Targets:
  97   - CONNMARK
  98
  99 endef
 100
 101 define Package/iptables-mod-filter
 102 $(call Package/iptables/Module, +kmod-ipt-filter)
 103   TITLE:=Content inspection extensions
 104 endef
 105
 106 define Package/iptables-mod-filter/description
 107 iptables extensions for packet content inspection.
 108 Includes support for:
 109
 110  Matches:
 111   - layer7
 112   - string
 113
 114 endef
 115
 116 define Package/iptables-mod-ipopt
 117 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 118   TITLE:=IP/Packet option extensions
 119 endef
 120
 121 define Package/iptables-mod-ipopt/description
 122 iptables extensions for matching/changing IP packet options.
 123
 124  Matches:
 125   - dscp
 126   - ecn
 127   - length
 128   - mark
 129   - statistic
 130   - tcpmss
 131   - time
 132   - unclean
 133   - hl
 134
 135  Targets:
 136   - DSCP
 137   - CLASSIFY
 138   - ECN
 139   - MARK
 140   - HL
 141
 142 endef
 143
 144 define Package/iptables-mod-ipsec
 145 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 146   TITLE:=IPsec extensions
 147 endef
 148
 149 define Package/iptables-mod-ipsec/description
 150 iptables extensions for matching ipsec traffic.
 151
 152  Matches:
 153   - ah
 154   - esp
 155   - policy
 156
 157 endef
 158
 159 define Package/iptables-mod-ipset
 160 $(call Package/iptables/Module,)
 161   TITLE:=IPset iptables extensions
 162 endef
 163
 164 define Package/iptables-mod-ipset/description
 165 IPset iptables extensions.
 166
 167  Matches:
 168   - set
 169
 170  Targets:
 171   - SET
 172
 173 endef
 174
 175 define Package/iptables-mod-nat-extra
 176 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 177   TITLE:=Extra NAT extensions
 178 endef
 179
 180 define Package/iptables-mod-nat-extra/description
 181 iptables extensions for extra NAT targets.
 182
 183  Targets:
 184   - MIRROR
 185   - NETMAP
 186   - REDIRECT
 187 endef
 188
 189 define Package/iptables-mod-ulog
 190 $(call Package/iptables/Module, +kmod-ipt-ulog)
 191   TITLE:=user-space packet logging
 192 endef
 193
 194 define Package/iptables-mod-ulog/description
 195 iptables extensions for user-space packet logging.
 196
 197  Targets:
 198   - ULOG
 199
 200 endef
 201
 202 define Package/iptables-mod-hashlimit
 203 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 204   TITLE:=hashlimit matching
 205 endef
 206
 207 define Package/iptables-mod-hashlimit/description
 208 iptables extensions for hashlimit matching
 209
 210  Matches:
 211   - hashlimit
 212
 213 endef
 214
 215 define Package/iptables-mod-iprange
 216 $(call Package/iptables/Module, +kmod-ipt-iprange)
 217   TITLE:=IP range extension
 218 endef
 219
 220 define Package/iptables-mod-iprange/description
 221 iptables extensions for matching ip ranges.
 222
 223  Matches:
 224   - iprange
 225
 226 endef
 227
 228 define Package/iptables-mod-extra
 229 $(call Package/iptables/Module, +kmod-ipt-extra)
 230   TITLE:=Other extra iptables extensions
 231 endef
 232
 233 define Package/iptables-mod-extra/description
 234 Other extra iptables extensions.
 235
 236  Matches:
 237   - addrtype
 238   - condition
 239   - owner
 240   - physdev (if ebtables is enabled)
 241   - pkttype
 242   - quota
 243
 244 endef
 245
 246 define Package/iptables-mod-led
 247 $(call Package/iptables/Module, +kmod-ipt-led)
 248   TITLE:=LED trigger iptables extension
 249 endef
 250
 251 define Package/iptables-mod-led/description
 252 iptables extension for triggering a LED.
 253
 254  Targets:
 255   - LED
 256
 257 endef
 258
 259 define Package/iptables-mod-tproxy
 260 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 261   TITLE:=Transparent proxy iptables extensions
 262 endef
 263
 264 define Package/iptables-mod-tproxy/description
 265 Transparent proxy iptables extensions.
 266
 267  Matches:
 268   - socket
 269
 270  Targets:
 271   - TPROXY
 272
 273 endef
 274
 275 define Package/iptables-mod-tee
 276 $(call Package/iptables/Module, +kmod-ipt-tee)
 277   TITLE:=TEE iptables extensions
 278 endef
 279
 280 define Package/iptables-mod-tee/description
 281 TEE iptables extensions.
 282
 283  Targets:
 284   - TEE
 285
 286 endef
 287
 288 define Package/iptables-mod-u32
 289 $(call Package/iptables/Module, +kmod-ipt-u32)
 290   TITLE:=U32 iptables extensions
 291 endef
 292
 293 define Package/iptables-mod-u32/description
 294 U32 iptables extensions.
 295
 296  Matches:
 297   - u32
 298
 299 endef
 300
 301 define Package/ip6tables
 302 $(call Package/iptables/Default)
 303   DEPENDS:=@IPV6 +kmod-ip6tables +iptables
 304   CATEGORY:=IPv6
 305   TITLE:=IPv6 firewall administration tool
 306   MENU:=1
 307 endef
 308
 309 define Package/libiptc
 310 $(call Package/iptables/Default)
 311   SECTION:=libs
 312   CATEGORY:=Libraries
 313   DEPENDS:=+libip4tc +libip6tc
 314   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 315 endef
 316
 317 define Package/libip4tc
 318 $(call Package/iptables/Default)
 319   SECTION:=libs
 320   CATEGORY:=Libraries
 321   TITLE:=IPv4 firewall - shared libiptc library
 322 endef
 323
 324 define Package/libip6tc
 325 $(call Package/iptables/Default)
 326   SECTION:=libs
 327   CATEGORY:=Libraries
 328   TITLE:=IPv6 firewall - shared libiptc library
 329 endef
 330
 331 define Package/libxtables
 332  $(call Package/iptables/Default)
 333  SECTION:=libs
 334  CATEGORY:=Libraries
 335  TITLE:=IPv4/IPv6 firewall - shared xtables library
 336 endef
 337
 338 TARGET_CPPFLAGS := \
 339         -I$(PKG_BUILD_DIR)/include \
 340         -I$(LINUX_DIR)/user_headers/include \
 341         $(TARGET_CPPFLAGS)
 342
 343 TARGET_CFLAGS += \
 344         -I$(PKG_BUILD_DIR)/include \
 345         -I$(LINUX_DIR)/user_headers/include
 346
 347 CONFIGURE_ARGS += \
 348         --enable-shared \
 349         --enable-devel \
 350         --with-kernel="$(LINUX_DIR)/user_headers" \
 351         --with-xtlibdir=/usr/lib/iptables \
 352         --enable-static
 353
 354 MAKE_FLAGS := \
 355         $(TARGET_CONFIGURE_OPTS) \
 356         COPT_FLAGS="$(TARGET_CFLAGS)" \
 357         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 358         KBUILD_OUTPUT="$(LINUX_DIR)" \
 359         BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
 360
 361 define Build/InstallDev
 362         $(INSTALL_DIR) $(1)/usr/include
 363         $(INSTALL_DIR) $(1)/usr/include/iptables
 364         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 365
 366         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 367         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 368         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 369         $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
 370         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 371         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 372
 373         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 374         $(INSTALL_DIR) $(1)/usr/lib
 375         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 376         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 377         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 378         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 379         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
 380 endef
 381
 382 define Package/iptables/install
 383         $(INSTALL_DIR) $(1)/usr/sbin
 384         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
 385         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
 386         $(INSTALL_DIR) $(1)/usr/lib/iptables
 387 endef
 388
 389 define Package/ip6tables/install
 390         $(INSTALL_DIR) $(1)/usr/sbin
 391         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
 392 endef
 393
 394 define Package/libiptc/install
 395         $(INSTALL_DIR) $(1)/usr/lib
 396         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 397 endef
 398
 399 define Package/libip4tc/install
 400         $(INSTALL_DIR) $(1)/usr/lib
 401         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 402 endef
 403
 404 define Package/libip6tc/install
 405         $(INSTALL_DIR) $(1)/usr/lib
 406         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 407 endef
 408
 409 define Package/libxtables/install
 410         $(INSTALL_DIR) $(1)/usr/lib
 411         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 412 endef
 413
 414 define BuildPlugin
 415   define Package/$(1)/install
 416         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 417         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
 418                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 419                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 420                 fi; \
 421         done
 422         $(3)
 423   endef
 424
 425   $$(eval $$(call BuildPackage,$(1)))
 426 endef
 427
 428 L7_INSTALL:=\
 429         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 430         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 431
 432
 433 $(eval $(call BuildPackage,iptables))
 434 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 435 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 436 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 437 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 438 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 439 $(eval $(call BuildPlugin,iptables-mod-ipset,ipt_set ipt_SET))
 440 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 441 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 442 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 443 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 444 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 445 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 446 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 447 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 448 $(eval $(call BuildPackage,ip6tables))
 449 $(eval $(call BuildPackage,libiptc))
 450 $(eval $(call BuildPackage,libip4tc))
 451 $(eval $(call BuildPackage,libip6tc))
 452 $(eval $(call BuildPackage,libxtables))