package/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2011 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.10
  13 PKG_RELEASE:=4
  14
  15 PKG_MD5SUM:=f382fe693f0b59d87bd47bea65eca198
  16 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  17 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  18         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  20         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IPv4 firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IPv4 firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - limit
  66   - mac
  67   - multiport
  68
  69  Targets:
  70   - ACCEPT
  71   - DROP
  72   - REJECT
  73   - LOG
  74   - TCPMSS
  75
  76  Tables:
  77   - filter
  78   - mangle
  79
  80 endef
  81
  82 define Package/iptables-mod-conntrack
  83 $(call Package/iptables/Module, +kmod-ipt-conntrack)
  84   TITLE:=Basic connection tracking extensions
  85 endef
  86
  87 define Package/iptables-mod-conntrack/description
  88 Basic iptables extensions for connection tracking.
  89
  90  Matches:
  91   - state
  92   - conntrack
  93
  94  Targets:
  95   - NOTRACK
  96
  97  Tables:
  98   - raw
  99
 100 endef
 101
 102 define Package/iptables-mod-conntrack-extra
 103 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
 104   TITLE:=Extra connection tracking extensions
 105 endef
 106
 107 define Package/iptables-mod-conntrack-extra/description
 108 Extra iptables extensions for connection tracking.
 109
 110  Matches:
 111   - connbytes
 112   - connmark
 113   - recent
 114   - helper
 115
 116  Targets:
 117   - CONNMARK
 118
 119 endef
 120
 121 define Package/iptables-mod-filter
 122 $(call Package/iptables/Module, +kmod-ipt-filter)
 123   TITLE:=Content inspection extensions
 124 endef
 125
 126 define Package/iptables-mod-filter/description
 127 iptables extensions for packet content inspection.
 128 Includes support for:
 129
 130  Matches:
 131   - layer7
 132   - string
 133
 134 endef
 135
 136 define Package/iptables-mod-ipopt
 137 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 138   TITLE:=IP/Packet option extensions
 139 endef
 140
 141 define Package/iptables-mod-ipopt/description
 142 iptables extensions for matching/changing IP packet options.
 143
 144  Matches:
 145   - dscp
 146   - hashlimit
 147   - ecn
 148   - length
 149   - mark
 150   - statistic
 151   - tcpmss
 152   - time
 153   - unclean
 154   - hl
 155
 156  Targets:
 157   - DSCP
 158   - CLASSIFY
 159   - ECN
 160   - MARK
 161   - HL
 162
 163 endef
 164
 165 define Package/iptables-mod-ipsec
 166 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 167   TITLE:=IPsec extensions
 168 endef
 169
 170 define Package/iptables-mod-ipsec/description
 171 iptables extensions for matching ipsec traffic.
 172
 173  Matches:
 174   - ah
 175   - esp
 176   - policy
 177
 178 endef
 179
 180 define Package/iptables-mod-ipset
 181 $(call Package/iptables/Module,)
 182   TITLE:=IPset iptables extensions
 183 endef
 184
 185 define Package/iptables-mod-ipset/description
 186 IPset iptables extensions.
 187
 188  Matches:
 189   - set
 190
 191  Targets:
 192   - SET
 193
 194 endef
 195
 196 define Package/iptables-mod-nat
 197 $(call Package/iptables/Module, +kmod-ipt-nat)
 198   TITLE:=Basic NAT extensions
 199 endef
 200
 201 define Package/iptables-mod-nat/description
 202 iptables extensions for basic NAT targets.
 203
 204  Targets:
 205   - SNAT
 206   - DNAT
 207   - MASQUERADE
 208
 209  Tables:
 210   - nat
 211
 212 endef
 213
 214 define Package/iptables-mod-nat-extra
 215 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 216   TITLE:=Extra NAT extensions
 217 endef
 218
 219 define Package/iptables-mod-nat-extra/description
 220 iptables extensions for extra NAT targets.
 221
 222  Targets:
 223   - MIRROR
 224   - NETMAP
 225   - REDIRECT
 226 endef
 227
 228 define Package/iptables-mod-ulog
 229 $(call Package/iptables/Module, +kmod-ipt-ulog)
 230   TITLE:=user-space packet logging
 231 endef
 232
 233 define Package/iptables-mod-ulog/description
 234 iptables extensions for user-space packet logging.
 235
 236  Targets:
 237   - ULOG
 238
 239 endef
 240
 241 define Package/iptables-mod-hashlimit
 242 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 243   TITLE:=hashlimit matching
 244 endef
 245
 246 define Package/iptables-mod-hashlimit/description
 247 iptables extensions for hashlimit matching
 248
 249  Matches:
 250   - hashlimit
 251
 252 endef
 253
 254 define Package/iptables-mod-iprange
 255 $(call Package/iptables/Module, +kmod-ipt-iprange)
 256   TITLE:=IP range extension
 257 endef
 258
 259 define Package/iptables-mod-iprange/description
 260 iptables extensions for matching ip ranges.
 261
 262  Matches:
 263   - iprange
 264
 265 endef
 266
 267 define Package/iptables-mod-extra
 268 $(call Package/iptables/Module, +kmod-ipt-extra)
 269   TITLE:=Other extra iptables extensions
 270 endef
 271
 272 define Package/iptables-mod-extra/description
 273 Other extra iptables extensions.
 274
 275  Matches:
 276   - condition
 277   - owner
 278   - physdev (if ebtables is enabled)
 279   - pkttype
 280   - quota
 281
 282 endef
 283
 284 define Package/iptables-mod-led
 285 $(call Package/iptables/Module, +kmod-ipt-led)
 286   TITLE:=LED trigger iptables extension
 287 endef
 288
 289 define Package/iptables-mod-led/description
 290 iptables extension for triggering a LED.
 291
 292  Targets:
 293   - LED
 294
 295 endef
 296
 297 define Package/iptables-mod-tproxy
 298 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 299   TITLE:=Transparent proxy iptables extensions
 300 endef
 301
 302 define Package/iptables-mod-tproxy/description
 303 Transparent proxy iptables extensions.
 304
 305  Matches:
 306   - socket
 307
 308  Targets:
 309   - TPROXY
 310
 311 endef
 312
 313 define Package/iptables-mod-tee
 314 $(call Package/iptables/Module, +kmod-ipt-tee)
 315   TITLE:=TEE iptables extensions
 316 endef
 317
 318 define Package/iptables-mod-tee/description
 319 TEE iptables extensions.
 320
 321  Targets:
 322   - TEE
 323
 324 endef
 325
 326 define Package/iptables-mod-u32
 327 $(call Package/iptables/Module, +kmod-ipt-u32)
 328   TITLE:=U32 iptables extensions
 329 endef
 330
 331 define Package/iptables-mod-u32/description
 332 U32 iptables extensions.
 333
 334  Matches:
 335   - u32
 336
 337 endef
 338
 339 define Package/ip6tables
 340 $(call Package/iptables/Default)
 341   DEPENDS:=+kmod-ip6tables +libip6tc +libxtables
 342   CATEGORY:=IPv6
 343   TITLE:=IPv6 firewall administration tool
 344   MENU:=1
 345 endef
 346
 347 define Package/libiptc
 348 $(call Package/iptables/Default)
 349   SECTION:=libs
 350   CATEGORY:=Libraries
 351   DEPENDS:=+libip4tc +libip6tc
 352   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 353 endef
 354
 355 define Package/libip4tc
 356 $(call Package/iptables/Default)
 357   SECTION:=libs
 358   CATEGORY:=Libraries
 359   TITLE:=IPv4 firewall - shared libiptc library
 360 endef
 361
 362 define Package/libip6tc
 363 $(call Package/iptables/Default)
 364   SECTION:=libs
 365   CATEGORY:=Libraries
 366   TITLE:=IPv6 firewall - shared libiptc library
 367 endef
 368
 369 define Package/libxtables
 370  $(call Package/iptables/Default)
 371  SECTION:=libs
 372  CATEGORY:=Libraries
 373  TITLE:=IPv4/IPv6 firewall - shared xtables library
 374 endef
 375
 376 define Package/libipq
 377   $(call Package/iptables/Default)
 378   SECTION:=libs
 379   CATEGORY:=Libraries
 380   TITLE:=IPv4/IPv6 firewall - shared libipq library
 381 endef
 382
 383 TARGET_CPPFLAGS := \
 384         -I$(PKG_BUILD_DIR)/include \
 385         -I$(LINUX_DIR)/arch/$(LINUX_KARCH)/include \
 386         $(TARGET_CPPFLAGS)
 387
 388 TARGET_CFLAGS += \
 389         -I$(PKG_BUILD_DIR)/include \
 390         -I$(LINUX_DIR)/arch/$(LINUX_KARCH)/include
 391
 392 CONFIGURE_ARGS += \
 393         --enable-shared \
 394         --enable-devel \
 395         $(if $(CONFIG_IPV6),--enable-ipv6,--disable-ipv6) \
 396         --enable-libipq \
 397         --with-kernel="$(LINUX_DIR)" \
 398         --with-xtlibdir=/usr/lib/iptables
 399
 400 MAKE_FLAGS := \
 401         $(TARGET_CONFIGURE_OPTS) \
 402         COPT_FLAGS="$(TARGET_CFLAGS)" \
 403         LDFLAGS="-rdynamic" \
 404         KERNEL_DIR="$(LINUX_DIR)" PREFIX=/usr \
 405         KBUILD_OUTPUT="$(LINUX_DIR)" \
 406
 407 define Build/InstallDev
 408         $(INSTALL_DIR) $(1)/usr/include
 409         $(INSTALL_DIR) $(1)/usr/include/iptables
 410         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 411
 412         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 413         $(CP) $(PKG_BUILD_DIR)/include/net/netfilter/*.h $(1)/usr/include/net/netfilter/
 414         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 415         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 416         $(CP) $(PKG_BUILD_DIR)/include/libipq/libipq.h $(1)/usr/include/
 417         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 418         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 419
 420         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 421         $(INSTALL_DIR) $(1)/usr/lib
 422         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 423         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 424         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libipq.so* $(1)/usr/lib/
 425         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 426         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 427         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libiptc.pc $(1)/usr/lib/pkgconfig/
 428 endef
 429
 430 define Package/iptables/install
 431         $(INSTALL_DIR) $(1)/usr/sbin
 432         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/iptables $(1)/usr/sbin/
 433         $(LN) iptables $(1)/usr/sbin/iptables-save
 434         $(LN) iptables $(1)/usr/sbin/iptables-restore
 435         $(INSTALL_DIR) $(1)/usr/lib/iptables
 436         (cd $(PKG_INSTALL_DIR)/usr/lib/iptables ; \
 437                 for m in $(patsubst xt_%,ipt_%,$(IPT_BUILTIN)) $(patsubst ipt_%,xt_%,$(IPT_BUILTIN)); do \
 438                         if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$${m}.so ]; then \
 439                                 $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$${m}.so $(1)/usr/lib/iptables/ ;\
 440                         fi; \
 441                 done \
 442         )
 443 endef
 444
 445 define Package/ip6tables/install
 446         $(INSTALL_DIR) $(1)/usr/sbin
 447         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables $(1)/usr/sbin/
 448         $(LN) ip6tables $(1)/usr/sbin/ip6tables-save
 449         $(LN) ip6tables $(1)/usr/sbin/ip6tables-restore
 450         $(INSTALL_DIR) $(1)/usr/lib/iptables
 451         (cd $(PKG_INSTALL_DIR)/usr/lib/iptables ; \
 452                 $(CP) libip6t_*.so $(1)/usr/lib/iptables/ \
 453         )
 454 endef
 455
 456 define Package/libiptc/install
 457         $(INSTALL_DIR) $(1)/usr/lib
 458         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 459 endef
 460
 461 define Package/libip4tc/install
 462         $(INSTALL_DIR) $(1)/usr/lib
 463         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 464 endef
 465
 466 define Package/libip6tc/install
 467         $(INSTALL_DIR) $(1)/usr/lib
 468         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 469 endef
 470
 471 define Package/libxtables/install
 472         $(INSTALL_DIR) $(1)/usr/lib
 473         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 474 endef
 475
 476 define Package/libipq/install
 477         $(INSTALL_DIR) $(1)/usr/lib
 478         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libipq.so* $(1)/usr/lib/
 479 endef
 480
 481 define BuildPlugin
 482   define Package/$(1)/install
 483         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 484         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)); do \
 485                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 486                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 487                 fi; \
 488         done
 489         $(3)
 490   endef
 491
 492   $$(eval $$(call BuildPackage,$(1)))
 493 endef
 494
 495 L7_INSTALL:=\
 496         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 497         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 498
 499
 500 $(eval $(call BuildPackage,iptables))
 501 $(eval $(call BuildPlugin,iptables-mod-conntrack,$(IPT_CONNTRACK-m)))
 502 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 503 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 504 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 505 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 506 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 507 $(eval $(call BuildPlugin,iptables-mod-ipset,ipt_set ipt_SET))
 508 $(eval $(call BuildPlugin,iptables-mod-nat,$(IPT_NAT-m)))
 509 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 510 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 511 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 512 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 513 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 514 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 515 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 516 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 517 $(eval $(call BuildPackage,ip6tables))
 518 $(eval $(call BuildPackage,libiptc))
 519 $(eval $(call BuildPackage,libip4tc))
 520 $(eval $(call BuildPackage,libip6tc))
 521 $(eval $(call BuildPackage,libxtables))
 522 $(eval $(call BuildPackage,libipq))