package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.21
  13 PKG_RELEASE:=1
  14
  15 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  16 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  17         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  18         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  20 PKG_MD5SUM:=536d048c8e8eeebcd9757d0863ebb0c0
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25 PKG_LICENSE:=GPL-2.0
  26
  27 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  28 PATCH_DIR:=
  29 endif
  30
  31 include $(INCLUDE_DIR)/package.mk
  32 ifeq ($(DUMP),)
  33   -include $(LINUX_DIR)/.config
  34   include $(INCLUDE_DIR)/netfilter.mk
  35   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  36 endif
  37
  38
  39 define Package/iptables/Default
  40   SECTION:=net
  41   CATEGORY:=Network
  42   SUBMENU:=Firewall
  43   URL:=http://netfilter.org/
  44 endef
  45
  46 define Package/iptables/Module
  47 $(call Package/iptables/Default)
  48   DEPENDS:=iptables $(1)
  49 endef
  50
  51 define Package/iptables
  52 $(call Package/iptables/Default)
  53   TITLE:=IP firewall administration tool
  54   MENU:=1
  55   DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
  56 endef
  57
  58 define Package/iptables/description
  59 IP firewall administration tool.
  60
  61  Matches:
  62   - icmp
  63   - tcp
  64   - udp
  65   - comment
  66   - conntrack
  67   - limit
  68   - mac
  69   - mark
  70   - multiport
  71   - set
  72   - state
  73   - time
  74
  75  Targets:
  76   - ACCEPT
  77   - CT
  78   - DNAT
  79   - DROP
  80   - REJECT
  81   - LOG
  82   - MARK
  83   - MASQUERADE
  84   - REDIRECT
  85   - SET
  86   - SNAT
  87   - TCPMSS
  88
  89  Tables:
  90   - filter
  91   - mangle
  92   - nat
  93   - raw
  94
  95 endef
  96
  97 define Package/iptables-mod-conntrack-extra
  98 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  99   TITLE:=Extra connection tracking extensions
 100 endef
 101
 102 define Package/iptables-mod-conntrack-extra/description
 103 Extra iptables extensions for connection tracking.
 104
 105  Matches:
 106   - connbytes
 107   - connlimit
 108   - connmark
 109   - recent
 110   - helper
 111
 112  Targets:
 113   - CONNMARK
 114
 115 endef
 116
 117 define Package/iptables-mod-filter
 118 $(call Package/iptables/Module, +kmod-ipt-filter)
 119   TITLE:=Content inspection extensions
 120 endef
 121
 122 define Package/iptables-mod-filter/description
 123 iptables extensions for packet content inspection.
 124 Includes support for:
 125
 126  Matches:
 127   - layer7
 128   - string
 129
 130 endef
 131
 132 define Package/iptables-mod-ipopt
 133 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 134   TITLE:=IP/Packet option extensions
 135 endef
 136
 137 define Package/iptables-mod-ipopt/description
 138 iptables extensions for matching/changing IP packet options.
 139
 140  Matches:
 141   - dscp
 142   - ecn
 143   - length
 144   - statistic
 145   - tcpmss
 146   - unclean
 147   - hl
 148
 149  Targets:
 150   - DSCP
 151   - CLASSIFY
 152   - ECN
 153   - HL
 154
 155 endef
 156
 157 define Package/iptables-mod-ipsec
 158 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 159   TITLE:=IPsec extensions
 160 endef
 161
 162 define Package/iptables-mod-ipsec/description
 163 iptables extensions for matching ipsec traffic.
 164
 165  Matches:
 166   - ah
 167   - esp
 168   - policy
 169
 170 endef
 171
 172 define Package/iptables-mod-nat-extra
 173 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 174   TITLE:=Extra NAT extensions
 175 endef
 176
 177 define Package/iptables-mod-nat-extra/description
 178 iptables extensions for extra NAT targets.
 179
 180  Targets:
 181   - MIRROR
 182   - NETMAP
 183 endef
 184
 185 define Package/iptables-mod-ulog
 186 $(call Package/iptables/Module, +kmod-ipt-ulog)
 187   TITLE:=user-space packet logging
 188 endef
 189
 190 define Package/iptables-mod-ulog/description
 191 iptables extensions for user-space packet logging.
 192
 193  Targets:
 194   - ULOG
 195
 196 endef
 197
 198 define Package/iptables-mod-nflog
 199 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
 200   TITLE:=Netfilter NFLOG target
 201 endef
 202
 203 define Package/iptables-mod-nflog/description
 204  iptables extension for user-space logging via NFNETLINK.
 205
 206  Includes:
 207   - libxt_NFLOG
 208
 209 endef
 210
 211 define Package/iptables-mod-nfqueue
 212 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
 213   TITLE:=Netfilter NFQUEUE target
 214 endef
 215
 216 define Package/iptables-mod-nfqueue/description
 217  iptables extension for user-space queuing via NFNETLINK.
 218
 219  Includes:
 220   - libxt_NFQUEUE
 221
 222 endef
 223
 224 define Package/iptables-mod-hashlimit
 225 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 226   TITLE:=hashlimit matching
 227 endef
 228
 229 define Package/iptables-mod-hashlimit/description
 230 iptables extensions for hashlimit matching
 231
 232  Matches:
 233   - hashlimit
 234
 235 endef
 236
 237 define Package/iptables-mod-iprange
 238 $(call Package/iptables/Module, +kmod-ipt-iprange)
 239   TITLE:=IP range extension
 240 endef
 241
 242 define Package/iptables-mod-iprange/description
 243 iptables extensions for matching ip ranges.
 244
 245  Matches:
 246   - iprange
 247
 248 endef
 249
 250 define Package/iptables-mod-extra
 251 $(call Package/iptables/Module, +kmod-ipt-extra)
 252   TITLE:=Other extra iptables extensions
 253 endef
 254
 255 define Package/iptables-mod-extra/description
 256 Other extra iptables extensions.
 257
 258  Matches:
 259   - addrtype
 260   - condition
 261   - owner
 262   - physdev (if ebtables is enabled)
 263   - pkttype
 264   - quota
 265
 266 endef
 267
 268 define Package/iptables-mod-led
 269 $(call Package/iptables/Module, +kmod-ipt-led)
 270   TITLE:=LED trigger iptables extension
 271 endef
 272
 273 define Package/iptables-mod-led/description
 274 iptables extension for triggering a LED.
 275
 276  Targets:
 277   - LED
 278
 279 endef
 280
 281 define Package/iptables-mod-tproxy
 282 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 283   TITLE:=Transparent proxy iptables extensions
 284 endef
 285
 286 define Package/iptables-mod-tproxy/description
 287 Transparent proxy iptables extensions.
 288
 289  Matches:
 290   - socket
 291
 292  Targets:
 293   - TPROXY
 294
 295 endef
 296
 297 define Package/iptables-mod-tee
 298 $(call Package/iptables/Module, +kmod-ipt-tee)
 299   TITLE:=TEE iptables extensions
 300 endef
 301
 302 define Package/iptables-mod-tee/description
 303 TEE iptables extensions.
 304
 305  Targets:
 306   - TEE
 307
 308 endef
 309
 310 define Package/iptables-mod-u32
 311 $(call Package/iptables/Module, +kmod-ipt-u32)
 312   TITLE:=U32 iptables extensions
 313 endef
 314
 315 define Package/iptables-mod-u32/description
 316 U32 iptables extensions.
 317
 318  Matches:
 319   - u32
 320
 321 endef
 322
 323 define Package/ip6tables
 324 $(call Package/iptables/Default)
 325   DEPENDS:=@IPV6 +kmod-ip6tables +iptables
 326   CATEGORY:=Network
 327   TITLE:=IPv6 firewall administration tool
 328   MENU:=1
 329 endef
 330
 331
 332 define Package/ip6tables-extra
 333 $(call Package/iptables/Default)
 334   DEPENDS:=ip6tables +kmod-ip6tables-extra
 335   TITLE:=IPv6 header matching modules
 336 endef
 337
 338 define Package/ip6tables-mod-extra/description
 339 iptables header matching modules for IPv6
 340 endef
 341
 342 define Package/ip6tables-mod-nat
 343 $(call Package/iptables/Default)
 344   DEPENDS:=ip6tables +kmod-ipt-nat6
 345   TITLE:=IPv6 NAT extensions
 346 endef
 347
 348 define Package/ip6tables-mod-nat/description
 349 iptables extensions for IPv6-NAT targets.
 350 endef
 351
 352 define Package/libiptc
 353 $(call Package/iptables/Default)
 354   SECTION:=libs
 355   CATEGORY:=Libraries
 356   DEPENDS:=+libip4tc +IPV6:libip6tc
 357   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 358 endef
 359
 360 define Package/libip4tc
 361 $(call Package/iptables/Default)
 362   SECTION:=libs
 363   CATEGORY:=Libraries
 364   TITLE:=IPv4 firewall - shared libiptc library
 365 endef
 366
 367 define Package/libip6tc
 368 $(call Package/iptables/Default)
 369   SECTION:=libs
 370   CATEGORY:=Libraries
 371   TITLE:=IPv6 firewall - shared libiptc library
 372 endef
 373
 374 define Package/libxtables
 375  $(call Package/iptables/Default)
 376  SECTION:=libs
 377  CATEGORY:=Libraries
 378  TITLE:=IPv4/IPv6 firewall - shared xtables library
 379 endef
 380
 381 TARGET_CPPFLAGS := \
 382         -I$(PKG_BUILD_DIR)/include \
 383         -I$(LINUX_DIR)/user_headers/include \
 384         $(TARGET_CPPFLAGS)
 385
 386 TARGET_CFLAGS += \
 387         -I$(PKG_BUILD_DIR)/include \
 388         -I$(LINUX_DIR)/user_headers/include \
 389         -ffunction-sections -fdata-sections
 390
 391 TARGET_LDFLAGS += \
 392         -Wl,--gc-sections
 393
 394 CONFIGURE_ARGS += \
 395         --enable-shared \
 396         --enable-devel \
 397         --with-kernel="$(LINUX_DIR)/user_headers" \
 398         --with-xtlibdir=/usr/lib/iptables \
 399         --enable-static \
 400         $(if $(CONFIG_IPV6),,--disable-ipv6)
 401
 402 MAKE_FLAGS := \
 403         $(TARGET_CONFIGURE_OPTS) \
 404         COPT_FLAGS="$(TARGET_CFLAGS)" \
 405         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 406         KBUILD_OUTPUT="$(LINUX_DIR)" \
 407         BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
 408
 409 define Build/InstallDev
 410         $(INSTALL_DIR) $(1)/usr/include
 411         $(INSTALL_DIR) $(1)/usr/include/iptables
 412         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 413
 414         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 415         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 416         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 417         $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
 418         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 419         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 420
 421         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 422         $(INSTALL_DIR) $(1)/usr/lib
 423         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 424         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 425         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 426         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 427         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
 428
 429         # XXX: needed by firewall3
 430         $(INSTALL_DIR) $(1)/usr/lib/iptables
 431         $(CP) $(PKG_BUILD_DIR)/extensions/libext*.a $(1)/usr/lib/iptables/
 432 endef
 433
 434 define Package/iptables/install
 435         $(INSTALL_DIR) $(1)/usr/sbin
 436         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
 437         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
 438         $(INSTALL_DIR) $(1)/usr/lib/iptables
 439 endef
 440
 441 define Package/ip6tables/install
 442         $(INSTALL_DIR) $(1)/usr/sbin
 443         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
 444 endef
 445
 446 define Package/libiptc/install
 447         $(INSTALL_DIR) $(1)/usr/lib
 448         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 449 endef
 450
 451 define Package/libip4tc/install
 452         $(INSTALL_DIR) $(1)/usr/lib
 453         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 454 endef
 455
 456 define Package/libip6tc/install
 457         $(INSTALL_DIR) $(1)/usr/lib
 458         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 459 endef
 460
 461 define Package/libxtables/install
 462         $(INSTALL_DIR) $(1)/usr/lib
 463         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 464 endef
 465
 466 define BuildPlugin
 467   define Package/$(1)/install
 468         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 469         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
 470                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 471                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 472                 fi; \
 473         done
 474         $(3)
 475   endef
 476
 477   $$(eval $$(call BuildPackage,$(1)))
 478 endef
 479
 480 L7_INSTALL:=\
 481         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 482         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 483
 484
 485 $(eval $(call BuildPackage,iptables))
 486 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 487 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 488 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 489 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 490 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 491 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 492 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 493 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 494 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 495 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 496 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 497 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 498 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 499 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
 500 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
 501 $(eval $(call BuildPackage,ip6tables))
 502 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
 503 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
 504 $(eval $(call BuildPackage,libiptc))
 505 $(eval $(call BuildPackage,libip4tc))
 506 $(eval $(call BuildPackage,libip6tc))
 507 $(eval $(call BuildPackage,libxtables))