package/kernel/linux/modules/netfilter.mk

   1
   2 #
   3 # Copyright (C) 2006-2010 OpenWrt.org
   4 #
   5 # This is free software, licensed under the GNU General Public License v2.
   6 # See /LICENSE for more information.
   7 #
   8
   9 NF_MENU:=Netfilter Extensions
  10 NF_KMOD:=1
  11 include $(INCLUDE_DIR)/netfilter.mk
  12
  13
  14 define KernelPackage/nf-ipt
  15   SUBMENU:=$(NF_MENU)
  16   TITLE:=Iptables core
  17   KCONFIG:= \
  18         CONFIG_NETFILTER=y \
  19         CONFIG_NETFILTER_ADVANCED=y \
  20         $(KCONFIG_NF_IPT)
  21   FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
  22   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
  23 endef
  24
  25 $(eval $(call KernelPackage,nf-ipt))
  26
  27
  28 define KernelPackage/nf-ipt6
  29   SUBMENU:=$(NF_MENU)
  30   TITLE:=Ip6tables core
  31   KCONFIG:=$(KCONFIG_NF_IPT6)
  32   FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
  33   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
  34   DEPENDS:=+kmod-nf-ipt +kmod-nf-conntrack6
  35 endef
  36
  37 $(eval $(call KernelPackage,nf-ipt6))
  38
  39
  40
  41 define KernelPackage/ipt-core
  42   SUBMENU:=$(NF_MENU)
  43   TITLE:=Iptables core
  44   KCONFIG:=$(KCONFIG_IPT_CORE)
  45   FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
  46   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
  47   DEPENDS:=+kmod-nf-ipt
  48 endef
  49
  50 define KernelPackage/ipt-core/description
  51  Netfilter core kernel modules
  52  Includes:
  53  - comment
  54  - limit
  55  - LOG
  56  - mac
  57  - multiport
  58  - REJECT
  59  - TCPMSS
  60 endef
  61
  62 $(eval $(call KernelPackage,ipt-core))
  63
  64
  65 define KernelPackage/nf-conntrack
  66   SUBMENU:=$(NF_MENU)
  67   TITLE:=Netfilter connection tracking
  68   KCONFIG:= \
  69         CONFIG_NETFILTER=y \
  70         CONFIG_NETFILTER_ADVANCED=y \
  71         CONFIG_NF_CONNTRACK_ZONES=y \
  72         $(KCONFIG_NF_CONNTRACK)
  73   FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
  74   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
  75 endef
  76
  77 $(eval $(call KernelPackage,nf-conntrack))
  78
  79
  80 define KernelPackage/nf-conntrack6
  81   SUBMENU:=$(NF_MENU)
  82   TITLE:=Netfilter IPv6 connection tracking
  83   KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
  84   DEPENDS:=@IPV6 +kmod-nf-conntrack
  85   FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
  86   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
  87 endef
  88
  89 $(eval $(call KernelPackage,nf-conntrack6))
  90
  91
  92 define KernelPackage/nf-nat
  93   SUBMENU:=$(NF_MENU)
  94   TITLE:=Netfilter NAT
  95   KCONFIG:=$(KCONFIG_NF_NAT)
  96   DEPENDS:=+kmod-nf-conntrack +kmod-nf-ipt
  97   FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
  98   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
  99 endef
 100
 101 $(eval $(call KernelPackage,nf-nat))
 102
 103
 104 define KernelPackage/nf-nat6
 105   SUBMENU:=$(NF_MENU)
 106   TITLE:=Netfilter IPV6-NAT
 107   KCONFIG:=$(KCONFIG_NF_NAT6)
 108   DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-ipt6 +kmod-nf-nat
 109   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 110   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 111 endef
 112
 113 $(eval $(call KernelPackage,nf-nat6))
 114
 115
 116 define AddDepends/ipt
 117   SUBMENU:=$(NF_MENU)
 118   DEPENDS+= +kmod-ipt-core $(1)
 119 endef
 120
 121
 122 define KernelPackage/ipt-conntrack
 123   TITLE:=Basic connection tracking modules
 124   KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
 125   FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
 126   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
 127   $(call AddDepends/ipt,+kmod-nf-conntrack)
 128 endef
 129
 130 define KernelPackage/ipt-conntrack/description
 131  Netfilter (IPv4) kernel modules for connection tracking
 132  Includes:
 133  - conntrack
 134  - defrag
 135  - iptables_raw
 136  - NOTRACK
 137  - state
 138 endef
 139
 140 $(eval $(call KernelPackage,ipt-conntrack))
 141
 142
 143 define KernelPackage/ipt-conntrack-extra
 144   TITLE:=Extra connection tracking modules
 145   KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
 146   FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 147   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
 148   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 149 endef
 150
 151 define KernelPackage/ipt-conntrack-extra/description
 152  Netfilter (IPv4) extra kernel modules for connection tracking
 153  Includes:
 154  - connbytes
 155  - connmark/CONNMARK
 156  - conntrack
 157  - helper
 158  - recent
 159 endef
 160
 161 $(eval $(call KernelPackage,ipt-conntrack-extra))
 162
 163
 164 define KernelPackage/ipt-filter
 165   TITLE:=Modules for packet content inspection
 166   KCONFIG:=$(KCONFIG_IPT_FILTER)
 167   FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
 168   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
 169   $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
 170 endef
 171
 172 define KernelPackage/ipt-filter/description
 173  Netfilter (IPv4) kernel modules for packet content inspection
 174  Includes:
 175  - string
 176 endef
 177
 178 $(eval $(call KernelPackage,ipt-filter))
 179
 180
 181 define KernelPackage/ipt-ipopt
 182   TITLE:=Modules for matching/changing IP packet options
 183   KCONFIG:=$(KCONFIG_IPT_IPOPT)
 184   FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
 185   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
 186   $(call AddDepends/ipt)
 187 endef
 188
 189 define KernelPackage/ipt-ipopt/description
 190  Netfilter (IPv4) modules for matching/changing IP packet options
 191  Includes:
 192  - CLASSIFY
 193  - dscp/DSCP
 194  - ecn/ECN
 195  - hl/HL
 196  - length
 197  - mark/MARK
 198  - statistic
 199  - tcpmss
 200  - time
 201  - ttl/TTL
 202  - unclean
 203 endef
 204
 205 $(eval $(call KernelPackage,ipt-ipopt))
 206
 207
 208 define KernelPackage/ipt-ipsec
 209   TITLE:=Modules for matching IPSec packets
 210   KCONFIG:=$(KCONFIG_IPT_IPSEC)
 211   FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
 212   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
 213   $(call AddDepends/ipt)
 214 endef
 215
 216 define KernelPackage/ipt-ipsec/description
 217  Netfilter (IPv4) modules for matching IPSec packets
 218  Includes:
 219  - ah
 220  - esp
 221  - policy
 222 endef
 223
 224 $(eval $(call KernelPackage,ipt-ipsec))
 225
 226 IPSET_MODULES:= \
 227         ipset/ip_set \
 228         ipset/ip_set_bitmap_ip \
 229         ipset/ip_set_bitmap_ipmac \
 230         ipset/ip_set_bitmap_port \
 231         ipset/ip_set_hash_ip \
 232         ipset/ip_set_hash_ipmark \
 233         ipset/ip_set_hash_ipport \
 234         ipset/ip_set_hash_ipportip \
 235         ipset/ip_set_hash_ipportnet \
 236         ipset/ip_set_hash_mac \
 237         ipset/ip_set_hash_netportnet \
 238         ipset/ip_set_hash_net \
 239         ipset/ip_set_hash_netnet \
 240         ipset/ip_set_hash_netport \
 241         ipset/ip_set_hash_netiface \
 242         ipset/ip_set_list_set \
 243         xt_set
 244
 245 define KernelPackage/ipt-ipset
 246   SUBMENU:=Netfilter Extensions
 247   TITLE:=IPset netfilter modules
 248   DEPENDS+= +kmod-ipt-core +kmod-nfnetlink
 249   KCONFIG:= \
 250         CONFIG_IP_SET \
 251         CONFIG_IP_SET_MAX=256 \
 252         CONFIG_NETFILTER_XT_SET \
 253         CONFIG_IP_SET_BITMAP_IP \
 254         CONFIG_IP_SET_BITMAP_IPMAC \
 255         CONFIG_IP_SET_BITMAP_PORT \
 256         CONFIG_IP_SET_HASH_IP \
 257         CONFIG_IP_SET_HASH_IPMARK \
 258         CONFIG_IP_SET_HASH_IPPORT \
 259         CONFIG_IP_SET_HASH_IPPORTIP \
 260         CONFIG_IP_SET_HASH_IPPORTNET \
 261         CONFIG_IP_SET_HASH_MAC \
 262         CONFIG_IP_SET_HASH_NET \
 263         CONFIG_IP_SET_HASH_NETNET \
 264         CONFIG_IP_SET_HASH_NETIFACE \
 265         CONFIG_IP_SET_HASH_NETPORT \
 266         CONFIG_IP_SET_HASH_NETPORTNET \
 267         CONFIG_IP_SET_LIST_SET \
 268         CONFIG_NET_EMATCH_IPSET=n
 269   FILES:=$(foreach mod,$(IPSET_MODULES),$(LINUX_DIR)/net/netfilter/$(mod).ko)
 270   AUTOLOAD:=$(call AutoLoad,49,$(notdir $(IPSET_MODULES)))
 271 endef
 272 $(eval $(call KernelPackage,ipt-ipset))
 273
 274
 275 define KernelPackage/ipt-nat
 276   TITLE:=Basic NAT targets
 277   KCONFIG:=$(KCONFIG_IPT_NAT)
 278   FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 279   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
 280   $(call AddDepends/ipt,+kmod-nf-nat)
 281 endef
 282
 283 define KernelPackage/ipt-nat/description
 284  Netfilter (IPv4) kernel modules for basic NAT targets
 285  Includes:
 286  - MASQUERADE
 287 endef
 288
 289 $(eval $(call KernelPackage,ipt-nat))
 290
 291
 292 define KernelPackage/ipt-raw
 293   TITLE:=Netfilter IPv4 raw table support
 294   KCONFIG:=CONFIG_IP_NF_RAW
 295   FILES:=$(LINUX_DIR)/net/ipv4/netfilter/iptable_raw.ko
 296   AUTOLOAD:=$(call AutoProbe,iptable_raw)
 297   $(call AddDepends/ipt)
 298 endef
 299
 300 $(eval $(call KernelPackage,ipt-raw))
 301
 302
 303 define KernelPackage/ipt-raw6
 304   TITLE:=Netfilter IPv6 raw table support
 305   KCONFIG:=CONFIG_IP6_NF_RAW
 306   FILES:=$(LINUX_DIR)/net/ipv6/netfilter/ip6table_raw.ko
 307   AUTOLOAD:=$(call AutoProbe,ip6table_raw)
 308   $(call AddDepends/ipt,+kmod-ip6tables)
 309 endef
 310
 311 $(eval $(call KernelPackage,ipt-raw6))
 312
 313
 314 define KernelPackage/ipt-nat6
 315   TITLE:=IPv6 NAT targets
 316   KCONFIG:=$(KCONFIG_IPT_NAT6)
 317   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 318   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
 319   $(call AddDepends/ipt,+kmod-nf-nat6)
 320   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 321   $(call AddDepends/ipt,+kmod-ipt-nat)
 322   $(call AddDepends/ipt,+kmod-ip6tables)
 323 endef
 324
 325 define KernelPackage/ipt-nat6/description
 326  Netfilter (IPv6) kernel modules for NAT targets
 327 endef
 328
 329 $(eval $(call KernelPackage,ipt-nat6))
 330
 331
 332 define KernelPackage/ipt-nat-extra
 333   TITLE:=Extra NAT targets
 334   KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
 335   FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 336   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
 337   $(call AddDepends/ipt,+kmod-ipt-nat)
 338 endef
 339
 340 define KernelPackage/ipt-nat-extra/description
 341  Netfilter (IPv4) kernel modules for extra NAT targets
 342  Includes:
 343  - NETMAP
 344  - REDIRECT
 345 endef
 346
 347 $(eval $(call KernelPackage,ipt-nat-extra))
 348
 349
 350 define KernelPackage/nf-nathelper
 351   SUBMENU:=$(NF_MENU)
 352   TITLE:=Basic Conntrack and NAT helpers
 353   KCONFIG:=$(KCONFIG_NF_NATHELPER)
 354   FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
 355   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
 356   DEPENDS:=+kmod-nf-nat
 357 endef
 358
 359 define KernelPackage/nf-nathelper/description
 360  Default Netfilter (IPv4) Conntrack and NAT helpers
 361  Includes:
 362  - ftp
 363  - irc
 364  - tftp
 365 endef
 366
 367 $(eval $(call KernelPackage,nf-nathelper))
 368
 369
 370 define KernelPackage/nf-nathelper-extra
 371   SUBMENU:=$(NF_MENU)
 372   TITLE:=Extra Conntrack and NAT helpers
 373   KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
 374   FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 375   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
 376   DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
 377 endef
 378
 379 define KernelPackage/nf-nathelper-extra/description
 380  Extra Netfilter (IPv4) Conntrack and NAT helpers
 381  Includes:
 382  - amanda
 383  - h323
 384  - mms
 385  - pptp
 386  - proto_gre
 387  - sip
 388  - snmp_basic
 389  - broadcast
 390 endef
 391
 392 $(eval $(call KernelPackage,nf-nathelper-extra))
 393
 394
 395 define KernelPackage/ipt-ulog
 396   TITLE:=Module for user-space packet logging
 397   KCONFIG:=$(KCONFIG_IPT_ULOG)
 398   FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
 399   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
 400   $(call AddDepends/ipt)
 401 endef
 402
 403 define KernelPackage/ipt-ulog/description
 404  Netfilter (IPv4) module for user-space packet logging
 405  Includes:
 406  - ULOG
 407 endef
 408
 409 $(eval $(call KernelPackage,ipt-ulog))
 410
 411
 412 define KernelPackage/ipt-nflog
 413   TITLE:=Module for user-space packet logging
 414   KCONFIG:=$(KCONFIG_IPT_NFLOG)
 415   FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
 416   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
 417   $(call AddDepends/ipt,+kmod-nfnetlink-log)
 418 endef
 419
 420 define KernelPackage/ipt-nflog/description
 421  Netfilter module for user-space packet logging
 422  Includes:
 423  - NFLOG
 424 endef
 425
 426 $(eval $(call KernelPackage,ipt-nflog))
 427
 428
 429 define KernelPackage/ipt-nfqueue
 430   TITLE:=Module for user-space packet queuing
 431   KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
 432   FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 433   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
 434   $(call AddDepends/ipt,+kmod-nfnetlink-queue)
 435 endef
 436
 437 define KernelPackage/ipt-nfqueue/description
 438  Netfilter module for user-space packet queuing
 439  Includes:
 440  - NFQUEUE
 441 endef
 442
 443 $(eval $(call KernelPackage,ipt-nfqueue))
 444
 445
 446 define KernelPackage/ipt-debug
 447   TITLE:=Module for debugging/development
 448   KCONFIG:=$(KCONFIG_IPT_DEBUG)
 449   DEFAULT:=n
 450   FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
 451   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
 452   $(call AddDepends/ipt)
 453 endef
 454
 455 define KernelPackage/ipt-debug/description
 456  Netfilter modules for debugging/development of the firewall
 457  Includes:
 458  - TRACE
 459 endef
 460
 461 $(eval $(call KernelPackage,ipt-debug))
 462
 463
 464 define KernelPackage/ipt-led
 465   TITLE:=Module to trigger a LED with a Netfilter rule
 466   KCONFIG:=$(KCONFIG_IPT_LED)
 467   FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
 468   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
 469   $(call AddDepends/ipt)
 470 endef
 471
 472 define KernelPackage/ipt-led/description
 473  Netfilter target to trigger a LED when a network packet is matched.
 474 endef
 475
 476 $(eval $(call KernelPackage,ipt-led))
 477
 478 define KernelPackage/ipt-tproxy
 479   TITLE:=Transparent proxying support
 480   DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-ip6tables
 481   KCONFIG:= \
 482         CONFIG_NETFILTER_XT_MATCH_SOCKET \
 483         CONFIG_NETFILTER_XT_TARGET_TPROXY
 484   FILES:= \
 485         $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
 486   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_TPROXY-m)))
 487   $(call AddDepends/ipt)
 488 endef
 489
 490 define KernelPackage/ipt-tproxy/description
 491   Kernel modules for Transparent Proxying
 492 endef
 493
 494 $(eval $(call KernelPackage,ipt-tproxy))
 495
 496 define KernelPackage/ipt-tee
 497   TITLE:=TEE support
 498   DEPENDS:=+kmod-ipt-conntrack
 499   KCONFIG:= \
 500         CONFIG_NETFILTER_XT_TARGET_TEE
 501   FILES:= \
 502         $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
 503         $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
 504   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
 505   $(call AddDepends/ipt)
 506 endef
 507
 508 define KernelPackage/ipt-tee/description
 509   Kernel modules for TEE
 510 endef
 511
 512 $(eval $(call KernelPackage,ipt-tee))
 513
 514
 515 define KernelPackage/ipt-u32
 516   TITLE:=U32 support
 517   KCONFIG:= \
 518         CONFIG_NETFILTER_XT_MATCH_U32
 519   FILES:= \
 520         $(LINUX_DIR)/net/netfilter/xt_u32.ko \
 521         $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
 522   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
 523   $(call AddDepends/ipt)
 524 endef
 525
 526 define KernelPackage/ipt-u32/description
 527   Kernel modules for U32
 528 endef
 529
 530 $(eval $(call KernelPackage,ipt-u32))
 531
 532
 533 define KernelPackage/ipt-iprange
 534   TITLE:=Module for matching ip ranges
 535   KCONFIG:=$(KCONFIG_IPT_IPRANGE)
 536   FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
 537   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
 538   $(call AddDepends/ipt)
 539 endef
 540
 541 define KernelPackage/ipt-iprange/description
 542  Netfilter (IPv4) module for matching ip ranges
 543  Includes:
 544  - iprange
 545 endef
 546
 547 $(eval $(call KernelPackage,ipt-iprange))
 548
 549 define KernelPackage/ipt-cluster
 550   TITLE:=Module for matching cluster
 551   KCONFIG:=$(KCONFIG_IPT_CLUSTER)
 552   FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
 553   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
 554   $(call AddDepends/ipt)
 555 endef
 556
 557 define KernelPackage/ipt-cluster/description
 558  Netfilter (IPv4/IPv6) module for matching cluster
 559  This option allows you to build work-load-sharing clusters of
 560  network servers/stateful firewalls without having a dedicated
 561  load-balancing router/server/switch. Basically, this match returns
 562  true when the packet must be handled by this cluster node. Thus,
 563  all nodes see all packets and this match decides which node handles
 564  what packets. The work-load sharing algorithm is based on source
 565  address hashing.
 566
 567  This module is usable for ipv4 and ipv6.
 568
 569  To use it also enable iptables-mod-cluster
 570
 571  see `iptables -m cluster --help` for more information.
 572 endef
 573
 574 $(eval $(call KernelPackage,ipt-cluster))
 575
 576 define KernelPackage/ipt-clusterip
 577   TITLE:=Module for CLUSTERIP
 578   KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
 579   FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
 580   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
 581   $(call AddDepends/ipt,+kmod-nf-conntrack)
 582 endef
 583
 584 define KernelPackage/ipt-clusterip/description
 585  Netfilter (IPv4-only) module for CLUSTERIP
 586  The CLUSTERIP target allows you to build load-balancing clusters of
 587  network servers without having a dedicated load-balancing
 588  router/server/switch.
 589
 590  To use it also enable iptables-mod-clusterip
 591
 592  see `iptables -j CLUSTERIP --help` for more information.
 593 endef
 594
 595 $(eval $(call KernelPackage,ipt-clusterip))
 596
 597
 598 define KernelPackage/ipt-extra
 599   TITLE:=Extra modules
 600   KCONFIG:=$(KCONFIG_IPT_EXTRA)
 601   FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 602   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
 603   $(call AddDepends/ipt,+kmod-br-netfilter)
 604 endef
 605
 606 define KernelPackage/ipt-extra/description
 607  Other Netfilter (IPv4) kernel modules
 608  Includes:
 609  - addrtype
 610  - owner
 611  - physdev (if bridge support was enabled in kernel)
 612  - pkttype
 613  - quota
 614 endef
 615
 616 $(eval $(call KernelPackage,ipt-extra))
 617
 618
 619 define KernelPackage/ip6tables
 620   SUBMENU:=$(NF_MENU)
 621   TITLE:=IPv6 modules
 622   DEPENDS:=+kmod-nf-ipt6 +kmod-ipt-core +kmod-ipt-conntrack
 623   KCONFIG:=$(KCONFIG_IPT_IPV6)
 624   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
 625   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
 626 endef
 627
 628 define KernelPackage/ip6tables/description
 629  Netfilter IPv6 firewalling support
 630 endef
 631
 632 $(eval $(call KernelPackage,ip6tables))
 633
 634 define KernelPackage/ip6tables-extra
 635   SUBMENU:=$(NF_MENU)
 636   TITLE:=Extra IPv6 modules
 637   DEPENDS:=+kmod-ip6tables
 638   KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
 639   FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 640   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
 641 endef
 642
 643 define KernelPackage/ip6tables-extra/description
 644  Netfilter IPv6 extra header matching modules
 645 endef
 646
 647 $(eval $(call KernelPackage,ip6tables-extra))
 648
 649 ARP_MODULES = arp_tables arpt_mangle arptable_filter
 650 define KernelPackage/arptables
 651   SUBMENU:=$(NF_MENU)
 652   TITLE:=ARP firewalling modules
 653   DEPENDS:=+kmod-ipt-core
 654   FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
 655   KCONFIG:=CONFIG_IP_NF_ARPTABLES \
 656     CONFIG_IP_NF_ARPFILTER \
 657     CONFIG_IP_NF_ARP_MANGLE
 658   AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
 659 endef
 660
 661 define KernelPackage/arptables/description
 662  Kernel modules for ARP firewalling
 663 endef
 664
 665 $(eval $(call KernelPackage,arptables))
 666
 667
 668 define KernelPackage/br-netfilter
 669   SUBMENU:=$(NF_MENU)
 670   TITLE:=Bridge netfilter support modules
 671   HIDDEN:=1
 672   DEPENDS:=+kmod-ipt-core
 673   FILES:=$(LINUX_DIR)/net/bridge/br_netfilter.ko
 674   KCONFIG:=CONFIG_BRIDGE_NETFILTER
 675   AUTOLOAD:=$(call AutoProbe,br_netfilter)
 676 endef
 677
 678 $(eval $(call KernelPackage,br-netfilter))
 679
 680
 681 define KernelPackage/ebtables
 682   SUBMENU:=$(NF_MENU)
 683   TITLE:=Bridge firewalling modules
 684   DEPENDS:=+kmod-ipt-core +kmod-br-netfilter
 685   FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
 686   KCONFIG:=$(KCONFIG_EBTABLES)
 687   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
 688 endef
 689
 690 define KernelPackage/ebtables/description
 691   ebtables is a general, extensible frame/packet identification
 692   framework. It provides you to do Ethernet
 693   filtering/NAT/brouting on the Ethernet bridge.
 694 endef
 695
 696 $(eval $(call KernelPackage,ebtables))
 697
 698
 699 define AddDepends/ebtables
 700   SUBMENU:=$(NF_MENU)
 701   DEPENDS+=kmod-ebtables $(1)
 702 endef
 703
 704
 705 define KernelPackage/ebtables-ipv4
 706   TITLE:=ebtables: IPv4 support
 707   FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
 708   KCONFIG:=$(KCONFIG_EBTABLES_IP4)
 709   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
 710   $(call AddDepends/ebtables)
 711 endef
 712
 713 define KernelPackage/ebtables-ipv4/description
 714  This option adds the IPv4 support to ebtables, which allows basic
 715  IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
 716 endef
 717
 718 $(eval $(call KernelPackage,ebtables-ipv4))
 719
 720
 721 define KernelPackage/ebtables-ipv6
 722   TITLE:=ebtables: IPv6 support
 723   FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
 724   KCONFIG:=$(KCONFIG_EBTABLES_IP6)
 725   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
 726   $(call AddDepends/ebtables)
 727 endef
 728
 729 define KernelPackage/ebtables-ipv6/description
 730  This option adds the IPv6 support to ebtables, which allows basic
 731  IPv6 header field filtering and target support.
 732 endef
 733
 734 $(eval $(call KernelPackage,ebtables-ipv6))
 735
 736
 737 define KernelPackage/ebtables-watchers
 738   TITLE:=ebtables: watchers support
 739   FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
 740   KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
 741   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
 742   $(call AddDepends/ebtables)
 743 endef
 744
 745 define KernelPackage/ebtables-watchers/description
 746  This option adds the log watchers, that you can use in any rule
 747  in any ebtables table.
 748 endef
 749
 750 $(eval $(call KernelPackage,ebtables-watchers))
 751
 752
 753 define KernelPackage/nfnetlink
 754   SUBMENU:=$(NF_MENU)
 755   TITLE:=Netlink-based userspace interface
 756   FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
 757   KCONFIG:=$(KCONFIG_NFNETLINK)
 758   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
 759 endef
 760
 761 define KernelPackage/nfnetlink/description
 762  Kernel modules support for a netlink-based userspace interface
 763 endef
 764
 765 $(eval $(call KernelPackage,nfnetlink))
 766
 767
 768 define AddDepends/nfnetlink
 769   SUBMENU:=$(NF_MENU)
 770   DEPENDS+=+kmod-nfnetlink $(1)
 771 endef
 772
 773
 774 define KernelPackage/nfnetlink-log
 775   TITLE:=Netfilter LOG over NFNETLINK interface
 776   FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
 777   KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
 778   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
 779   $(call AddDepends/nfnetlink)
 780 endef
 781
 782 define KernelPackage/nfnetlink-log/description
 783  Kernel modules support for logging packets via NFNETLINK
 784  Includes:
 785  - NFLOG
 786 endef
 787
 788 $(eval $(call KernelPackage,nfnetlink-log))
 789
 790
 791 define KernelPackage/nfnetlink-queue
 792   TITLE:=Netfilter QUEUE over NFNETLINK interface
 793   FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 794   KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
 795   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
 796   $(call AddDepends/nfnetlink)
 797 endef
 798
 799 define KernelPackage/nfnetlink-queue/description
 800  Kernel modules support for queueing packets via NFNETLINK
 801  Includes:
 802  - NFQUEUE
 803 endef
 804
 805 $(eval $(call KernelPackage,nfnetlink-queue))
 806
 807
 808 define KernelPackage/nf-conntrack-netlink
 809   TITLE:=Connection tracking netlink interface
 810   FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
 811   KCONFIG:=CONFIG_NF_CT_NETLINK CONFIG_NF_CONNTRACK_EVENTS=y
 812   AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
 813   $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
 814 endef
 815
 816 define KernelPackage/nf-conntrack-netlink/description
 817  Kernel modules support for a netlink-based connection tracking
 818  userspace interface
 819 endef
 820
 821 $(eval $(call KernelPackage,nf-conntrack-netlink))
 822
 823 define KernelPackage/ipt-hashlimit
 824   SUBMENU:=$(NF_MENU)
 825   TITLE:=Netfilter hashlimit match
 826   DEPENDS:=+kmod-ipt-core
 827   KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
 828   FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
 829   AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
 830   $(call KernelPackage/ipt)
 831 endef
 832
 833 define KernelPackage/ipt-hashlimit/description
 834  Kernel modules support for the hashlimit bucket match module
 835 endef
 836
 837 $(eval $(call KernelPackage,ipt-hashlimit))
 838
 839
 840 define KernelPackage/nft-core
 841   SUBMENU:=$(NF_MENU)
 842   TITLE:=Netfilter nf_tables support
 843   DEPENDS:=+kmod-nfnetlink +kmod-nf-conntrack6 +kmod-nf-ipt +kmod-nf-ipt6
 844   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
 845   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
 846   KCONFIG:= \
 847         CONFIG_NETFILTER=y \
 848         CONFIG_NETFILTER_ADVANCED=y \
 849         CONFIG_NFT_COMPAT=n \
 850         CONFIG_NFT_QUEUE=n \
 851         CONFIG_NF_TABLES_ARP=n \
 852         CONFIG_NF_TABLES_BRIDGE=n \
 853         $(KCONFIG_NFT_CORE)
 854 endef
 855
 856 define KernelPackage/nft-core/description
 857  Kernel module support for nftables
 858 endef
 859
 860 $(eval $(call KernelPackage,nft-core))
 861
 862
 863 define KernelPackage/nft-nat
 864   SUBMENU:=$(NF_MENU)
 865   TITLE:=Netfilter nf_tables NAT support
 866   DEPENDS:=+kmod-nft-core +kmod-nf-nat +kmod-nf-nat6
 867   FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 868   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
 869   KCONFIG:=$(KCONFIG_NFT_NAT)
 870 endef
 871
 872 $(eval $(call KernelPackage,nft-nat))
 873
 874
 875 define KernelPackage/nft-nat6
 876   SUBMENU:=$(NF_MENU)
 877   TITLE:=Netfilter nf_tables IPv6-NAT support
 878   DEPENDS:=+kmod-nft-core +kmod-nf-nat6
 879   FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 880   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
 881   KCONFIG:=$(KCONFIG_NFT_NAT6)
 882 endef
 883
 884 $(eval $(call KernelPackage,nft-nat6))
 885