package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2013 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.4.10
  13 PKG_RELEASE:=5
  14
  15 PKG_MD5SUM:=f382fe693f0b59d87bd47bea65eca198
  16 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  17 PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  18         ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  19         ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  20         ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  21
  22 PKG_FIXUP:=autoreconf
  23 PKG_INSTALL:=1
  24 PKG_BUILD_PARALLEL:=1
  25
  26 ifneq ($(CONFIG_EXTERNAL_KERNEL_TREE),"")
  27 PATCH_DIR:=
  28 endif
  29
  30 include $(INCLUDE_DIR)/package.mk
  31 ifeq ($(DUMP),)
  32   -include $(LINUX_DIR)/.config
  33   include $(INCLUDE_DIR)/netfilter.mk
  34   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell $(SH_FUNC) grep 'NETFILTER' $(LINUX_DIR)/.config | md5s)
  35 endif
  36
  37
  38 define Package/iptables/Default
  39   SECTION:=net
  40   CATEGORY:=Network
  41   SUBMENU:=Firewall
  42   URL:=http://netfilter.org/
  43 endef
  44
  45 define Package/iptables/Module
  46 $(call Package/iptables/Default)
  47   DEPENDS:=iptables $(1)
  48 endef
  49
  50 define Package/iptables
  51 $(call Package/iptables/Default)
  52   TITLE:=IPv4 firewall administration tool
  53   MENU:=1
  54   DEPENDS+= +kmod-ipt-core +libip4tc +libxtables
  55 endef
  56
  57 define Package/iptables/description
  58 IPv4 firewall administration tool.
  59
  60  Matches:
  61   - icmp
  62   - tcp
  63   - udp
  64   - comment
  65   - limit
  66   - mac
  67   - multiport
  68
  69  Targets:
  70   - ACCEPT
  71   - DROP
  72   - REJECT
  73   - LOG
  74   - TCPMSS
  75
  76  Tables:
  77   - filter
  78   - mangle
  79
  80 endef
  81
  82 define Package/iptables-mod-conntrack-extra
  83 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  84   TITLE:=Extra connection tracking extensions
  85 endef
  86
  87 define Package/iptables-mod-conntrack-extra/description
  88 Extra iptables extensions for connection tracking.
  89
  90  Matches:
  91   - connbytes
  92   - connmark
  93   - recent
  94   - helper
  95
  96  Targets:
  97   - CONNMARK
  98
  99 endef
 100
 101 define Package/iptables-mod-filter
 102 $(call Package/iptables/Module, +kmod-ipt-filter)
 103   TITLE:=Content inspection extensions
 104 endef
 105
 106 define Package/iptables-mod-filter/description
 107 iptables extensions for packet content inspection.
 108 Includes support for:
 109
 110  Matches:
 111   - layer7
 112   - string
 113
 114 endef
 115
 116 define Package/iptables-mod-ipopt
 117 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 118   TITLE:=IP/Packet option extensions
 119 endef
 120
 121 define Package/iptables-mod-ipopt/description
 122 iptables extensions for matching/changing IP packet options.
 123
 124  Matches:
 125   - dscp
 126   - ecn
 127   - length
 128   - mark
 129   - statistic
 130   - tcpmss
 131   - time
 132   - unclean
 133   - hl
 134
 135  Targets:
 136   - DSCP
 137   - CLASSIFY
 138   - ECN
 139   - MARK
 140   - HL
 141
 142 endef
 143
 144 define Package/iptables-mod-ipsec
 145 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 146   TITLE:=IPsec extensions
 147 endef
 148
 149 define Package/iptables-mod-ipsec/description
 150 iptables extensions for matching ipsec traffic.
 151
 152  Matches:
 153   - ah
 154   - esp
 155   - policy
 156
 157 endef
 158
 159 define Package/iptables-mod-ipset
 160 $(call Package/iptables/Module,)
 161   TITLE:=IPset iptables extensions
 162 endef
 163
 164 define Package/iptables-mod-ipset/description
 165 IPset iptables extensions.
 166
 167  Matches:
 168   - set
 169
 170  Targets:
 171   - SET
 172
 173 endef
 174
 175 define Package/iptables-mod-nat-extra
 176 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 177   TITLE:=Extra NAT extensions
 178 endef
 179
 180 define Package/iptables-mod-nat-extra/description
 181 iptables extensions for extra NAT targets.
 182
 183  Targets:
 184   - MIRROR
 185   - NETMAP
 186   - REDIRECT
 187 endef
 188
 189 define Package/iptables-mod-ulog
 190 $(call Package/iptables/Module, +kmod-ipt-ulog)
 191   TITLE:=user-space packet logging
 192 endef
 193
 194 define Package/iptables-mod-ulog/description
 195 iptables extensions for user-space packet logging.
 196
 197  Targets:
 198   - ULOG
 199
 200 endef
 201
 202 define Package/iptables-mod-hashlimit
 203 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 204   TITLE:=hashlimit matching
 205 endef
 206
 207 define Package/iptables-mod-hashlimit/description
 208 iptables extensions for hashlimit matching
 209
 210  Matches:
 211   - hashlimit
 212
 213 endef
 214
 215 define Package/iptables-mod-iprange
 216 $(call Package/iptables/Module, +kmod-ipt-iprange)
 217   TITLE:=IP range extension
 218 endef
 219
 220 define Package/iptables-mod-iprange/description
 221 iptables extensions for matching ip ranges.
 222
 223  Matches:
 224   - iprange
 225
 226 endef
 227
 228 define Package/iptables-mod-extra
 229 $(call Package/iptables/Module, +kmod-ipt-extra)
 230   TITLE:=Other extra iptables extensions
 231 endef
 232
 233 define Package/iptables-mod-extra/description
 234 Other extra iptables extensions.
 235
 236  Matches:
 237   - addrtype
 238   - condition
 239   - owner
 240   - physdev (if ebtables is enabled)
 241   - pkttype
 242   - quota
 243
 244 endef
 245
 246 define Package/iptables-mod-led
 247 $(call Package/iptables/Module, +kmod-ipt-led)
 248   TITLE:=LED trigger iptables extension
 249 endef
 250
 251 define Package/iptables-mod-led/description
 252 iptables extension for triggering a LED.
 253
 254  Targets:
 255   - LED
 256
 257 endef
 258
 259 define Package/iptables-mod-tproxy
 260 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 261   TITLE:=Transparent proxy iptables extensions
 262 endef
 263
 264 define Package/iptables-mod-tproxy/description
 265 Transparent proxy iptables extensions.
 266
 267  Matches:
 268   - socket
 269
 270  Targets:
 271   - TPROXY
 272
 273 endef
 274
 275 define Package/iptables-mod-tee
 276 $(call Package/iptables/Module, +kmod-ipt-tee)
 277   TITLE:=TEE iptables extensions
 278 endef
 279
 280 define Package/iptables-mod-tee/description
 281 TEE iptables extensions.
 282
 283  Targets:
 284   - TEE
 285
 286 endef
 287
 288 define Package/iptables-mod-u32
 289 $(call Package/iptables/Module, +kmod-ipt-u32)
 290   TITLE:=U32 iptables extensions
 291 endef
 292
 293 define Package/iptables-mod-u32/description
 294 U32 iptables extensions.
 295
 296  Matches:
 297   - u32
 298
 299 endef
 300
 301 define Package/ip6tables
 302 $(call Package/iptables/Default)
 303   DEPENDS:=+kmod-ip6tables +libip6tc +libxtables
 304   CATEGORY:=IPv6
 305   TITLE:=IPv6 firewall administration tool
 306   MENU:=1
 307 endef
 308
 309 define Package/libiptc
 310 $(call Package/iptables/Default)
 311   SECTION:=libs
 312   CATEGORY:=Libraries
 313   DEPENDS:=+libip4tc +libip6tc
 314   TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
 315 endef
 316
 317 define Package/libip4tc
 318 $(call Package/iptables/Default)
 319   SECTION:=libs
 320   CATEGORY:=Libraries
 321   TITLE:=IPv4 firewall - shared libiptc library
 322 endef
 323
 324 define Package/libip6tc
 325 $(call Package/iptables/Default)
 326   SECTION:=libs
 327   CATEGORY:=Libraries
 328   TITLE:=IPv6 firewall - shared libiptc library
 329 endef
 330
 331 define Package/libxtables
 332  $(call Package/iptables/Default)
 333  SECTION:=libs
 334  CATEGORY:=Libraries
 335  TITLE:=IPv4/IPv6 firewall - shared xtables library
 336 endef
 337
 338 TARGET_CPPFLAGS := \
 339         -I$(PKG_BUILD_DIR)/include \
 340         -I$(LINUX_DIR)/user_headers/include \
 341         $(TARGET_CPPFLAGS)
 342
 343 TARGET_CFLAGS += \
 344         -I$(PKG_BUILD_DIR)/include \
 345         -I$(LINUX_DIR)/user_headers/include
 346
 347 CONFIGURE_ARGS += \
 348         --enable-shared \
 349         --enable-devel \
 350         $(if $(CONFIG_IPV6),--enable-ipv6,--disable-ipv6) \
 351         --with-kernel="$(LINUX_DIR)/user_headers" \
 352         --with-xtlibdir=/usr/lib/iptables \
 353         --enable-static
 354
 355 MAKE_FLAGS := \
 356         $(TARGET_CONFIGURE_OPTS) \
 357         COPT_FLAGS="$(TARGET_CFLAGS)" \
 358         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 359         KBUILD_OUTPUT="$(LINUX_DIR)" \
 360         BUILTIN_MODULES="$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m)))"
 361
 362 define Build/InstallDev
 363         $(INSTALL_DIR) $(1)/usr/include
 364         $(INSTALL_DIR) $(1)/usr/include/iptables
 365         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 366
 367         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 368         $(CP) $(PKG_BUILD_DIR)/include/net/netfilter/*.h $(1)/usr/include/net/netfilter/
 369         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 370         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 371         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 372         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 373
 374         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 375         $(INSTALL_DIR) $(1)/usr/lib
 376         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 377         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 378         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 379         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 380         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libiptc.pc $(1)/usr/lib/pkgconfig/
 381 endef
 382
 383 define Package/iptables/install
 384         $(INSTALL_DIR) $(1)/usr/sbin
 385         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/iptables $(1)/usr/sbin/
 386         $(LN) iptables $(1)/usr/sbin/iptables-save
 387         $(LN) iptables $(1)/usr/sbin/iptables-restore
 388         $(INSTALL_DIR) $(1)/usr/lib/iptables
 389 endef
 390
 391 define Package/ip6tables/install
 392         $(INSTALL_DIR) $(1)/usr/sbin
 393         $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables $(1)/usr/sbin/
 394         $(LN) ip6tables $(1)/usr/sbin/ip6tables-save
 395         $(LN) ip6tables $(1)/usr/sbin/ip6tables-restore
 396         $(INSTALL_DIR) $(1)/usr/lib/iptables
 397         (cd $(PKG_INSTALL_DIR)/usr/lib/iptables ; \
 398                 $(CP) libip6t_*.so $(1)/usr/lib/iptables/ \
 399         )
 400 endef
 401
 402 define Package/libiptc/install
 403         $(INSTALL_DIR) $(1)/usr/lib
 404         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
 405 endef
 406
 407 define Package/libip4tc/install
 408         $(INSTALL_DIR) $(1)/usr/lib
 409         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
 410 endef
 411
 412 define Package/libip6tc/install
 413         $(INSTALL_DIR) $(1)/usr/lib
 414         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
 415 endef
 416
 417 define Package/libxtables/install
 418         $(INSTALL_DIR) $(1)/usr/lib
 419         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 420 endef
 421
 422 define BuildPlugin
 423   define Package/$(1)/install
 424         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 425         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)); do \
 426                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 427                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 428                 fi; \
 429         done
 430         $(3)
 431   endef
 432
 433   $$(eval $$(call BuildPackage,$(1)))
 434 endef
 435
 436 L7_INSTALL:=\
 437         $(INSTALL_DIR) $$(1)/etc/l7-protocols; \
 438         $(CP) files/l7/*.pat $$(1)/etc/l7-protocols/
 439
 440
 441 $(eval $(call BuildPackage,iptables))
 442 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 443 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 444 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m),$(L7_INSTALL)))
 445 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 446 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 447 $(eval $(call BuildPlugin,iptables-mod-ipset,ipt_set ipt_SET))
 448 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 449 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 450 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 451 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 452 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 453 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 454 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 455 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 456 $(eval $(call BuildPackage,ip6tables))
 457 $(eval $(call BuildPackage,libiptc))
 458 $(eval $(call BuildPackage,libip4tc))
 459 $(eval $(call BuildPackage,libip6tc))
 460 $(eval $(call BuildPackage,libxtables))