1
0

Makefile 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558
  1. #
  2. # Copyright (C) 2006-2016 OpenWrt.org
  3. #
  4. # This is free software, licensed under the GNU General Public License v2.
  5. # See /LICENSE for more information.
  6. #
  7. include $(TOPDIR)/rules.mk
  8. include $(INCLUDE_DIR)/kernel.mk
  9. PKG_NAME:=iptables
  10. PKG_VERSION:=1.4.21
  11. PKG_RELEASE:=2
  12. PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  13. PKG_SOURCE_URL:=http://www.netfilter.org/projects/iptables/files \
  14. ftp://ftp.be.netfilter.org/pub/netfilter/iptables/ \
  15. ftp://ftp.de.netfilter.org/pub/netfilter/iptables/ \
  16. ftp://ftp.no.netfilter.org/pub/netfilter/iptables/
  17. PKG_HASH:=52004c68021da9a599feed27f65defcfb22128f7da2c0531c0f75de0f479d3e0
  18. PKG_FIXUP:=autoreconf
  19. PKG_INSTALL:=1
  20. PKG_BUILD_PARALLEL:=1
  21. PKG_LICENSE:=GPL-2.0
  22. include $(INCLUDE_DIR)/package.mk
  23. ifeq ($(DUMP),)
  24. -include $(LINUX_DIR)/.config
  25. include $(INCLUDE_DIR)/netfilter.mk
  26. STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
  27. endif
  28. define Package/iptables/Default
  29. SECTION:=net
  30. CATEGORY:=Network
  31. SUBMENU:=Firewall
  32. URL:=http://netfilter.org/
  33. endef
  34. define Package/iptables/Module
  35. $(call Package/iptables/Default)
  36. DEPENDS:=iptables $(1)
  37. endef
  38. define Package/iptables
  39. $(call Package/iptables/Default)
  40. TITLE:=IP firewall administration tool
  41. MENU:=1
  42. DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
  43. endef
  44. define Package/iptables/description
  45. IP firewall administration tool.
  46. Matches:
  47. - icmp
  48. - tcp
  49. - udp
  50. - comment
  51. - conntrack
  52. - limit
  53. - mac
  54. - mark
  55. - multiport
  56. - set
  57. - state
  58. - time
  59. Targets:
  60. - ACCEPT
  61. - CT
  62. - DNAT
  63. - DROP
  64. - REJECT
  65. - LOG
  66. - MARK
  67. - MASQUERADE
  68. - REDIRECT
  69. - SET
  70. - SNAT
  71. - TCPMSS
  72. Tables:
  73. - filter
  74. - mangle
  75. - nat
  76. - raw
  77. endef
  78. define Package/iptables-mod-conntrack-extra
  79. $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
  80. TITLE:=Extra connection tracking extensions
  81. endef
  82. define Package/iptables-mod-conntrack-extra/description
  83. Extra iptables extensions for connection tracking.
  84. Matches:
  85. - connbytes
  86. - connlimit
  87. - connmark
  88. - recent
  89. - helper
  90. Targets:
  91. - CONNMARK
  92. endef
  93. define Package/iptables-mod-filter
  94. $(call Package/iptables/Module, +kmod-ipt-filter)
  95. TITLE:=Content inspection extensions
  96. endef
  97. define Package/iptables-mod-filter/description
  98. iptables extensions for packet content inspection.
  99. Includes support for:
  100. Matches:
  101. - string
  102. endef
  103. define Package/iptables-mod-ipopt
  104. $(call Package/iptables/Module, +kmod-ipt-ipopt)
  105. TITLE:=IP/Packet option extensions
  106. endef
  107. define Package/iptables-mod-ipopt/description
  108. iptables extensions for matching/changing IP packet options.
  109. Matches:
  110. - dscp
  111. - ecn
  112. - length
  113. - statistic
  114. - tcpmss
  115. - unclean
  116. - hl
  117. Targets:
  118. - DSCP
  119. - CLASSIFY
  120. - ECN
  121. - HL
  122. endef
  123. define Package/iptables-mod-ipsec
  124. $(call Package/iptables/Module, +kmod-ipt-ipsec)
  125. TITLE:=IPsec extensions
  126. endef
  127. define Package/iptables-mod-ipsec/description
  128. iptables extensions for matching ipsec traffic.
  129. Matches:
  130. - ah
  131. - esp
  132. - policy
  133. endef
  134. define Package/iptables-mod-nat-extra
  135. $(call Package/iptables/Module, +kmod-ipt-nat-extra)
  136. TITLE:=Extra NAT extensions
  137. endef
  138. define Package/iptables-mod-nat-extra/description
  139. iptables extensions for extra NAT targets.
  140. Targets:
  141. - MIRROR
  142. - NETMAP
  143. endef
  144. define Package/iptables-mod-ulog
  145. $(call Package/iptables/Module, +kmod-ipt-ulog)
  146. TITLE:=user-space packet logging
  147. endef
  148. define Package/iptables-mod-ulog/description
  149. iptables extensions for user-space packet logging.
  150. Targets:
  151. - ULOG
  152. endef
  153. define Package/iptables-mod-nflog
  154. $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
  155. TITLE:=Netfilter NFLOG target
  156. endef
  157. define Package/iptables-mod-nflog/description
  158. iptables extension for user-space logging via NFNETLINK.
  159. Includes:
  160. - libxt_NFLOG
  161. endef
  162. define Package/iptables-mod-nfqueue
  163. $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
  164. TITLE:=Netfilter NFQUEUE target
  165. endef
  166. define Package/iptables-mod-nfqueue/description
  167. iptables extension for user-space queuing via NFNETLINK.
  168. Includes:
  169. - libxt_NFQUEUE
  170. endef
  171. define Package/iptables-mod-hashlimit
  172. $(call Package/iptables/Module, +kmod-ipt-hashlimit)
  173. TITLE:=hashlimit matching
  174. endef
  175. define Package/iptables-mod-hashlimit/description
  176. iptables extensions for hashlimit matching
  177. Matches:
  178. - hashlimit
  179. endef
  180. define Package/iptables-mod-iprange
  181. $(call Package/iptables/Module, +kmod-ipt-iprange)
  182. TITLE:=IP range extension
  183. endef
  184. define Package/iptables-mod-iprange/description
  185. iptables extensions for matching ip ranges.
  186. Matches:
  187. - iprange
  188. endef
  189. define Package/iptables-mod-cluster
  190. $(call Package/iptables/Module, +kmod-ipt-cluster)
  191. TITLE:=Match cluster extension
  192. endef
  193. define Package/iptables-mod-cluster/description
  194. iptables extensions for matching cluster.
  195. Netfilter (IPv4/IPv6) module for matching cluster
  196. This option allows you to build work-load-sharing clusters of
  197. network servers/stateful firewalls without having a dedicated
  198. load-balancing router/server/switch. Basically, this match returns
  199. true when the packet must be handled by this cluster node. Thus,
  200. all nodes see all packets and this match decides which node handles
  201. what packets. The work-load sharing algorithm is based on source
  202. address hashing.
  203. This module is usable for ipv4 and ipv6.
  204. If you select it, it enables kmod-ipt-cluster.
  205. see `iptables -m cluster --help` for more information.
  206. endef
  207. define Package/iptables-mod-clusterip
  208. $(call Package/iptables/Module, +kmod-ipt-clusterip)
  209. TITLE:=Clusterip extension
  210. endef
  211. define Package/iptables-mod-clusterip/description
  212. iptables extensions for CLUSTERIP.
  213. The CLUSTERIP target allows you to build load-balancing clusters of
  214. network servers without having a dedicated load-balancing
  215. router/server/switch.
  216. If you select it, it enables kmod-ipt-clusterip.
  217. see `iptables -j CLUSTERIP --help` for more information.
  218. endef
  219. define Package/iptables-mod-extra
  220. $(call Package/iptables/Module, +kmod-ipt-extra)
  221. TITLE:=Other extra iptables extensions
  222. endef
  223. define Package/iptables-mod-extra/description
  224. Other extra iptables extensions.
  225. Matches:
  226. - addrtype
  227. - condition
  228. - owner
  229. - physdev (if ebtables is enabled)
  230. - pkttype
  231. - quota
  232. endef
  233. define Package/iptables-mod-led
  234. $(call Package/iptables/Module, +kmod-ipt-led)
  235. TITLE:=LED trigger iptables extension
  236. endef
  237. define Package/iptables-mod-led/description
  238. iptables extension for triggering a LED.
  239. Targets:
  240. - LED
  241. endef
  242. define Package/iptables-mod-tproxy
  243. $(call Package/iptables/Module, +kmod-ipt-tproxy)
  244. TITLE:=Transparent proxy iptables extensions
  245. endef
  246. define Package/iptables-mod-tproxy/description
  247. Transparent proxy iptables extensions.
  248. Matches:
  249. - socket
  250. Targets:
  251. - TPROXY
  252. endef
  253. define Package/iptables-mod-tee
  254. $(call Package/iptables/Module, +kmod-ipt-tee)
  255. TITLE:=TEE iptables extensions
  256. endef
  257. define Package/iptables-mod-tee/description
  258. TEE iptables extensions.
  259. Targets:
  260. - TEE
  261. endef
  262. define Package/iptables-mod-u32
  263. $(call Package/iptables/Module, +kmod-ipt-u32)
  264. TITLE:=U32 iptables extensions
  265. endef
  266. define Package/iptables-mod-u32/description
  267. U32 iptables extensions.
  268. Matches:
  269. - u32
  270. endef
  271. define Package/ip6tables
  272. $(call Package/iptables/Default)
  273. DEPENDS:=@IPV6 +kmod-ip6tables +iptables
  274. CATEGORY:=Network
  275. TITLE:=IPv6 firewall administration tool
  276. MENU:=1
  277. endef
  278. define Package/ip6tables-extra
  279. $(call Package/iptables/Default)
  280. DEPENDS:=ip6tables +kmod-ip6tables-extra
  281. TITLE:=IPv6 header matching modules
  282. endef
  283. define Package/ip6tables-mod-extra/description
  284. iptables header matching modules for IPv6
  285. endef
  286. define Package/ip6tables-mod-nat
  287. $(call Package/iptables/Default)
  288. DEPENDS:=ip6tables +kmod-ipt-nat6
  289. TITLE:=IPv6 NAT extensions
  290. endef
  291. define Package/ip6tables-mod-nat/description
  292. iptables extensions for IPv6-NAT targets.
  293. endef
  294. define Package/libiptc
  295. $(call Package/iptables/Default)
  296. SECTION:=libs
  297. CATEGORY:=Libraries
  298. DEPENDS:=+libip4tc +libip6tc +libxtables
  299. TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
  300. endef
  301. define Package/libip4tc
  302. $(call Package/iptables/Default)
  303. SECTION:=libs
  304. CATEGORY:=Libraries
  305. TITLE:=IPv4 firewall - shared libiptc library
  306. DEPENDS:=+libxtables
  307. endef
  308. define Package/libip6tc
  309. $(call Package/iptables/Default)
  310. SECTION:=libs
  311. CATEGORY:=Libraries
  312. TITLE:=IPv6 firewall - shared libiptc library
  313. DEPENDS:=+libxtables
  314. endef
  315. define Package/libxtables
  316. $(call Package/iptables/Default)
  317. SECTION:=libs
  318. CATEGORY:=Libraries
  319. TITLE:=IPv4/IPv6 firewall - shared xtables library
  320. endef
  321. TARGET_CPPFLAGS := \
  322. -I$(PKG_BUILD_DIR)/include \
  323. -I$(LINUX_DIR)/user_headers/include \
  324. $(TARGET_CPPFLAGS)
  325. TARGET_CFLAGS += \
  326. -I$(PKG_BUILD_DIR)/include \
  327. -I$(LINUX_DIR)/user_headers/include \
  328. -ffunction-sections -fdata-sections \
  329. -DNO_LEGACY
  330. TARGET_LDFLAGS += \
  331. -Wl,--gc-sections
  332. CONFIGURE_ARGS += \
  333. --enable-shared \
  334. --enable-devel \
  335. --with-kernel="$(LINUX_DIR)/user_headers" \
  336. --with-xtlibdir=/usr/lib/iptables \
  337. --enable-static \
  338. $(if $(CONFIG_IPV6),,--disable-ipv6)
  339. MAKE_FLAGS := \
  340. $(TARGET_CONFIGURE_OPTS) \
  341. COPT_FLAGS="$(TARGET_CFLAGS)" \
  342. KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
  343. KBUILD_OUTPUT="$(LINUX_DIR)" \
  344. BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
  345. ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
  346. define Build/Configure/rebuild
  347. $(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
  348. rm -f $(PKG_BUILD_DIR)/.config_*
  349. rm -f $(PKG_BUILD_DIR)/.configured_*
  350. touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
  351. endef
  352. endif
  353. define Build/Configure
  354. $(Build/Configure/rebuild)
  355. $(Build/Configure/Default)
  356. endef
  357. define Build/InstallDev
  358. $(INSTALL_DIR) $(1)/usr/include
  359. $(INSTALL_DIR) $(1)/usr/include/iptables
  360. $(INSTALL_DIR) $(1)/usr/include/net/netfilter
  361. # XXX: iptables header fixup, some headers are not installed by iptables anymore
  362. $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
  363. $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
  364. $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
  365. $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
  366. $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
  367. $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
  368. $(INSTALL_DIR) $(1)/usr/lib
  369. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
  370. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
  371. $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
  372. $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
  373. $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
  374. # XXX: needed by firewall3
  375. $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
  376. endef
  377. define Package/iptables/install
  378. $(INSTALL_DIR) $(1)/usr/sbin
  379. $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
  380. $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
  381. $(INSTALL_DIR) $(1)/usr/lib/iptables
  382. endef
  383. define Package/ip6tables/install
  384. $(INSTALL_DIR) $(1)/usr/sbin
  385. $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
  386. endef
  387. define Package/libiptc/install
  388. $(INSTALL_DIR) $(1)/usr/lib
  389. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
  390. endef
  391. define Package/libip4tc/install
  392. $(INSTALL_DIR) $(1)/usr/lib
  393. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
  394. $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
  395. endef
  396. define Package/libip6tc/install
  397. $(INSTALL_DIR) $(1)/usr/lib
  398. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
  399. $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
  400. endef
  401. define Package/libxtables/install
  402. $(INSTALL_DIR) $(1)/usr/lib
  403. $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
  404. $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
  405. endef
  406. define BuildPlugin
  407. define Package/$(1)/install
  408. $(INSTALL_DIR) $$(1)/usr/lib/iptables
  409. for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
  410. if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
  411. $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
  412. fi; \
  413. done
  414. $(3)
  415. endef
  416. $$(eval $$(call BuildPackage,$(1)))
  417. endef
  418. $(eval $(call BuildPackage,iptables))
  419. $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
  420. $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
  421. $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
  422. $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
  423. $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
  424. $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
  425. $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
  426. $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
  427. $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
  428. $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
  429. $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
  430. $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
  431. $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
  432. $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
  433. $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
  434. $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
  435. $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
  436. $(eval $(call BuildPackage,ip6tables))
  437. $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
  438. $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
  439. $(eval $(call BuildPackage,libiptc))
  440. $(eval $(call BuildPackage,libip4tc))
  441. $(eval $(call BuildPackage,libip6tc))
  442. $(eval $(call BuildPackage,libxtables))