mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-27 01:11:14 +00:00
2805402f86
459b6932 policy: add nft translation for simple policy none/strict use case
255e55b7 tests: xlate-test: no need to require superuser privileges
6990bbc5 extensions: hashlimit: remove space before burst in translation to nft
13ecaeb0 extensions: hashlimit: Rename 'flow table' keyword to meter
c252a2b0 extensions: Add test for cluster nft translation
bda1daa4 extensions: ip6t_{S,D}NAT: add more tests
88fa4543 extensions: ip6t_{S,D}NAT: multiple to-dst/to-src arguments not reported
64a0e098 extensions: libxt_cluster: Add translation to nft
6067208f extensions: add support for 'srh' match
0f387b07 extensions: hashlimit: fix incorrect burst in translations
1ffe6a74 extensions: libxt_hashlimit: Do not print default timeout and burst
27de281d extensions: Add macro _DEFAULT_SOURCE.
75364151 iptables: Remove const qualifier from struct option.
8b0da213 iptables: masquerade: add randomize-full support
e64db006 iptables: patch to correct linker flag sequence
033eac81 extensions: libxt_tcpmss: Add test case for invalid ranges.
505bfa11 iptables: xtables-eb: Remove const qualifier from struct option
a6d6821a iptables: extensions: Fix MARK target help
71de414c libxt_sctp: fix array out of range in print_chunk
1a32381a extensions: add tests for ipcomp protocol
4bd51770 tests: xlate: print output in same way as nft-test.py
d0e3d95f libxt_recent: Remove ineffective checks for info->name
23e6ed71 libxt_TOS: add tests for translation infrastructure
9564595e Update .gitignore
bebce197 iptables: iptables-compat translation for TCPMSS
dbbab0aa extensions: libxt_tcpmss: Detect invalid ranges
0e958281 iptables-translate: add test file for TCPMSS extension
de3c68b6 iptables-compat: do not allow to delete populated user define chains
f4b80ce7 iptables: change large file support handling
f5b46c2f iptables: Constify option struct
21ba5b38 ip{,6}tables-restore: Don't accept wait-interval without wait
60e0ffd3 ip{,6}tables-restore: Don't ignore missing wait-interval value
af468b6e utils: Add a man page for nfnl_osf
1773dcaa utils: nfnl_osf: Fix synopsis in help text
895ce096 extensions: libxt_bpf: fix missing __NR_bpf declaration
3c633296 xtables-compat-restore: fix translation of mangle's OUTPUT
1c32e560 netfilter: xt_hashlimit: add rate match mode
b5331f88 xtables-compat: fix memory leak when listing
91ae12e3 xtables-compat-restore: fix several memory leaks
79e1edd1 iptables-xml: Fix segfault on jump without a target
c49a93f1 xtables-translate: fix double space before comment
79fa7cc2 libip6t_icmp6: xlate: remove leftover space
8e62f572 tests: xlate: generalize owner
8d994bcf iptables: Add file output option to iptables-save
f8e5ebc5 iptables: Fix crash on malformed iptables-restore
80d8bfaa iptables: insist that the lock is held.
c29d99c8 libxtables: Display weird character warning for wildcards
1fe96cfb tests: xlate: check if it is being run as root
3f92b259 tests: xlate: remove python 3.5 dependency
d89dc47a iptables-restore/save: exit when given an unknown option
65801d02 iptables-restore.8: document -w/-W options
9cd3adbe iptables-restore/ip6tables-restore: add --version/-V argument
1ec1fb7a extensions: libxt_hashlimit: fix 64-bit printf formats
27f69f4a iptables: extensions: Remove typedef in struct.
340105fa tests: add regression tests for xtables-translate
b669e184 extensions: libxt_TOS: Add translation to nft
b2a84476 iptables: Remove unnecessary braces.
2963a8df iptables: Remove explicit static variables initalization.
1cf4ba6f iptables: Constify option struct
999eaa24 iptables-restore: support acquiring the lock.
6e2e169e iptables: remove duplicated argument parsing code
836846f0 iptables: move XT_LOCK_NAME from CFLAGS to config.h.
b91af533 iptables: set the path of the lock file via a configure option.
0e94eb2e iptables-translate: print nft iff there are more expanded rules to print
48ad179b libxtables: abolish AI_CANONNAME
9f50bbdf libxtables: remove unnecessary nesting from host_to_ip(6)addr
c6df55d6 iptables-translate: print nft command for each expand rules via dns names
82dacbb8 xtables-translate: Avoid querying the kernel
9f972f45 extensions: libxt_addrtype: Add translation to nft
2c8e251e utils: nfsynproxy: fix build with musl libc
9b8cb756 libiptc: don't set_changed() when checking rules with module jumps
eb66632d extensions: libxt_hashlimit: Add translation to nft
72bb3dbf xshared: using the blocking file lock request when we wait indefinitely
24f81746 xshared: do not lock again and again if "-w" option is not specified
fc3c3b4e libxt_hashlimit: add new unit test to catch kernel bug
516d9191 iptables: update pf.os
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
637 lines
15 KiB
Makefile
637 lines
15 KiB
Makefile
#
|
|
# Copyright (C) 2006-2016 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
include $(INCLUDE_DIR)/kernel.mk
|
|
|
|
PKG_NAME:=iptables
|
|
PKG_VERSION:=1.6.2
|
|
PKG_RELEASE:=1
|
|
|
|
PKG_SOURCE_PROTO:=git
|
|
PKG_SOURCE_URL:=https://git.netfilter.org/iptables
|
|
PKG_SOURCE_VERSION:=c16bdec15137b241586310d0e61bc88cc3726004
|
|
PKG_MIRROR_HASH:=72e4bec94a56dd600097846c773e1074ff705e38f800ef221db646c064371a53
|
|
|
|
PKG_FIXUP:=autoreconf
|
|
|
|
PKG_INSTALL:=1
|
|
PKG_BUILD_PARALLEL:=1
|
|
PKG_LICENSE:=GPL-2.0
|
|
PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
ifeq ($(DUMP),)
|
|
-include $(LINUX_DIR)/.config
|
|
include $(INCLUDE_DIR)/netfilter.mk
|
|
STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
|
|
endif
|
|
|
|
|
|
define Package/iptables/Default
|
|
SECTION:=net
|
|
CATEGORY:=Network
|
|
SUBMENU:=Firewall
|
|
URL:=http://netfilter.org/
|
|
endef
|
|
|
|
define Package/iptables/Module
|
|
$(call Package/iptables/Default)
|
|
DEPENDS:=iptables $(1)
|
|
endef
|
|
|
|
define Package/iptables
|
|
$(call Package/iptables/Default)
|
|
TITLE:=IP firewall administration tool
|
|
MENU:=1
|
|
DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
|
|
endef
|
|
|
|
define Package/iptables/config
|
|
config IPTABLES_CONNLABEL
|
|
bool "Enable Connlabel support"
|
|
default n
|
|
help
|
|
This enable connlabel support in iptables.
|
|
|
|
config IPTABLES_NFTABLES
|
|
bool "Enable Nftables support"
|
|
default n
|
|
help
|
|
This enable nftables support in iptables.
|
|
endef
|
|
|
|
define Package/iptables/description
|
|
IP firewall administration tool.
|
|
|
|
Matches:
|
|
- icmp
|
|
- tcp
|
|
- udp
|
|
- comment
|
|
- conntrack
|
|
- limit
|
|
- mac
|
|
- mark
|
|
- multiport
|
|
- set
|
|
- state
|
|
- time
|
|
|
|
Targets:
|
|
- ACCEPT
|
|
- CT
|
|
- DNAT
|
|
- DROP
|
|
- REJECT
|
|
- LOG
|
|
- MARK
|
|
- MASQUERADE
|
|
- REDIRECT
|
|
- SET
|
|
- SNAT
|
|
- TCPMSS
|
|
|
|
Tables:
|
|
- filter
|
|
- mangle
|
|
- nat
|
|
- raw
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-conntrack-extra
|
|
$(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
|
|
TITLE:=Extra connection tracking extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-conntrack-extra/description
|
|
Extra iptables extensions for connection tracking.
|
|
|
|
Matches:
|
|
- connbytes
|
|
- connlimit
|
|
- connmark
|
|
- recent
|
|
- helper
|
|
|
|
Targets:
|
|
- CONNMARK
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-conntrack-label
|
|
$(call Package/iptables/Module, +kmod-ipt-conntrack-label @IPTABLES_CONNLABEL)
|
|
TITLE:=Connection tracking labeling extension
|
|
DEFAULT:=y if IPTABLES_CONNLABEL
|
|
endef
|
|
|
|
define Package/iptables-mod-conntrack-label/description
|
|
Match and set label(s) on connection tracking entries
|
|
|
|
Matches:
|
|
- connlabel
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-filter
|
|
$(call Package/iptables/Module, +kmod-ipt-filter)
|
|
TITLE:=Content inspection extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-filter/description
|
|
iptables extensions for packet content inspection.
|
|
Includes support for:
|
|
|
|
Matches:
|
|
- string
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-ipopt
|
|
$(call Package/iptables/Module, +kmod-ipt-ipopt)
|
|
TITLE:=IP/Packet option extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-ipopt/description
|
|
iptables extensions for matching/changing IP packet options.
|
|
|
|
Matches:
|
|
- dscp
|
|
- ecn
|
|
- length
|
|
- statistic
|
|
- tcpmss
|
|
- unclean
|
|
- hl
|
|
|
|
Targets:
|
|
- DSCP
|
|
- CLASSIFY
|
|
- ECN
|
|
- HL
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-ipsec
|
|
$(call Package/iptables/Module, +kmod-ipt-ipsec)
|
|
TITLE:=IPsec extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-ipsec/description
|
|
iptables extensions for matching ipsec traffic.
|
|
|
|
Matches:
|
|
- ah
|
|
- esp
|
|
- policy
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-nat-extra
|
|
$(call Package/iptables/Module, +kmod-ipt-nat-extra)
|
|
TITLE:=Extra NAT extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-nat-extra/description
|
|
iptables extensions for extra NAT targets.
|
|
|
|
Targets:
|
|
- MIRROR
|
|
- NETMAP
|
|
endef
|
|
|
|
define Package/iptables-mod-ulog
|
|
$(call Package/iptables/Module, +kmod-ipt-ulog)
|
|
TITLE:=user-space packet logging
|
|
endef
|
|
|
|
define Package/iptables-mod-ulog/description
|
|
iptables extensions for user-space packet logging.
|
|
|
|
Targets:
|
|
- ULOG
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-nflog
|
|
$(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
|
|
TITLE:=Netfilter NFLOG target
|
|
endef
|
|
|
|
define Package/iptables-mod-nflog/description
|
|
iptables extension for user-space logging via NFNETLINK.
|
|
|
|
Includes:
|
|
- libxt_NFLOG
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-trace
|
|
$(call Package/iptables/Module, +kmod-ipt-debug)
|
|
TITLE:=Netfilter TRACE target
|
|
endef
|
|
|
|
define Package/iptables-mod-trace/description
|
|
iptables extension for TRACE target
|
|
|
|
Includes:
|
|
- libxt_TRACE
|
|
|
|
endef
|
|
|
|
|
|
define Package/iptables-mod-nfqueue
|
|
$(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
|
|
TITLE:=Netfilter NFQUEUE target
|
|
endef
|
|
|
|
define Package/iptables-mod-nfqueue/description
|
|
iptables extension for user-space queuing via NFNETLINK.
|
|
|
|
Includes:
|
|
- libxt_NFQUEUE
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-hashlimit
|
|
$(call Package/iptables/Module, +kmod-ipt-hashlimit)
|
|
TITLE:=hashlimit matching
|
|
endef
|
|
|
|
define Package/iptables-mod-hashlimit/description
|
|
iptables extensions for hashlimit matching
|
|
|
|
Matches:
|
|
- hashlimit
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-rpfilter
|
|
$(call Package/iptables/Module, +kmod-ipt-rpfilter)
|
|
TITLE:=rpfilter iptables extension
|
|
endef
|
|
|
|
define Package/iptables-mod-rpfilter/description
|
|
iptables extensions for reverse path filter test on a packet
|
|
|
|
Matches:
|
|
- rpfilter
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-iprange
|
|
$(call Package/iptables/Module, +kmod-ipt-iprange)
|
|
TITLE:=IP range extension
|
|
endef
|
|
|
|
define Package/iptables-mod-iprange/description
|
|
iptables extensions for matching ip ranges.
|
|
|
|
Matches:
|
|
- iprange
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-cluster
|
|
$(call Package/iptables/Module, +kmod-ipt-cluster)
|
|
TITLE:=Match cluster extension
|
|
endef
|
|
|
|
define Package/iptables-mod-cluster/description
|
|
iptables extensions for matching cluster.
|
|
|
|
Netfilter (IPv4/IPv6) module for matching cluster
|
|
This option allows you to build work-load-sharing clusters of
|
|
network servers/stateful firewalls without having a dedicated
|
|
load-balancing router/server/switch. Basically, this match returns
|
|
true when the packet must be handled by this cluster node. Thus,
|
|
all nodes see all packets and this match decides which node handles
|
|
what packets. The work-load sharing algorithm is based on source
|
|
address hashing.
|
|
|
|
This module is usable for ipv4 and ipv6.
|
|
|
|
If you select it, it enables kmod-ipt-cluster.
|
|
|
|
see `iptables -m cluster --help` for more information.
|
|
endef
|
|
|
|
define Package/iptables-mod-clusterip
|
|
$(call Package/iptables/Module, +kmod-ipt-clusterip)
|
|
TITLE:=Clusterip extension
|
|
endef
|
|
|
|
define Package/iptables-mod-clusterip/description
|
|
iptables extensions for CLUSTERIP.
|
|
The CLUSTERIP target allows you to build load-balancing clusters of
|
|
network servers without having a dedicated load-balancing
|
|
router/server/switch.
|
|
|
|
If you select it, it enables kmod-ipt-clusterip.
|
|
|
|
see `iptables -j CLUSTERIP --help` for more information.
|
|
endef
|
|
|
|
define Package/iptables-mod-extra
|
|
$(call Package/iptables/Module, +kmod-ipt-extra)
|
|
TITLE:=Other extra iptables extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-extra/description
|
|
Other extra iptables extensions.
|
|
|
|
Matches:
|
|
- addrtype
|
|
- condition
|
|
- owner
|
|
- physdev (if ebtables is enabled)
|
|
- pkttype
|
|
- quota
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-led
|
|
$(call Package/iptables/Module, +kmod-ipt-led)
|
|
TITLE:=LED trigger iptables extension
|
|
endef
|
|
|
|
define Package/iptables-mod-led/description
|
|
iptables extension for triggering a LED.
|
|
|
|
Targets:
|
|
- LED
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-tproxy
|
|
$(call Package/iptables/Module, +kmod-ipt-tproxy)
|
|
TITLE:=Transparent proxy iptables extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-tproxy/description
|
|
Transparent proxy iptables extensions.
|
|
|
|
Matches:
|
|
- socket
|
|
|
|
Targets:
|
|
- TPROXY
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-tee
|
|
$(call Package/iptables/Module, +kmod-ipt-tee)
|
|
TITLE:=TEE iptables extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-tee/description
|
|
TEE iptables extensions.
|
|
|
|
Targets:
|
|
- TEE
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-u32
|
|
$(call Package/iptables/Module, +kmod-ipt-u32)
|
|
TITLE:=U32 iptables extensions
|
|
endef
|
|
|
|
define Package/iptables-mod-u32/description
|
|
U32 iptables extensions.
|
|
|
|
Matches:
|
|
- u32
|
|
|
|
endef
|
|
|
|
define Package/iptables-mod-checksum
|
|
$(call Package/iptables/Module, +kmod-ipt-checksum)
|
|
TITLE:=IP CHECKSUM target extension
|
|
endef
|
|
|
|
define Package/iptables-mod-checksum/description
|
|
iptables extension for the CHECKSUM calculation target
|
|
endef
|
|
|
|
define Package/ip6tables
|
|
$(call Package/iptables/Default)
|
|
DEPENDS:=@IPV6 +kmod-ip6tables +iptables
|
|
CATEGORY:=Network
|
|
TITLE:=IPv6 firewall administration tool
|
|
MENU:=1
|
|
endef
|
|
|
|
|
|
define Package/ip6tables-extra
|
|
$(call Package/iptables/Default)
|
|
DEPENDS:=ip6tables +kmod-ip6tables-extra
|
|
TITLE:=IPv6 header matching modules
|
|
endef
|
|
|
|
define Package/ip6tables-mod-extra/description
|
|
iptables header matching modules for IPv6
|
|
endef
|
|
|
|
define Package/ip6tables-mod-nat
|
|
$(call Package/iptables/Default)
|
|
DEPENDS:=ip6tables +kmod-ipt-nat6
|
|
TITLE:=IPv6 NAT extensions
|
|
endef
|
|
|
|
define Package/ip6tables-mod-nat/description
|
|
iptables extensions for IPv6-NAT targets.
|
|
endef
|
|
|
|
define Package/libiptc
|
|
$(call Package/iptables/Default)
|
|
SECTION:=libs
|
|
CATEGORY:=Libraries
|
|
DEPENDS:=+libip4tc +libip6tc +libxtables
|
|
ABI_VERSION:=$(PKG_VERSION)
|
|
TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
|
|
endef
|
|
|
|
define Package/libip4tc
|
|
$(call Package/iptables/Default)
|
|
SECTION:=libs
|
|
CATEGORY:=Libraries
|
|
TITLE:=IPv4 firewall - shared libiptc library
|
|
ABI_VERSION:=$(PKG_VERSION)
|
|
DEPENDS:=+libxtables
|
|
endef
|
|
|
|
define Package/libip6tc
|
|
$(call Package/iptables/Default)
|
|
SECTION:=libs
|
|
CATEGORY:=Libraries
|
|
TITLE:=IPv6 firewall - shared libiptc library
|
|
ABI_VERSION:=$(PKG_VERSION)
|
|
DEPENDS:=+libxtables
|
|
endef
|
|
|
|
define Package/libxtables
|
|
$(call Package/iptables/Default)
|
|
SECTION:=libs
|
|
CATEGORY:=Libraries
|
|
TITLE:=IPv4/IPv6 firewall - shared xtables library
|
|
ABI_VERSION:=$(PKG_VERSION)
|
|
DEPENDS:= \
|
|
+IPTABLES_CONNLABEL:libnetfilter-conntrack \
|
|
+IPTABLES_NFTABLES:libnftnl
|
|
endef
|
|
|
|
TARGET_CPPFLAGS := \
|
|
-I$(PKG_BUILD_DIR)/include \
|
|
-I$(LINUX_DIR)/user_headers/include \
|
|
$(TARGET_CPPFLAGS)
|
|
|
|
TARGET_CFLAGS += \
|
|
-I$(PKG_BUILD_DIR)/include \
|
|
-I$(LINUX_DIR)/user_headers/include \
|
|
-ffunction-sections -fdata-sections \
|
|
-DNO_LEGACY
|
|
|
|
TARGET_LDFLAGS += \
|
|
-Wl,--gc-sections
|
|
|
|
CONFIGURE_ARGS += \
|
|
--enable-shared \
|
|
--enable-static \
|
|
--enable-devel \
|
|
--with-kernel="$(LINUX_DIR)/user_headers" \
|
|
--with-xtlibdir=/usr/lib/iptables \
|
|
--with-xt-lock-name=/var/run/xtables.lock \
|
|
$(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
|
|
$(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
|
|
$(if $(CONFIG_IPV6),,--disable-ipv6)
|
|
|
|
MAKE_FLAGS := \
|
|
$(TARGET_CONFIGURE_OPTS) \
|
|
COPT_FLAGS="$(TARGET_CFLAGS)" \
|
|
KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
|
|
KBUILD_OUTPUT="$(LINUX_DIR)" \
|
|
BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
|
|
|
|
ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
|
|
define Build/Configure/rebuild
|
|
$(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
|
|
rm -f $(PKG_BUILD_DIR)/.config_*
|
|
rm -f $(PKG_BUILD_DIR)/.configured_*
|
|
touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
|
|
endef
|
|
endif
|
|
|
|
define Build/Configure
|
|
$(Build/Configure/rebuild)
|
|
$(Build/Configure/Default)
|
|
endef
|
|
|
|
define Build/InstallDev
|
|
$(INSTALL_DIR) $(1)/usr/include
|
|
$(INSTALL_DIR) $(1)/usr/include/iptables
|
|
$(INSTALL_DIR) $(1)/usr/include/net/netfilter
|
|
|
|
# XXX: iptables header fixup, some headers are not installed by iptables anymore
|
|
$(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
|
|
$(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
|
|
$(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
|
|
$(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
|
|
$(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
|
|
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
|
|
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
|
|
|
|
# XXX: needed by firewall3
|
|
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/iptables/install
|
|
$(INSTALL_DIR) $(1)/usr/sbin
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
|
|
$(INSTALL_DIR) $(1)/usr/lib/iptables
|
|
endef
|
|
|
|
define Package/ip6tables/install
|
|
$(INSTALL_DIR) $(1)/usr/sbin
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
|
|
endef
|
|
|
|
define Package/libiptc/install
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/libip4tc/install
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
|
|
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/libip6tc/install
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
|
|
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/libxtables/install
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
|
|
$(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
|
|
endef
|
|
|
|
define BuildPlugin
|
|
define Package/$(1)/install
|
|
$(INSTALL_DIR) $$(1)/usr/lib/iptables
|
|
for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
|
|
if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
|
|
fi; \
|
|
done
|
|
$(3)
|
|
endef
|
|
|
|
$$(eval $$(call BuildPackage,$(1)))
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,iptables))
|
|
$(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
|
|
$(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
|
|
$(eval $(call BuildPackage,ip6tables))
|
|
$(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
|
|
$(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
|
|
$(eval $(call BuildPackage,libiptc))
|
|
$(eval $(call BuildPackage,libip4tc))
|
|
$(eval $(call BuildPackage,libip6tc))
|
|
$(eval $(call BuildPackage,libxtables))
|