2 # Copyright (C) 2006-2016 OpenWrt.org
4 # This is free software, licensed under the GNU General Public License v2.
5 # See /LICENSE for more information.
8 include $(TOPDIR)/rules.mk
9 include $(INCLUDE_DIR)/kernel.mk
16 PKG_SOURCE_URL:=https://git.netfilter.org/iptables
17 PKG_SOURCE_VERSION:=bba6bc692b0e6137e13881a1f398c134822e9f83
18 PKG_MIRROR_HASH:=23a61d2a23fc0d587029690ef2564625d78fba4b2d90117edaf5b9eaf55bb7f9
26 PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
28 include $(INCLUDE_DIR)/package.mk
30 -include $(LINUX_DIR)/.config
31 include $(INCLUDE_DIR)/netfilter.mk
32 STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
36 define Package/iptables/Default
40 URL:=http://netfilter.org/
43 define Package/iptables/Module
44 $(call Package/iptables/Default)
45 DEPENDS:=iptables $(1)
48 define Package/iptables
49 $(call Package/iptables/Default)
50 TITLE:=IP firewall administration tool
52 DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
55 define Package/iptables/config
56 config IPTABLES_CONNLABEL
57 bool "Enable Connlabel support"
60 This enable connlabel support in iptables.
62 config IPTABLES_NFTABLES
63 bool "Enable Nftables support"
66 This enable nftables support in iptables.
69 define Package/iptables/description
70 IP firewall administration tool.
109 define Package/iptables-nft
110 $(call Package/iptables/Default)
111 TITLE:=IP firewall administration tool nft
112 DEPENDS:=iptables @IPTABLES_NFTABLES +libxtables-nft
115 define Package/iptables-nft/description
116 Extra iptables nftables nft binaries.
121 iptables-restore-translate
124 define Package/iptables-mod-conntrack-extra
125 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw)
126 TITLE:=Extra connection tracking extensions
129 define Package/iptables-mod-conntrack-extra/description
130 Extra iptables extensions for connection tracking.
144 define Package/iptables-mod-conntrack-label
145 $(call Package/iptables/Module, +kmod-ipt-conntrack-label @IPTABLES_CONNLABEL)
146 TITLE:=Connection tracking labeling extension
147 DEFAULT:=y if IPTABLES_CONNLABEL
150 define Package/iptables-mod-conntrack-label/description
151 Match and set label(s) on connection tracking entries
158 define Package/iptables-mod-filter
159 $(call Package/iptables/Module, +kmod-ipt-filter)
160 TITLE:=Content inspection extensions
163 define Package/iptables-mod-filter/description
164 iptables extensions for packet content inspection.
165 Includes support for:
173 define Package/iptables-mod-ipopt
174 $(call Package/iptables/Module, +kmod-ipt-ipopt)
175 TITLE:=IP/Packet option extensions
178 define Package/iptables-mod-ipopt/description
179 iptables extensions for matching/changing IP packet options.
198 define Package/iptables-mod-ipsec
199 $(call Package/iptables/Module, +kmod-ipt-ipsec)
200 TITLE:=IPsec extensions
203 define Package/iptables-mod-ipsec/description
204 iptables extensions for matching ipsec traffic.
213 define Package/iptables-mod-nat-extra
214 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
215 TITLE:=Extra NAT extensions
218 define Package/iptables-mod-nat-extra/description
219 iptables extensions for extra NAT targets.
226 define Package/iptables-mod-ulog
227 $(call Package/iptables/Module, +kmod-ipt-ulog)
228 TITLE:=user-space packet logging
231 define Package/iptables-mod-ulog/description
232 iptables extensions for user-space packet logging.
239 define Package/iptables-mod-nflog
240 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
241 TITLE:=Netfilter NFLOG target
244 define Package/iptables-mod-nflog/description
245 iptables extension for user-space logging via NFNETLINK.
252 define Package/iptables-mod-trace
253 $(call Package/iptables/Module, +kmod-ipt-debug)
254 TITLE:=Netfilter TRACE target
257 define Package/iptables-mod-trace/description
258 iptables extension for TRACE target
266 define Package/iptables-mod-nfqueue
267 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
268 TITLE:=Netfilter NFQUEUE target
271 define Package/iptables-mod-nfqueue/description
272 iptables extension for user-space queuing via NFNETLINK.
279 define Package/iptables-mod-hashlimit
280 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
281 TITLE:=hashlimit matching
284 define Package/iptables-mod-hashlimit/description
285 iptables extensions for hashlimit matching
292 define Package/iptables-mod-rpfilter
293 $(call Package/iptables/Module, +kmod-ipt-rpfilter)
294 TITLE:=rpfilter iptables extension
297 define Package/iptables-mod-rpfilter/description
298 iptables extensions for reverse path filter test on a packet
305 define Package/iptables-mod-iprange
306 $(call Package/iptables/Module, +kmod-ipt-iprange)
307 TITLE:=IP range extension
310 define Package/iptables-mod-iprange/description
311 iptables extensions for matching ip ranges.
318 define Package/iptables-mod-cluster
319 $(call Package/iptables/Module, +kmod-ipt-cluster)
320 TITLE:=Match cluster extension
323 define Package/iptables-mod-cluster/description
324 iptables extensions for matching cluster.
326 Netfilter (IPv4/IPv6) module for matching cluster
327 This option allows you to build work-load-sharing clusters of
328 network servers/stateful firewalls without having a dedicated
329 load-balancing router/server/switch. Basically, this match returns
330 true when the packet must be handled by this cluster node. Thus,
331 all nodes see all packets and this match decides which node handles
332 what packets. The work-load sharing algorithm is based on source
335 This module is usable for ipv4 and ipv6.
337 If you select it, it enables kmod-ipt-cluster.
339 see `iptables -m cluster --help` for more information.
342 define Package/iptables-mod-clusterip
343 $(call Package/iptables/Module, +kmod-ipt-clusterip)
344 TITLE:=Clusterip extension
347 define Package/iptables-mod-clusterip/description
348 iptables extensions for CLUSTERIP.
349 The CLUSTERIP target allows you to build load-balancing clusters of
350 network servers without having a dedicated load-balancing
351 router/server/switch.
353 If you select it, it enables kmod-ipt-clusterip.
355 see `iptables -j CLUSTERIP --help` for more information.
358 define Package/iptables-mod-extra
359 $(call Package/iptables/Module, +kmod-ipt-extra)
360 TITLE:=Other extra iptables extensions
363 define Package/iptables-mod-extra/description
364 Other extra iptables extensions.
375 define Package/iptables-mod-physdev
376 $(call Package/iptables/Module, +kmod-ipt-physdev)
377 TITLE:=physdev iptables extension
380 define Package/iptables-mod-physdev/description
381 The iptables physdev match.
384 define Package/iptables-mod-led
385 $(call Package/iptables/Module, +kmod-ipt-led)
386 TITLE:=LED trigger iptables extension
389 define Package/iptables-mod-led/description
390 iptables extension for triggering a LED.
397 define Package/iptables-mod-tproxy
398 $(call Package/iptables/Module, +kmod-ipt-tproxy)
399 TITLE:=Transparent proxy iptables extensions
402 define Package/iptables-mod-tproxy/description
403 Transparent proxy iptables extensions.
413 define Package/iptables-mod-tee
414 $(call Package/iptables/Module, +kmod-ipt-tee)
415 TITLE:=TEE iptables extensions
418 define Package/iptables-mod-tee/description
419 TEE iptables extensions.
426 define Package/iptables-mod-u32
427 $(call Package/iptables/Module, +kmod-ipt-u32)
428 TITLE:=U32 iptables extensions
431 define Package/iptables-mod-u32/description
432 U32 iptables extensions.
439 define Package/iptables-mod-checksum
440 $(call Package/iptables/Module, +kmod-ipt-checksum)
441 TITLE:=IP CHECKSUM target extension
444 define Package/iptables-mod-checksum/description
445 iptables extension for the CHECKSUM calculation target
448 define Package/ip6tables
449 $(call Package/iptables/Default)
450 DEPENDS:=@IPV6 +kmod-ip6tables +iptables
452 TITLE:=IPv6 firewall administration tool
456 define Package/ip6tables-nft
457 $(call Package/iptables/Default)
458 DEPENDS:=ip6tables @IPTABLES_NFTABLES +libxtables-nft
459 TITLE:=IP firewall administration tool nft
462 define Package/ip6tables-nft/description
463 Extra ip6tables nftables nft binaries.
468 iptables-restore-translate
471 define Package/ip6tables-extra
472 $(call Package/iptables/Default)
473 DEPENDS:=ip6tables +kmod-ip6tables-extra
474 TITLE:=IPv6 header matching modules
477 define Package/ip6tables-mod-extra/description
478 iptables header matching modules for IPv6
481 define Package/ip6tables-mod-nat
482 $(call Package/iptables/Default)
483 DEPENDS:=ip6tables +kmod-ipt-nat6
484 TITLE:=IPv6 NAT extensions
487 define Package/ip6tables-mod-nat/description
488 iptables extensions for IPv6-NAT targets.
491 define Package/libiptc
492 $(call Package/iptables/Default)
495 DEPENDS:=+libip4tc +libip6tc +libxtables
497 TITLE:=IPv4/IPv6 firewall - shared libiptc library (nf compatibility stub)
500 define Package/libip4tc
501 $(call Package/iptables/Default)
504 TITLE:=IPv4 firewall - shared libiptc library
509 define Package/libip6tc
510 $(call Package/iptables/Default)
513 TITLE:=IPv6 firewall - shared libiptc library
518 define Package/libxtables
519 $(call Package/iptables/Default)
522 TITLE:=IPv4/IPv6 firewall - shared xtables library
525 +IPTABLES_CONNLABEL:libnetfilter-conntrack \
526 +IPTABLES_NFTABLES:libnftnl
529 define Package/libxtables-nft
530 $(call Package/iptables/Default)
533 TITLE:=IPv4/IPv6 firewall - shared xtables nft library
539 -I$(PKG_BUILD_DIR)/include \
540 -I$(LINUX_DIR)/user_headers/include \
544 -I$(PKG_BUILD_DIR)/include \
545 -I$(LINUX_DIR)/user_headers/include \
546 -ffunction-sections -fdata-sections \
556 --with-kernel="$(LINUX_DIR)/user_headers" \
557 --with-xtlibdir=/usr/lib/iptables \
558 --with-xt-lock-name=/var/run/xtables.lock \
559 $(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
560 $(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
561 $(if $(CONFIG_IPV6),,--disable-ipv6)
564 $(TARGET_CONFIGURE_OPTS) \
565 COPT_FLAGS="$(TARGET_CFLAGS)" \
566 KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
567 KBUILD_OUTPUT="$(LINUX_DIR)" \
568 BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
570 ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
571 define Build/Configure/rebuild
572 $(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
573 rm -f $(PKG_BUILD_DIR)/.config_*
574 rm -f $(PKG_BUILD_DIR)/.configured_*
575 touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
579 define Build/Configure
580 $(Build/Configure/rebuild)
581 $(Build/Configure/Default)
584 define Build/InstallDev
585 $(INSTALL_DIR) $(1)/usr/include
586 $(INSTALL_DIR) $(1)/usr/include/iptables
587 $(INSTALL_DIR) $(1)/usr/include/net/netfilter
589 # XXX: iptables header fixup, some headers are not installed by iptables anymore
590 $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
591 $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
592 $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
593 $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
594 $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
596 $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
597 $(INSTALL_DIR) $(1)/usr/lib
598 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
599 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
600 $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
601 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
602 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
604 # XXX: needed by firewall3
605 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
608 define Package/iptables/install
609 $(INSTALL_DIR) $(1)/usr/sbin
610 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/
611 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
612 $(INSTALL_DIR) $(1)/usr/lib/iptables
615 define Package/iptables-nft/install
616 $(INSTALL_DIR) $(1)/usr/sbin
617 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/
618 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/
619 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/
622 define Package/ip6tables/install
623 $(INSTALL_DIR) $(1)/usr/sbin
624 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
627 define Package/ip6tables-nft/install
628 $(INSTALL_DIR) $(1)/usr/sbin
629 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-nft{,-restore,-save} $(1)/usr/sbin/
630 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/
633 define Package/libiptc/install
634 $(INSTALL_DIR) $(1)/usr/lib
635 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so.* $(1)/usr/lib/
638 define Package/libip4tc/install
639 $(INSTALL_DIR) $(1)/usr/lib
640 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/
641 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
644 define Package/libip6tc/install
645 $(INSTALL_DIR) $(1)/usr/lib
646 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/
647 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
650 define Package/libxtables/install
651 $(INSTALL_DIR) $(1)/usr/lib
652 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/
653 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
656 define Package/libxtables-nft/install
657 $(INSTALL_DIR) $(1)/usr/lib
658 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/
662 define Package/$(1)/install
663 $(INSTALL_DIR) $$(1)/usr/lib/iptables
664 for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
665 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
666 $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
672 $$(eval $$(call BuildPackage,$(1)))
675 $(eval $(call BuildPackage,iptables))
676 $(eval $(call BuildPackage,iptables-nft))
677 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
678 $(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
679 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
680 $(eval $(call BuildPlugin,iptables-mod-physdev,$(IPT_PHYSDEV-m)))
681 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
682 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
683 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
684 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
685 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
686 $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
687 $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
688 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
689 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
690 $(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
691 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
692 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
693 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
694 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
695 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
696 $(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
697 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
698 $(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
699 $(eval $(call BuildPackage,ip6tables))
700 $(eval $(call BuildPackage,ip6tables-nft))
701 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
702 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
703 $(eval $(call BuildPackage,libiptc))
704 $(eval $(call BuildPackage,libip4tc))
705 $(eval $(call BuildPackage,libip6tc))
706 $(eval $(call BuildPackage,libxtables))
707 $(eval $(call BuildPackage,libxtables-nft))