2 # Copyright (C) 2006-2016 OpenWrt.org
4 # This is free software, licensed under the GNU General Public License v2.
5 # See /LICENSE for more information.
8 include $(TOPDIR)/rules.mk
9 include $(INCLUDE_DIR)/kernel.mk
16 PKG_SOURCE_URL:=https://git.netfilter.org/iptables
17 PKG_SOURCE_VERSION:=7df66f1c13563cfbab75246b009ce36f69ee4487
18 PKG_MIRROR_HASH:=22f15ef41fd8e3724bedcee666b7b6a3491d2d038d580ef1fb032718dcb73f14
26 include $(INCLUDE_DIR)/package.mk
28 -include $(LINUX_DIR)/.config
29 include $(INCLUDE_DIR)/netfilter.mk
30 STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | mkhash md5)
34 define Package/iptables/Default
38 URL:=http://netfilter.org/
41 define Package/iptables/Module
42 $(call Package/iptables/Default)
43 DEPENDS:=iptables $(1)
46 define Package/iptables
47 $(call Package/iptables/Default)
48 TITLE:=IP firewall administration tool
50 DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libxtables
53 define Package/iptables/config
54 config IPTABLES_CONNLABEL
55 bool "Enable Connlabel support"
58 This enable connlabel support in iptables.
60 config IPTABLES_NFTABLES
61 bool "Enable Nftables support"
64 This enable nftables support in iptables.
67 define Package/iptables/description
68 IP firewall administration tool.
106 define Package/iptables-mod-conntrack-extra
107 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra)
108 TITLE:=Extra connection tracking extensions
111 define Package/iptables-mod-conntrack-extra/description
112 Extra iptables extensions for connection tracking.
126 define Package/iptables-mod-filter
127 $(call Package/iptables/Module, +kmod-ipt-filter)
128 TITLE:=Content inspection extensions
131 define Package/iptables-mod-filter/description
132 iptables extensions for packet content inspection.
133 Includes support for:
140 define Package/iptables-mod-ipopt
141 $(call Package/iptables/Module, +kmod-ipt-ipopt)
142 TITLE:=IP/Packet option extensions
145 define Package/iptables-mod-ipopt/description
146 iptables extensions for matching/changing IP packet options.
165 define Package/iptables-mod-ipsec
166 $(call Package/iptables/Module, +kmod-ipt-ipsec)
167 TITLE:=IPsec extensions
170 define Package/iptables-mod-ipsec/description
171 iptables extensions for matching ipsec traffic.
180 define Package/iptables-mod-nat-extra
181 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
182 TITLE:=Extra NAT extensions
185 define Package/iptables-mod-nat-extra/description
186 iptables extensions for extra NAT targets.
193 define Package/iptables-mod-ulog
194 $(call Package/iptables/Module, +kmod-ipt-ulog)
195 TITLE:=user-space packet logging
198 define Package/iptables-mod-ulog/description
199 iptables extensions for user-space packet logging.
206 define Package/iptables-mod-nflog
207 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
208 TITLE:=Netfilter NFLOG target
211 define Package/iptables-mod-nflog/description
212 iptables extension for user-space logging via NFNETLINK.
219 define Package/iptables-mod-nfqueue
220 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
221 TITLE:=Netfilter NFQUEUE target
224 define Package/iptables-mod-nfqueue/description
225 iptables extension for user-space queuing via NFNETLINK.
232 define Package/iptables-mod-hashlimit
233 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
234 TITLE:=hashlimit matching
237 define Package/iptables-mod-hashlimit/description
238 iptables extensions for hashlimit matching
245 define Package/iptables-mod-rpfilter
246 $(call Package/iptables/Module, +kmod-ipt-rpfilter)
247 TITLE:=rpfilter iptables extension
250 define Package/iptables-mod-rpfilter/description
251 iptables extensions for reverse path filter test on a packet
258 define Package/iptables-mod-iprange
259 $(call Package/iptables/Module, +kmod-ipt-iprange)
260 TITLE:=IP range extension
263 define Package/iptables-mod-iprange/description
264 iptables extensions for matching ip ranges.
271 define Package/iptables-mod-cluster
272 $(call Package/iptables/Module, +kmod-ipt-cluster)
273 TITLE:=Match cluster extension
276 define Package/iptables-mod-cluster/description
277 iptables extensions for matching cluster.
279 Netfilter (IPv4/IPv6) module for matching cluster
280 This option allows you to build work-load-sharing clusters of
281 network servers/stateful firewalls without having a dedicated
282 load-balancing router/server/switch. Basically, this match returns
283 true when the packet must be handled by this cluster node. Thus,
284 all nodes see all packets and this match decides which node handles
285 what packets. The work-load sharing algorithm is based on source
288 This module is usable for ipv4 and ipv6.
290 If you select it, it enables kmod-ipt-cluster.
292 see `iptables -m cluster --help` for more information.
295 define Package/iptables-mod-clusterip
296 $(call Package/iptables/Module, +kmod-ipt-clusterip)
297 TITLE:=Clusterip extension
300 define Package/iptables-mod-clusterip/description
301 iptables extensions for CLUSTERIP.
302 The CLUSTERIP target allows you to build load-balancing clusters of
303 network servers without having a dedicated load-balancing
304 router/server/switch.
306 If you select it, it enables kmod-ipt-clusterip.
308 see `iptables -j CLUSTERIP --help` for more information.
311 define Package/iptables-mod-extra
312 $(call Package/iptables/Module, +kmod-ipt-extra)
313 TITLE:=Other extra iptables extensions
316 define Package/iptables-mod-extra/description
317 Other extra iptables extensions.
323 - physdev (if ebtables is enabled)
329 define Package/iptables-mod-led
330 $(call Package/iptables/Module, +kmod-ipt-led)
331 TITLE:=LED trigger iptables extension
334 define Package/iptables-mod-led/description
335 iptables extension for triggering a LED.
342 define Package/iptables-mod-tproxy
343 $(call Package/iptables/Module, +kmod-ipt-tproxy)
344 TITLE:=Transparent proxy iptables extensions
347 define Package/iptables-mod-tproxy/description
348 Transparent proxy iptables extensions.
358 define Package/iptables-mod-tee
359 $(call Package/iptables/Module, +kmod-ipt-tee)
360 TITLE:=TEE iptables extensions
363 define Package/iptables-mod-tee/description
364 TEE iptables extensions.
371 define Package/iptables-mod-u32
372 $(call Package/iptables/Module, +kmod-ipt-u32)
373 TITLE:=U32 iptables extensions
376 define Package/iptables-mod-u32/description
377 U32 iptables extensions.
384 define Package/ip6tables
385 $(call Package/iptables/Default)
386 DEPENDS:=@IPV6 +kmod-ip6tables +iptables
388 TITLE:=IPv6 firewall administration tool
393 define Package/ip6tables-extra
394 $(call Package/iptables/Default)
395 DEPENDS:=ip6tables +kmod-ip6tables-extra
396 TITLE:=IPv6 header matching modules
399 define Package/ip6tables-mod-extra/description
400 iptables header matching modules for IPv6
403 define Package/ip6tables-mod-nat
404 $(call Package/iptables/Default)
405 DEPENDS:=ip6tables +kmod-ipt-nat6
406 TITLE:=IPv6 NAT extensions
409 define Package/ip6tables-mod-nat/description
410 iptables extensions for IPv6-NAT targets.
413 define Package/libiptc
414 $(call Package/iptables/Default)
417 DEPENDS:=+libip4tc +libip6tc +libxtables
418 ABI_VERSION:=$(PKG_VERSION)
419 TITLE:=IPv4/IPv6 firewall - shared libiptc library (compatibility stub)
422 define Package/libip4tc
423 $(call Package/iptables/Default)
426 TITLE:=IPv4 firewall - shared libiptc library
427 ABI_VERSION:=$(PKG_VERSION)
431 define Package/libip6tc
432 $(call Package/iptables/Default)
435 TITLE:=IPv6 firewall - shared libiptc library
436 ABI_VERSION:=$(PKG_VERSION)
440 define Package/libxtables
441 $(call Package/iptables/Default)
444 TITLE:=IPv4/IPv6 firewall - shared xtables library
445 ABI_VERSION:=$(PKG_VERSION)
447 +IPTABLES_CONNLABEL:libnetfilter-conntrack \
448 +IPTABLES_NFTABLES:libnftnl
452 -I$(PKG_BUILD_DIR)/include \
453 -I$(LINUX_DIR)/user_headers/include \
457 -I$(PKG_BUILD_DIR)/include \
458 -I$(LINUX_DIR)/user_headers/include \
459 -ffunction-sections -fdata-sections \
469 --with-kernel="$(LINUX_DIR)/user_headers" \
470 --with-xtlibdir=/usr/lib/iptables \
471 $(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
472 $(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
473 $(if $(CONFIG_IPV6),,--disable-ipv6)
476 $(TARGET_CONFIGURE_OPTS) \
477 COPT_FLAGS="$(TARGET_CFLAGS)" \
478 KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
479 KBUILD_OUTPUT="$(LINUX_DIR)" \
480 BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
482 ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
483 define Build/Configure/rebuild
484 $(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
485 rm -f $(PKG_BUILD_DIR)/.config_*
486 rm -f $(PKG_BUILD_DIR)/.configured_*
487 touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
491 define Build/Configure
492 $(Build/Configure/rebuild)
493 $(Build/Configure/Default)
496 define Build/InstallDev
497 $(INSTALL_DIR) $(1)/usr/include
498 $(INSTALL_DIR) $(1)/usr/include/iptables
499 $(INSTALL_DIR) $(1)/usr/include/net/netfilter
501 # XXX: iptables header fixup, some headers are not installed by iptables anymore
502 $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
503 $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
504 $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
505 $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
506 $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
508 $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
509 $(INSTALL_DIR) $(1)/usr/lib
510 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
511 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
512 $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
513 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
514 $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
516 # XXX: needed by firewall3
517 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
520 define Package/iptables/install
521 $(INSTALL_DIR) $(1)/usr/sbin
522 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-multi $(1)/usr/sbin/
523 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore,-save} $(1)/usr/sbin/
524 $(INSTALL_DIR) $(1)/usr/lib/iptables
527 define Package/ip6tables/install
528 $(INSTALL_DIR) $(1)/usr/sbin
529 $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore,-save} $(1)/usr/sbin/
532 define Package/libiptc/install
533 $(INSTALL_DIR) $(1)/usr/lib
534 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libiptc.so* $(1)/usr/lib/
537 define Package/libip4tc/install
538 $(INSTALL_DIR) $(1)/usr/lib
539 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so* $(1)/usr/lib/
540 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
543 define Package/libip6tc/install
544 $(INSTALL_DIR) $(1)/usr/lib
545 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so* $(1)/usr/lib/
546 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
549 define Package/libxtables/install
550 $(INSTALL_DIR) $(1)/usr/lib
551 $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
552 $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
556 define Package/$(1)/install
557 $(INSTALL_DIR) $$(1)/usr/lib/iptables
558 for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
559 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
560 $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
566 $$(eval $$(call BuildPackage,$(1)))
569 $(eval $(call BuildPackage,iptables))
570 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
571 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
572 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
573 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
574 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
575 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
576 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
577 $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
578 $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
579 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
580 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
581 $(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
582 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
583 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
584 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
585 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
586 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
587 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
588 $(eval $(call BuildPackage,ip6tables))
589 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
590 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
591 $(eval $(call BuildPackage,libiptc))
592 $(eval $(call BuildPackage,libip4tc))
593 $(eval $(call BuildPackage,libip6tc))
594 $(eval $(call BuildPackage,libxtables))