openwrtv4/package/network/config/firewall/Makefile

#
# Copyright (C) 2013-2016 OpenWrt.org
# Copyright (C) 2016 LEDE project
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#

include $(TOPDIR)/rules.mk

PKG_NAME:=firewall
PKG_RELEASE:=2

PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL=$(LEDE_GIT)/project/firewall3.git
PKG_SOURCE_DATE:=2017-05-09
PKG_SOURCE_VERSION:=c328d1f6fe982888b5f5852423ee0a41cee3adb1
PKG_MIRROR_HASH:=ca7d5aa038489afa9241ba36781c70237a41f8c4622612c933ea452b6d0c6ece
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
PKG_LICENSE:=ISC

PKG_CONFIG_DEPENDS := CONFIG_IPV6

include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk

define Package/firewall
  SECTION:=net
  CATEGORY:=Base system
  TITLE:=OpenWrt C Firewall
  DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +kmod-ipt-nat
endef

define Package/firewall/description
 This package provides a config-compatible C implementation of the UCI firewall.
endef

define Package/firewall/conffiles
/etc/config/firewall
/etc/firewall.user
endef

TARGET_CFLAGS += -ffunction-sections -fdata-sections
TARGET_LDFLAGS += -Wl,--gc-sections
CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)

define Package/firewall/install
	$(INSTALL_DIR) $(1)/sbin
	$(INSTALL_BIN) $(PKG_BUILD_DIR)/firewall3 $(1)/sbin/fw3
	$(INSTALL_DIR) $(1)/etc/init.d
	$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall
	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
	$(INSTALL_DATA) ./files/firewall.hotplug $(1)/etc/hotplug.d/iface/20-firewall
	$(INSTALL_DIR) $(1)/etc/config/
	$(INSTALL_DATA) ./files/firewall.config $(1)/etc/config/firewall
	$(INSTALL_DIR) $(1)/etc/
	$(INSTALL_DATA) ./files/firewall.user $(1)/etc/firewall.user
endef

$(eval $(call BuildPackage,firewall))
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`#`
firewall: drop invalid by default, remove chain indirection, fix invert flags (#21738) * Enable drop_invalid by default to catch unnatted packets (#21738) * Fix processing of inversions for -i, -o, -s, -d and -p flags * Remove delegate_* chain indirection but rely on xt_id to identify own rules Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48551 2016-01-29 17:26:41 +00:00			`# Copyright (C) 2013-2016 OpenWrt.org`
firewall3: fix mark rules for local traffic, fix race condition Update to latest HEAD in order to fix MARK rule generation for local traffic, also fix a possible race condition during firewall start. Signed-off-by: Jo-Philipp Wich <jo@mein.io> 2016-05-02 17:46:23 +00:00			`# Copyright (C) 2016 LEDE project`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`#`
			`# This is free software, licensed under the GNU General Public License v2.`
			`# See /LICENSE for more information.`
			`#`

			`include $(TOPDIR)/rules.mk`

firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`PKG_NAME:=firewall`
firewall: document rules for IPSec ESP/ISAKMP with 'name' option These are recommended practices by REC-22 and REC-24 of RFC6092: "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" Fixes FS#640 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com> 2017-03-28 09:41:14 +00:00			`PKG_RELEASE:=2`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00
			`PKG_SOURCE_PROTO:=git`
package/*: update git urls for project repos Signed-off-by: John Crispin <john@phrozen.org> 2016-06-06 19:16:47 +00:00			`PKG_SOURCE_URL=$(LEDE_GIT)/project/firewall3.git`
firewall: update to the latest version, fixes a gcc7 build error Signed-off-by: Felix Fietkau <nbd@nbd.name> 2017-05-04 14:11:27 +00:00			`PKG_SOURCE_DATE:=2017-05-09`
			`PKG_SOURCE_VERSION:=c328d1f6fe982888b5f5852423ee0a41cee3adb1`
			`PKG_MIRROR_HASH:=ca7d5aa038489afa9241ba36781c70237a41f8c4622612c933ea452b6d0c6ece`
firewall3: fix mark rules for local traffic, fix race condition Update to latest HEAD in order to fix MARK rule generation for local traffic, also fix a possible race condition during firewall start. Signed-off-by: Jo-Philipp Wich <jo@mein.io> 2016-05-02 17:46:23 +00:00			`PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>`
Add a few SPDX tags Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 43151 2014-11-02 12:20:54 +00:00			`PKG_LICENSE:=ISC`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00
firewall: add CONFIG_IPV6 to PKG_CONFIG_DEPENDS to fix a rebuild error Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48315 2016-01-18 13:21:37 +00:00			`PKG_CONFIG_DEPENDS := CONFIG_IPV6`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00
			`include $(INCLUDE_DIR)/package.mk`
			`include $(INCLUDE_DIR)/cmake.mk`

firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`define Package/firewall`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`SECTION:=net`
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`CATEGORY:=Base system`
			`TITLE:=OpenWrt C Firewall`
firewall: depend on kmod-ipt-conntrack (#20542) Our ruleset requires kernel support for conntrack state matching, therfore depend on the require kmod. Fixes #20542. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 46990 2015-09-17 15:31:45 +00:00			`DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +kmod-ipt-nat`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`endef`

firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`define Package/firewall/description`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`This package provides a config-compatible C implementation of the UCI firewall.`
			`endef`

firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`define Package/firewall/conffiles`
firewall3: add default config and firewall.user SVN-Revision: 35889 2013-03-05 13:45:09 +00:00			`/etc/config/firewall`
			`/etc/firewall.user`
			`endef`

firewall3: update to git head * use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions * make ipset integration more reliable SVN-Revision: 36681 2013-05-21 10:15:14 +00:00			`TARGET_CFLAGS += -ffunction-sections -fdata-sections`
firewall3: update to git head - fixes linking issues with some toolchains SVN-Revision: 36703 2013-05-24 12:49:06 +00:00			`TARGET_LDFLAGS += -Wl,--gc-sections`
firewall3: update to git head - allows building without IPv6 support - uses more robust rules to cope with missing libext.a - uses better linking strategy to avoid symbol clashes with older iptables - introduces source compatiblity layer for different libxtables versions SVN-Revision: 36736 2013-05-27 15:13:19 +00:00			`CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)`
firewall3: update to git head * use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions * make ipset integration more reliable SVN-Revision: 36681 2013-05-21 10:15:14 +00:00
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`define Package/firewall/install`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`$(INSTALL_DIR) $(1)/sbin`
firewall3: fix accidentally changed install directive SVN-Revision: 36840 2013-06-04 12:30:50 +00:00			`$(INSTALL_BIN) $(PKG_BUILD_DIR)/firewall3 $(1)/sbin/fw3`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`$(INSTALL_DIR) $(1)/etc/init.d`
			`$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall`
			`$(INSTALL_DIR) $(1)/etc/hotplug.d/iface`
			`$(INSTALL_DATA) ./files/firewall.hotplug $(1)/etc/hotplug.d/iface/20-firewall`
firewall3: add default config and firewall.user SVN-Revision: 35889 2013-03-05 13:45:09 +00:00			`$(INSTALL_DIR) $(1)/etc/config/`
			`$(INSTALL_DATA) ./files/firewall.config $(1)/etc/config/firewall`
			`$(INSTALL_DIR) $(1)/etc/`
			`$(INSTALL_DATA) ./files/firewall.user $(1)/etc/firewall.user`
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643 2013-02-17 19:26:52 +00:00			`endef`

firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838 2013-06-04 12:21:52 +00:00			`$(eval $(call BuildPackage,firewall))`