KumiSystems/openwrtv4
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
openwrtv4/package/network/config/firewall/Makefile

61 lines
1.8 KiB
Makefile
Raw Normal View History

firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
#
firewall: drop invalid by default, remove chain indirection, fix invert flags (#21738) * Enable drop_invalid by default to catch unnatted packets (#21738) * Fix processing of inversions for -i, -o, -s, -d and -p flags * Remove delegate_* chain indirection but rely on xt_id to identify own rules Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48551
2016-01-29 17:26:41 +00:00
# Copyright (C) 2013-2016 OpenWrt.org
firewall3: fix mark rules for local traffic, fix race condition Update to latest HEAD in order to fix MARK rule generation for local traffic, also fix a possible race condition during firewall start. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-05-02 17:46:23 +00:00
# Copyright (C) 2016 LEDE project
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
PKG_NAME:=firewall
treewide: clean up and unify PKG_VERSION for git based downloads Also use default defintions for PKG_SOURCE_SUBDIR, PKG_SOURCE Signed-off-by: Felix Fietkau <nbd@nbd.name>
2016-12-21 21:25:41 +00:00
PKG_RELEASE:=1
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
PKG_SOURCE_PROTO:=git
package/*: update git urls for project repos Signed-off-by: John Crispin <john@phrozen.org>
2016-06-06 19:16:47 +00:00
PKG_SOURCE_URL=$(LEDE_GIT)/project/firewall3.git
firewall: fix forwarding local subnet traffic Packets which are merely forwarded by the router and which are neither involved in any DNAT/SNAT nor originate locally, are considered INVALID from a conntrack point of view, causing them to get dropped in the zone_*_dest_ACCEPT chains, since those only allow stream with state NEW or UNTRACKED. Remove the ctstate restriction on dest accept chains to properly pass- through unrelated 3rd party traffic. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2017-01-13 17:31:08 +00:00
PKG_SOURCE_DATE:=2017-01-13
PKG_SOURCE_VERSION:=37cb4cb437fd685f31926a4c326ba8afe329e4a6
PKG_MIRROR_HASH:=7ee075f05977e5d9a78e661b537e6eb077c8f328ff2e71d1e2fbef44cca97355
firewall3: fix mark rules for local traffic, fix race condition Update to latest HEAD in order to fix MARK rule generation for local traffic, also fix a possible race condition during firewall start. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-05-02 17:46:23 +00:00
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
Add a few SPDX tags Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 43151
2014-11-02 12:20:54 +00:00
PKG_LICENSE:=ISC
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
firewall: add CONFIG_IPV6 to PKG_CONFIG_DEPENDS to fix a rebuild error Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48315
2016-01-18 13:21:37 +00:00
PKG_CONFIG_DEPENDS := CONFIG_IPV6
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
define Package/firewall
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
SECTION:=net
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
CATEGORY:=Base system
TITLE:=OpenWrt C Firewall
firewall: depend on kmod-ipt-conntrack (#20542) Our ruleset requires kernel support for conntrack state matching, therfore depend on the require kmod. Fixes #20542. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 46990
2015-09-17 15:31:45 +00:00
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +kmod-ipt-nat
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
endef
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
define Package/firewall/description
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
This package provides a config-compatible C implementation of the UCI firewall.
endef
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
define Package/firewall/conffiles
firewall3: add default config and firewall.user SVN-Revision: 35889
2013-03-05 13:45:09 +00:00
/etc/config/firewall
/etc/firewall.user
endef
firewall3: update to git head * use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions * make ipset integration more reliable SVN-Revision: 36681
2013-05-21 10:15:14 +00:00
TARGET_CFLAGS += -ffunction-sections -fdata-sections
firewall3: update to git head - fixes linking issues with some toolchains SVN-Revision: 36703
2013-05-24 12:49:06 +00:00
TARGET_LDFLAGS += -Wl,--gc-sections
firewall3: update to git head - allows building without IPv6 support - uses more robust rules to cope with missing libext.a - uses better linking strategy to avoid symbol clashes with older iptables - introduces source compatiblity layer for different libxtables versions SVN-Revision: 36736
2013-05-27 15:13:19 +00:00
CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)
firewall3: update to git head * use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions * make ipset integration more reliable SVN-Revision: 36681
2013-05-21 10:15:14 +00:00
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
define Package/firewall/install
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
$(INSTALL_DIR) $(1)/sbin
firewall3: fix accidentally changed install directive SVN-Revision: 36840
2013-06-04 12:30:50 +00:00
$(INSTALL_BIN) $(PKG_BUILD_DIR)/firewall3 $(1)/sbin/fw3
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
$(INSTALL_DIR) $(1)/etc/init.d
$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall
$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
$(INSTALL_DATA) ./files/firewall.hotplug $(1)/etc/hotplug.d/iface/20-firewall
firewall3: add default config and firewall.user SVN-Revision: 35889
2013-03-05 13:45:09 +00:00
$(INSTALL_DIR) $(1)/etc/config/
$(INSTALL_DATA) ./files/firewall.config $(1)/etc/config/firewall
$(INSTALL_DIR) $(1)/etc/
$(INSTALL_DATA) ./files/firewall.user $(1)/etc/firewall.user
firewall3 - a C implementation of the current firewall scripts SVN-Revision: 35643
2013-02-17 19:26:52 +00:00
endef
firewall3: rename to firewall, move into base system menu, update to git head with compatibility fixes for AA SVN-Revision: 36838
2013-06-04 12:21:52 +00:00
$(eval $(call BuildPackage,firewall))
Reference in a new issue Copy permalink