package/kernel/linux/modules/netfilter.mk

   1
   2 #
   3 # Copyright (C) 2006-2010 OpenWrt.org
   4 #
   5 # This is free software, licensed under the GNU General Public License v2.
   6 # See /LICENSE for more information.
   7 #
   8
   9 NF_MENU:=Netfilter Extensions
  10 NF_KMOD:=1
  11 include $(INCLUDE_DIR)/netfilter.mk
  12
  13
  14 define KernelPackage/nf-ipt
  15   SUBMENU:=$(NF_MENU)
  16   TITLE:=Iptables core
  17   KCONFIG:= \
  18         CONFIG_NETFILTER=y \
  19         CONFIG_NETFILTER_ADVANCED=y \
  20         $(KCONFIG_NF_IPT)
  21   FILES:=$(foreach mod,$(NF_IPT-m),$(LINUX_DIR)/net/$(mod).ko)
  22   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT-m)))
  23 endef
  24
  25 $(eval $(call KernelPackage,nf-ipt))
  26
  27
  28 define KernelPackage/nf-ipt6
  29   SUBMENU:=$(NF_MENU)
  30   TITLE:=Ip6tables core
  31   KCONFIG:=$(KCONFIG_NF_IPT6)
  32   FILES:=$(foreach mod,$(NF_IPT6-m),$(LINUX_DIR)/net/$(mod).ko)
  33   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_IPT6-m)))
  34   DEPENDS:=+kmod-nf-ipt +kmod-nf-conntrack6
  35 endef
  36
  37 $(eval $(call KernelPackage,nf-ipt6))
  38
  39
  40
  41 define KernelPackage/ipt-core
  42   SUBMENU:=$(NF_MENU)
  43   TITLE:=Iptables core
  44   KCONFIG:=$(KCONFIG_IPT_CORE)
  45   FILES:=$(foreach mod,$(IPT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
  46   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CORE-m)))
  47   DEPENDS:=+kmod-nf-ipt
  48 endef
  49
  50 define KernelPackage/ipt-core/description
  51  Netfilter core kernel modules
  52  Includes:
  53  - comment
  54  - limit
  55  - LOG
  56  - mac
  57  - multiport
  58  - REJECT
  59  - TCPMSS
  60 endef
  61
  62 $(eval $(call KernelPackage,ipt-core))
  63
  64
  65 define KernelPackage/nf-conntrack
  66   SUBMENU:=$(NF_MENU)
  67   TITLE:=Netfilter connection tracking
  68   KCONFIG:= \
  69         CONFIG_NETFILTER=y \
  70         CONFIG_NETFILTER_ADVANCED=y \
  71         $(KCONFIG_NF_CONNTRACK)
  72   FILES:=$(foreach mod,$(NF_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
  73   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
  74 endef
  75
  76 $(eval $(call KernelPackage,nf-conntrack))
  77
  78
  79 define KernelPackage/nf-conntrack6
  80   SUBMENU:=$(NF_MENU)
  81   TITLE:=Netfilter IPv6 connection tracking
  82   KCONFIG:=$(KCONFIG_NF_CONNTRACK6)
  83   DEPENDS:=+kmod-ipv6 +kmod-nf-conntrack
  84   FILES:=$(foreach mod,$(NF_CONNTRACK6-m),$(LINUX_DIR)/net/$(mod).ko)
  85   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK6-m)))
  86 endef
  87
  88 $(eval $(call KernelPackage,nf-conntrack6))
  89
  90
  91 define KernelPackage/nf-nat
  92   SUBMENU:=$(NF_MENU)
  93   TITLE:=Netfilter NAT
  94   KCONFIG:=$(KCONFIG_NF_NAT)
  95   DEPENDS:=+kmod-nf-conntrack +kmod-nf-ipt
  96   FILES:=$(foreach mod,$(NF_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
  97   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT-m)))
  98 endef
  99
 100 $(eval $(call KernelPackage,nf-nat))
 101
 102
 103 define KernelPackage/nf-nat6
 104   SUBMENU:=$(NF_MENU)
 105   TITLE:=Netfilter IPV6-NAT
 106   KCONFIG:=$(KCONFIG_NF_NAT6)
 107   DEPENDS:=+kmod-nf-conntrack6 +kmod-nf-ipt6 +kmod-nf-nat
 108   FILES:=$(foreach mod,$(NF_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 109   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NAT6-m)))
 110 endef
 111
 112 $(eval $(call KernelPackage,nf-nat6))
 113
 114
 115 define AddDepends/ipt
 116   SUBMENU:=$(NF_MENU)
 117   DEPENDS+= +kmod-ipt-core $(1)
 118 endef
 119
 120
 121 define KernelPackage/ipt-conntrack
 122   TITLE:=Basic connection tracking modules
 123   KCONFIG:=$(KCONFIG_IPT_CONNTRACK)
 124   FILES:=$(foreach mod,$(IPT_CONNTRACK-m),$(LINUX_DIR)/net/$(mod).ko)
 125   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK-m)))
 126   $(call AddDepends/ipt,+kmod-nf-conntrack)
 127 endef
 128
 129 define KernelPackage/ipt-conntrack/description
 130  Netfilter (IPv4) kernel modules for connection tracking
 131  Includes:
 132  - conntrack
 133  - defrag
 134  - iptables_raw
 135  - NOTRACK
 136  - state
 137 endef
 138
 139 $(eval $(call KernelPackage,ipt-conntrack))
 140
 141
 142 define KernelPackage/ipt-conntrack-extra
 143   TITLE:=Extra connection tracking modules
 144   KCONFIG:=$(KCONFIG_IPT_CONNTRACK_EXTRA)
 145   FILES:=$(foreach mod,$(IPT_CONNTRACK_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 146   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CONNTRACK_EXTRA-m)))
 147   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 148 endef
 149
 150 define KernelPackage/ipt-conntrack-extra/description
 151  Netfilter (IPv4) extra kernel modules for connection tracking
 152  Includes:
 153  - connbytes
 154  - connmark/CONNMARK
 155  - conntrack
 156  - helper
 157  - recent
 158 endef
 159
 160 $(eval $(call KernelPackage,ipt-conntrack-extra))
 161
 162
 163 define KernelPackage/ipt-filter
 164   TITLE:=Modules for packet content inspection
 165   KCONFIG:=$(KCONFIG_IPT_FILTER)
 166   FILES:=$(foreach mod,$(IPT_FILTER-m),$(LINUX_DIR)/net/$(mod).ko)
 167   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_FILTER-m)))
 168   $(call AddDepends/ipt,+kmod-lib-textsearch +kmod-ipt-conntrack)
 169 endef
 170
 171 define KernelPackage/ipt-filter/description
 172  Netfilter (IPv4) kernel modules for packet content inspection
 173  Includes:
 174  - layer7
 175  - string
 176 endef
 177
 178 $(eval $(call KernelPackage,ipt-filter))
 179
 180
 181 define KernelPackage/ipt-ipopt
 182   TITLE:=Modules for matching/changing IP packet options
 183   KCONFIG:=$(KCONFIG_IPT_IPOPT)
 184   FILES:=$(foreach mod,$(IPT_IPOPT-m),$(LINUX_DIR)/net/$(mod).ko)
 185   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPOPT-m)))
 186   $(call AddDepends/ipt)
 187 endef
 188
 189 define KernelPackage/ipt-ipopt/description
 190  Netfilter (IPv4) modules for matching/changing IP packet options
 191  Includes:
 192  - CLASSIFY
 193  - dscp/DSCP
 194  - ecn/ECN
 195  - hl/HL
 196  - length
 197  - mark/MARK
 198  - statistic
 199  - tcpmss
 200  - time
 201  - ttl/TTL
 202  - unclean
 203 endef
 204
 205 $(eval $(call KernelPackage,ipt-ipopt))
 206
 207
 208 define KernelPackage/ipt-ipsec
 209   TITLE:=Modules for matching IPSec packets
 210   KCONFIG:=$(KCONFIG_IPT_IPSEC)
 211   FILES:=$(foreach mod,$(IPT_IPSEC-m),$(LINUX_DIR)/net/$(mod).ko)
 212   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPSEC-m)))
 213   $(call AddDepends/ipt)
 214 endef
 215
 216 define KernelPackage/ipt-ipsec/description
 217  Netfilter (IPv4) modules for matching IPSec packets
 218  Includes:
 219  - ah
 220  - esp
 221  - policy
 222 endef
 223
 224 $(eval $(call KernelPackage,ipt-ipsec))
 225
 226
 227 define KernelPackage/ipt-nat
 228   TITLE:=Basic NAT targets
 229   KCONFIG:=$(KCONFIG_IPT_NAT)
 230   FILES:=$(foreach mod,$(IPT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 231   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT-m)))
 232   $(call AddDepends/ipt,+kmod-nf-nat)
 233 endef
 234
 235 define KernelPackage/ipt-nat/description
 236  Netfilter (IPv4) kernel modules for basic NAT targets
 237  Includes:
 238  - MASQUERADE
 239 endef
 240
 241 $(eval $(call KernelPackage,ipt-nat))
 242
 243
 244 define KernelPackage/ipt-nat6
 245   TITLE:=IPv6 NAT targets
 246   KCONFIG:=$(KCONFIG_IPT_NAT6)
 247   FILES:=$(foreach mod,$(IPT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 248   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_NAT6-m)))
 249   $(call AddDepends/ipt,+kmod-nf-nat6)
 250   $(call AddDepends/ipt,+kmod-ipt-conntrack)
 251   $(call AddDepends/ipt,+kmod-ipt-nat)
 252   $(call AddDepends/ipt,+kmod-ip6tables)
 253 endef
 254
 255 define KernelPackage/ipt-nat6/description
 256  Netfilter (IPv6) kernel modules for NAT targets
 257 endef
 258
 259 $(eval $(call KernelPackage,ipt-nat6))
 260
 261
 262 define KernelPackage/ipt-nat-extra
 263   TITLE:=Extra NAT targets
 264   KCONFIG:=$(KCONFIG_IPT_NAT_EXTRA)
 265   FILES:=$(foreach mod,$(IPT_NAT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 266   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NAT_EXTRA-m)))
 267   $(call AddDepends/ipt,+kmod-ipt-nat)
 268 endef
 269
 270 define KernelPackage/ipt-nat-extra/description
 271  Netfilter (IPv4) kernel modules for extra NAT targets
 272  Includes:
 273  - NETMAP
 274  - REDIRECT
 275 endef
 276
 277 $(eval $(call KernelPackage,ipt-nat-extra))
 278
 279
 280 define KernelPackage/nf-nathelper
 281   SUBMENU:=$(NF_MENU)
 282   TITLE:=Basic Conntrack and NAT helpers
 283   KCONFIG:=$(KCONFIG_NF_NATHELPER)
 284   FILES:=$(foreach mod,$(NF_NATHELPER-m),$(LINUX_DIR)/net/$(mod).ko)
 285   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER-m)))
 286   DEPENDS:=+kmod-nf-nat
 287 endef
 288
 289 define KernelPackage/nf-nathelper/description
 290  Default Netfilter (IPv4) Conntrack and NAT helpers
 291  Includes:
 292  - ftp
 293  - irc
 294  - tftp
 295 endef
 296
 297 $(eval $(call KernelPackage,nf-nathelper))
 298
 299
 300 define KernelPackage/nf-nathelper-extra
 301   SUBMENU:=$(NF_MENU)
 302   TITLE:=Extra Conntrack and NAT helpers
 303   KCONFIG:=$(KCONFIG_NF_NATHELPER_EXTRA)
 304   FILES:=$(foreach mod,$(NF_NATHELPER_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 305   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_NATHELPER_EXTRA-m)))
 306   DEPENDS:=+kmod-nf-nat +kmod-lib-textsearch
 307 endef
 308
 309 define KernelPackage/nf-nathelper-extra/description
 310  Extra Netfilter (IPv4) Conntrack and NAT helpers
 311  Includes:
 312  - amanda
 313  - h323
 314  - mms
 315  - pptp
 316  - proto_gre
 317  - sip
 318  - snmp_basic
 319  - broadcast
 320 endef
 321
 322 $(eval $(call KernelPackage,nf-nathelper-extra))
 323
 324
 325 define KernelPackage/ipt-queue
 326   TITLE:=Module for user-space packet queueing
 327   KCONFIG:=$(KCONFIG_IPT_QUEUE)
 328   DEPENDS:=@!LINUX_3_6
 329   FILES:=$(foreach mod,$(IPT_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 330   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_QUEUE-m)))
 331   $(call AddDepends/ipt)
 332 endef
 333
 334 define KernelPackage/ipt-queue/description
 335  Netfilter (IPv4) module for user-space packet queueing
 336  Includes:
 337  - QUEUE
 338 endef
 339
 340 $(eval $(call KernelPackage,ipt-queue))
 341
 342
 343 define KernelPackage/ipt-ulog
 344   TITLE:=Module for user-space packet logging
 345   KCONFIG:=$(KCONFIG_IPT_ULOG)
 346   FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
 347   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
 348   $(call AddDepends/ipt)
 349 endef
 350
 351 define KernelPackage/ipt-ulog/description
 352  Netfilter (IPv4) module for user-space packet logging
 353  Includes:
 354  - ULOG
 355 endef
 356
 357 $(eval $(call KernelPackage,ipt-ulog))
 358
 359
 360 define KernelPackage/ipt-nflog
 361   TITLE:=Module for user-space packet logging
 362   KCONFIG:=$(KCONFIG_IPT_NFLOG)
 363   FILES:=$(foreach mod,$(IPT_NFLOG-m),$(LINUX_DIR)/net/$(mod).ko)
 364   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFLOG-m)))
 365   $(call AddDepends/ipt,+kmod-nfnetlink-log)
 366 endef
 367
 368 define KernelPackage/ipt-nflog/description
 369  Netfilter module for user-space packet logging
 370  Includes:
 371  - NFLOG
 372 endef
 373
 374 $(eval $(call KernelPackage,ipt-nflog))
 375
 376
 377 define KernelPackage/ipt-nfqueue
 378   TITLE:=Module for user-space packet queuing
 379   KCONFIG:=$(KCONFIG_IPT_NFQUEUE)
 380   FILES:=$(foreach mod,$(IPT_NFQUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 381   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_NFQUEUE-m)))
 382   $(call AddDepends/ipt,+kmod-nfnetlink-queue)
 383 endef
 384
 385 define KernelPackage/ipt-nfqueue/description
 386  Netfilter module for user-space packet queuing
 387  Includes:
 388  - NFQUEUE
 389 endef
 390
 391 $(eval $(call KernelPackage,ipt-nfqueue))
 392
 393
 394 define KernelPackage/ipt-debug
 395   TITLE:=Module for debugging/development
 396   KCONFIG:=$(KCONFIG_IPT_DEBUG)
 397   DEFAULT:=n
 398   FILES:=$(foreach mod,$(IPT_DEBUG-m),$(LINUX_DIR)/net/$(mod).ko)
 399   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_DEBUG-m)))
 400   $(call AddDepends/ipt)
 401 endef
 402
 403 define KernelPackage/ipt-debug/description
 404  Netfilter modules for debugging/development of the firewall
 405  Includes:
 406  - TRACE
 407 endef
 408
 409 $(eval $(call KernelPackage,ipt-debug))
 410
 411
 412 define KernelPackage/ipt-led
 413   TITLE:=Module to trigger a LED with a Netfilter rule
 414   KCONFIG:=$(KCONFIG_IPT_LED)
 415   FILES:=$(foreach mod,$(IPT_LED-m),$(LINUX_DIR)/net/$(mod).ko)
 416   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_LED-m)))
 417   $(call AddDepends/ipt)
 418 endef
 419
 420 define KernelPackage/ipt-led/description
 421  Netfilter target to trigger a LED when a network packet is matched.
 422 endef
 423
 424 $(eval $(call KernelPackage,ipt-led))
 425
 426 define KernelPackage/ipt-tproxy
 427   TITLE:=Transparent proxying support
 428   DEPENDS+=+kmod-ipt-conntrack +IPV6:kmod-ipv6 +IPV6:kmod-ip6tables
 429   KCONFIG:= \
 430         CONFIG_NETFILTER_TPROXY \
 431         CONFIG_NETFILTER_XT_MATCH_SOCKET \
 432         CONFIG_NETFILTER_XT_TARGET_TPROXY
 433   FILES:= \
 434         $(if $(call kernel_patchver_lt,3.12),$(LINUX_DIR)/net/netfilter/nf_tproxy_core.ko) \
 435         $(foreach mod,$(IPT_TPROXY-m),$(LINUX_DIR)/net/$(mod).ko)
 436   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tproxy_core $(IPT_TPROXY-m)))
 437   $(call AddDepends/ipt)
 438 endef
 439
 440 define KernelPackage/ipt-tproxy/description
 441   Kernel modules for Transparent Proxying
 442 endef
 443
 444 $(eval $(call KernelPackage,ipt-tproxy))
 445
 446 define KernelPackage/ipt-tee
 447   TITLE:=TEE support
 448   DEPENDS:=+kmod-ipt-conntrack +IPV6:kmod-ipv6
 449   KCONFIG:= \
 450         CONFIG_NETFILTER_XT_TARGET_TEE
 451   FILES:= \
 452         $(LINUX_DIR)/net/netfilter/xt_TEE.ko \
 453         $(foreach mod,$(IPT_TEE-m),$(LINUX_DIR)/net/$(mod).ko)
 454   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_TEE-m)))
 455   $(call AddDepends/ipt)
 456 endef
 457
 458 define KernelPackage/ipt-tee/description
 459   Kernel modules for TEE
 460 endef
 461
 462 $(eval $(call KernelPackage,ipt-tee))
 463
 464
 465 define KernelPackage/ipt-u32
 466   TITLE:=U32 support
 467   KCONFIG:= \
 468         CONFIG_NETFILTER_XT_MATCH_U32
 469   FILES:= \
 470         $(LINUX_DIR)/net/netfilter/xt_u32.ko \
 471         $(foreach mod,$(IPT_U32-m),$(LINUX_DIR)/net/$(mod).ko)
 472   AUTOLOAD:=$(call AutoProbe,$(notdir nf_tee $(IPT_U32-m)))
 473   $(call AddDepends/ipt)
 474 endef
 475
 476 define KernelPackage/ipt-u32/description
 477   Kernel modules for U32
 478 endef
 479
 480 $(eval $(call KernelPackage,ipt-u32))
 481
 482
 483 define KernelPackage/ipt-iprange
 484   TITLE:=Module for matching ip ranges
 485   KCONFIG:=$(KCONFIG_IPT_IPRANGE)
 486   FILES:=$(foreach mod,$(IPT_IPRANGE-m),$(LINUX_DIR)/net/$(mod).ko)
 487   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_IPRANGE-m)))
 488   $(call AddDepends/ipt)
 489 endef
 490
 491 define KernelPackage/ipt-iprange/description
 492  Netfilter (IPv4) module for matching ip ranges
 493  Includes:
 494  - iprange
 495 endef
 496
 497 $(eval $(call KernelPackage,ipt-iprange))
 498
 499 define KernelPackage/ipt-cluster
 500   TITLE:=Module for matching cluster
 501   KCONFIG:=$(KCONFIG_IPT_CLUSTER)
 502   FILES:=$(foreach mod,$(IPT_CLUSTER-m),$(LINUX_DIR)/net/$(mod).ko)
 503   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTER-m)))
 504   $(call AddDepends/ipt)
 505 endef
 506
 507 define KernelPackage/ipt-cluster/description
 508  Netfilter (IPv4/IPv6) module for matching cluster
 509  This option allows you to build work-load-sharing clusters of
 510  network servers/stateful firewalls without having a dedicated
 511  load-balancing router/server/switch. Basically, this match returns
 512  true when the packet must be handled by this cluster node. Thus,
 513  all nodes see all packets and this match decides which node handles
 514  what packets. The work-load sharing algorithm is based on source
 515  address hashing.
 516
 517  This module is usable for ipv4 and ipv6.
 518
 519  To use it also enable iptables-mod-cluster
 520
 521  see `iptables -m cluster --help` for more information.
 522 endef
 523
 524 $(eval $(call KernelPackage,ipt-cluster))
 525
 526 define KernelPackage/ipt-clusterip
 527   TITLE:=Module for CLUSTERIP
 528   KCONFIG:=$(KCONFIG_IPT_CLUSTERIP)
 529   FILES:=$(foreach mod,$(IPT_CLUSTERIP-m),$(LINUX_DIR)/net/$(mod).ko)
 530   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_CLUSTERIP-m)))
 531   $(call AddDepends/ipt,+kmod-nf-conntrack)
 532 endef
 533
 534 define KernelPackage/ipt-clusterip/description
 535  Netfilter (IPv4-only) module for CLUSTERIP
 536  The CLUSTERIP target allows you to build load-balancing clusters of
 537  network servers without having a dedicated load-balancing
 538  router/server/switch.
 539
 540  To use it also enable iptables-mod-clusterip
 541
 542  see `iptables -j CLUSTERIP --help` for more information.
 543 endef
 544
 545 $(eval $(call KernelPackage,ipt-clusterip))
 546
 547
 548 define KernelPackage/ipt-extra
 549   TITLE:=Extra modules
 550   KCONFIG:=$(KCONFIG_IPT_EXTRA)
 551   FILES:=$(foreach mod,$(IPT_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 552   AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_EXTRA-m)))
 553   $(call AddDepends/ipt)
 554 endef
 555
 556 define KernelPackage/ipt-extra/description
 557  Other Netfilter (IPv4) kernel modules
 558  Includes:
 559  - addrtype
 560  - owner
 561  - physdev (if bridge support was enabled in kernel)
 562  - pkttype
 563  - quota
 564 endef
 565
 566 $(eval $(call KernelPackage,ipt-extra))
 567
 568
 569 define KernelPackage/ip6tables
 570   SUBMENU:=$(NF_MENU)
 571   TITLE:=IPv6 modules
 572   DEPENDS:=+kmod-nf-ipt6 +kmod-ipt-core +kmod-ipt-conntrack
 573   KCONFIG:=$(KCONFIG_IPT_IPV6)
 574   FILES:=$(foreach mod,$(IPT_IPV6-m),$(LINUX_DIR)/net/$(mod).ko)
 575   AUTOLOAD:=$(call AutoLoad,42,$(notdir $(IPT_IPV6-m)))
 576 endef
 577
 578 define KernelPackage/ip6tables/description
 579  Netfilter IPv6 firewalling support
 580 endef
 581
 582 $(eval $(call KernelPackage,ip6tables))
 583
 584 define KernelPackage/ip6tables-extra
 585   SUBMENU:=$(NF_MENU)
 586   TITLE:=Extra IPv6 modules
 587   DEPENDS:=+kmod-ip6tables
 588   KCONFIG:=$(KCONFIG_IPT_IPV6_EXTRA)
 589   FILES:=$(foreach mod,$(IPT_IPV6_EXTRA-m),$(LINUX_DIR)/net/$(mod).ko)
 590   AUTOLOAD:=$(call AutoLoad,43,$(notdir $(IPT_IPV6_EXTRA-m)))
 591 endef
 592
 593 define KernelPackage/ip6tables-extra/description
 594  Netfilter IPv6 extra header matching modules
 595 endef
 596
 597 $(eval $(call KernelPackage,ip6tables-extra))
 598
 599 ARP_MODULES = arp_tables arpt_mangle arptable_filter
 600 define KernelPackage/arptables
 601   SUBMENU:=$(NF_MENU)
 602   TITLE:=ARP firewalling modules
 603   DEPENDS:=+kmod-ipt-core
 604   FILES:=$(LINUX_DIR)/net/ipv4/netfilter/arp*.ko
 605   KCONFIG:=CONFIG_IP_NF_ARPTABLES \
 606     CONFIG_IP_NF_ARPFILTER \
 607     CONFIG_IP_NF_ARP_MANGLE
 608   AUTOLOAD:=$(call AutoProbe,$(ARP_MODULES))
 609 endef
 610
 611 define KernelPackage/arptables/description
 612  Kernel modules for ARP firewalling
 613 endef
 614
 615 $(eval $(call KernelPackage,arptables))
 616
 617
 618 define KernelPackage/ebtables
 619   SUBMENU:=$(NF_MENU)
 620   TITLE:=Bridge firewalling modules
 621   DEPENDS:=+kmod-ipt-core +kmod-bridge
 622   FILES:=$(foreach mod,$(EBTABLES-m),$(LINUX_DIR)/net/$(mod).ko)
 623   KCONFIG:=CONFIG_BRIDGE_NETFILTER=y \
 624         $(KCONFIG_EBTABLES)
 625   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES-m)))
 626 endef
 627
 628 define KernelPackage/ebtables/description
 629   ebtables is a general, extensible frame/packet identification
 630   framework. It provides you to do Ethernet
 631   filtering/NAT/brouting on the Ethernet bridge.
 632 endef
 633
 634 $(eval $(call KernelPackage,ebtables))
 635
 636
 637 define AddDepends/ebtables
 638   SUBMENU:=$(NF_MENU)
 639   DEPENDS+=kmod-ebtables $(1)
 640 endef
 641
 642
 643 define KernelPackage/ebtables-ipv4
 644   TITLE:=ebtables: IPv4 support
 645   FILES:=$(foreach mod,$(EBTABLES_IP4-m),$(LINUX_DIR)/net/$(mod).ko)
 646   KCONFIG:=$(KCONFIG_EBTABLES_IP4)
 647   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP4-m)))
 648   $(call AddDepends/ebtables)
 649 endef
 650
 651 define KernelPackage/ebtables-ipv4/description
 652  This option adds the IPv4 support to ebtables, which allows basic
 653  IPv4 header field filtering, ARP filtering as well as SNAT, DNAT targets.
 654 endef
 655
 656 $(eval $(call KernelPackage,ebtables-ipv4))
 657
 658
 659 define KernelPackage/ebtables-ipv6
 660   TITLE:=ebtables: IPv6 support
 661   FILES:=$(foreach mod,$(EBTABLES_IP6-m),$(LINUX_DIR)/net/$(mod).ko)
 662   KCONFIG:=$(KCONFIG_EBTABLES_IP6)
 663   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_IP6-m)))
 664   $(call AddDepends/ebtables)
 665 endef
 666
 667 define KernelPackage/ebtables-ipv6/description
 668  This option adds the IPv6 support to ebtables, which allows basic
 669  IPv6 header field filtering and target support.
 670 endef
 671
 672 $(eval $(call KernelPackage,ebtables-ipv6))
 673
 674
 675 define KernelPackage/ebtables-watchers
 676   TITLE:=ebtables: watchers support
 677   FILES:=$(foreach mod,$(EBTABLES_WATCHERS-m),$(LINUX_DIR)/net/$(mod).ko)
 678   KCONFIG:=$(KCONFIG_EBTABLES_WATCHERS)
 679   AUTOLOAD:=$(call AutoProbe,$(notdir $(EBTABLES_WATCHERS-m)))
 680   $(call AddDepends/ebtables)
 681 endef
 682
 683 define KernelPackage/ebtables-watchers/description
 684  This option adds the log watchers, that you can use in any rule
 685  in any ebtables table.
 686 endef
 687
 688 $(eval $(call KernelPackage,ebtables-watchers))
 689
 690
 691 define KernelPackage/nfnetlink
 692   SUBMENU:=$(NF_MENU)
 693   TITLE:=Netlink-based userspace interface
 694   FILES:=$(foreach mod,$(NFNETLINK-m),$(LINUX_DIR)/net/$(mod).ko)
 695   KCONFIG:=$(KCONFIG_NFNETLINK)
 696   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK-m)))
 697 endef
 698
 699 define KernelPackage/nfnetlink/description
 700  Kernel modules support for a netlink-based userspace interface
 701 endef
 702
 703 $(eval $(call KernelPackage,nfnetlink))
 704
 705
 706 define AddDepends/nfnetlink
 707   SUBMENU:=$(NF_MENU)
 708   DEPENDS+=+kmod-nfnetlink $(1)
 709 endef
 710
 711
 712 define KernelPackage/nfnetlink-log
 713   TITLE:=Netfilter LOG over NFNETLINK interface
 714   FILES:=$(foreach mod,$(NFNETLINK_LOG-m),$(LINUX_DIR)/net/$(mod).ko)
 715   KCONFIG:=$(KCONFIG_NFNETLINK_LOG)
 716   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_LOG-m)))
 717   $(call AddDepends/nfnetlink)
 718 endef
 719
 720 define KernelPackage/nfnetlink-log/description
 721  Kernel modules support for logging packets via NFNETLINK
 722  Includes:
 723  - NFLOG
 724 endef
 725
 726 $(eval $(call KernelPackage,nfnetlink-log))
 727
 728
 729 define KernelPackage/nfnetlink-queue
 730   TITLE:=Netfilter QUEUE over NFNETLINK interface
 731   FILES:=$(foreach mod,$(NFNETLINK_QUEUE-m),$(LINUX_DIR)/net/$(mod).ko)
 732   KCONFIG:=$(KCONFIG_NFNETLINK_QUEUE)
 733   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFNETLINK_QUEUE-m)))
 734   $(call AddDepends/nfnetlink)
 735 endef
 736
 737 define KernelPackage/nfnetlink-queue/description
 738  Kernel modules support for queueing packets via NFNETLINK
 739  Includes:
 740  - NFQUEUE
 741 endef
 742
 743 $(eval $(call KernelPackage,nfnetlink-queue))
 744
 745
 746 define KernelPackage/nf-conntrack-netlink
 747   TITLE:=Connection tracking netlink interface
 748   FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
 749   KCONFIG:=CONFIG_NF_CT_NETLINK
 750   AUTOLOAD:=$(call AutoProbe,nf_conntrack_netlink)
 751   $(call AddDepends/nfnetlink,+kmod-ipt-conntrack)
 752 endef
 753
 754 define KernelPackage/nf-conntrack-netlink/description
 755  Kernel modules support for a netlink-based connection tracking
 756  userspace interface
 757 endef
 758
 759 $(eval $(call KernelPackage,nf-conntrack-netlink))
 760
 761 define KernelPackage/ipt-hashlimit
 762   SUBMENU:=$(NF_MENU)
 763   TITLE:=Netfilter hashlimit match
 764   DEPENDS:=+kmod-ipt-core
 765   KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
 766   FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.ko
 767   AUTOLOAD:=$(call AutoProbe,xt_hashlimit)
 768   $(call KernelPackage/ipt)
 769 endef
 770
 771 define KernelPackage/ipt-hashlimit/description
 772  Kernel modules support for the hashlimit bucket match module
 773 endef
 774
 775 $(eval $(call KernelPackage,ipt-hashlimit))
 776
 777
 778 define KernelPackage/nft-core
 779   SUBMENU:=$(NF_MENU)
 780   TITLE:=Netfilter nf_tables support
 781   DEPENDS:=+kmod-nfnetlink +kmod-nf-conntrack6
 782   FILES:=$(foreach mod,$(NFT_CORE-m),$(LINUX_DIR)/net/$(mod).ko)
 783   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_CORE-m)))
 784   KCONFIG:= \
 785         CONFIG_NETFILTER=y \
 786         CONFIG_NETFILTER_ADVANCED=y \
 787         CONFIG_NFT_COMPAT=n \
 788         CONFIG_NFT_QUEUE=n \
 789         CONFIG_NF_TABLES_ARP=n \
 790         CONFIG_NF_TABLES_BRIDGE=n \
 791         $(KCONFIG_NFT_CORE)
 792 endef
 793
 794 define KernelPackage/nft-core/description
 795  Kernel module support for nftables
 796 endef
 797
 798 $(eval $(call KernelPackage,nft-core))
 799
 800
 801 define KernelPackage/nft-nat
 802   SUBMENU:=$(NF_MENU)
 803   TITLE:=Netfilter nf_tables NAT support
 804   DEPENDS:=+kmod-nft-core +kmod-nf-nat
 805   FILES:=$(foreach mod,$(NFT_NAT-m),$(LINUX_DIR)/net/$(mod).ko)
 806   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT-m)))
 807   KCONFIG:=$(KCONFIG_NFT_NAT)
 808 endef
 809
 810 $(eval $(call KernelPackage,nft-nat))
 811
 812
 813 define KernelPackage/nft-nat6
 814   SUBMENU:=$(NF_MENU)
 815   TITLE:=Netfilter nf_tables IPv6-NAT support
 816   DEPENDS:=+kmod-nft-core +kmod-nf-nat6
 817   FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
 818   AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
 819   KCONFIG:=$(KCONFIG_NFT_NAT6)
 820 endef
 821
 822 $(eval $(call KernelPackage,nft-nat6))
 823