package/network/utils/iptables/Makefile

   1 #
   2 # Copyright (C) 2006-2016 OpenWrt.org
   3 #
   4 # This is free software, licensed under the GNU General Public License v2.
   5 # See /LICENSE for more information.
   6 #
   7
   8 include $(TOPDIR)/rules.mk
   9 include $(INCLUDE_DIR)/kernel.mk
  10
  11 PKG_NAME:=iptables
  12 PKG_VERSION:=1.8.7
  13 PKG_RELEASE:=5
  14
  15 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
  16 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
  17 PKG_HASH:=c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0
  18
  19 PKG_FIXUP:=autoreconf
  20 PKG_FLAGS:=nonshared
  21
  22 PKG_INSTALL:=1
  23 PKG_BUILD_PARALLEL:=1
  24 PKG_LICENSE:=GPL-2.0
  25 PKG_CPE_ID:=cpe:/a:netfilter_core_team:iptables
  26
  27 include $(INCLUDE_DIR)/package.mk
  28 ifeq ($(DUMP),)
  29   -include $(LINUX_DIR)/.config
  30   include $(INCLUDE_DIR)/netfilter.mk
  31   STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell grep 'NETFILTER' $(LINUX_DIR)/.config | $(MKHASH) md5)
  32 endif
  33
  34
  35 define Package/iptables/Default
  36   SECTION:=net
  37   CATEGORY:=Network
  38   SUBMENU:=Firewall
  39   URL:=https://netfilter.org/
  40 endef
  41
  42 define Package/iptables/Module
  43 $(call Package/iptables/Default)
  44   DEPENDS:=+libxtables $(1)
  45 endef
  46
  47 define Package/iptables-legacy
  48 $(call Package/iptables/Default)
  49   TITLE:=IP firewall administration tool
  50   DEPENDS+= +kmod-ipt-core +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 +libxtables
  51   PROVIDES:=iptables
  52   ALTERNATIVES:=\
  53     200:/usr/sbin/iptables:/usr/sbin/xtables-legacy-multi \
  54     200:/usr/sbin/iptables-restore:/usr/sbin/xtables-legacy-multi \
  55     200:/usr/sbin/iptables-save:/usr/sbin/xtables-legacy-multi
  56 endef
  57
  58 define Package/iptables-legacy/description
  59 IP firewall administration tool.
  60
  61  Matches:
  62   - icmp
  63   - tcp
  64   - udp
  65   - comment
  66   - conntrack
  67   - limit
  68   - mac
  69   - mark
  70   - multiport
  71   - set
  72   - state
  73   - time
  74
  75  Targets:
  76   - ACCEPT
  77   - CT
  78   - DNAT
  79   - DROP
  80   - REJECT
  81   - FLOWOFFLOAD
  82   - LOG
  83   - MARK
  84   - MASQUERADE
  85   - REDIRECT
  86   - SET
  87   - SNAT
  88   - TCPMSS
  89
  90  Tables:
  91   - filter
  92   - mangle
  93   - nat
  94   - raw
  95
  96 endef
  97
  98 define Package/iptables-nft
  99 $(call Package/iptables/Default)
 100   TITLE:=IP firewall administration tool nft
 101   DEPENDS:=@IPTABLES_NFTABLES +libnftnl +libiptext +IPV6:libiptext6 +libiptext-nft +kmod-ipt-core +kmod-nft-compat
 102   PROVIDES:=iptables
 103   ALTERNATIVES:=\
 104     300:/usr/sbin/iptables:/usr/sbin/xtables-nft-multi \
 105     300:/usr/sbin/iptables-restore:/usr/sbin/xtables-nft-multi \
 106     300:/usr/sbin/iptables-save:/usr/sbin/xtables-nft-multi
 107 endef
 108
 109 define Package/iptables-nft/description
 110 Extra iptables nftables nft binaries.
 111   iptables-nft
 112   iptables-nft-restore
 113   iptables-nft-save
 114   iptables-translate
 115   iptables-restore-translate
 116 endef
 117
 118 define Package/iptables-mod-conntrack-extra
 119 $(call Package/iptables/Module, +kmod-ipt-conntrack-extra +kmod-ipt-raw)
 120   TITLE:=Extra connection tracking extensions
 121 endef
 122
 123 define Package/iptables-mod-conntrack-extra/description
 124 Extra iptables extensions for connection tracking.
 125
 126  Matches:
 127   - connbytes
 128   - connlimit
 129   - connmark
 130   - recent
 131   - helper
 132
 133  Targets:
 134   - CONNMARK
 135
 136 endef
 137
 138 define Package/iptables-mod-conntrack-label
 139 $(call Package/iptables/Module, +kmod-ipt-conntrack-label @IPTABLES_CONNLABEL)
 140   TITLE:=Connection tracking labeling extension
 141   DEFAULT:=y if IPTABLES_CONNLABEL
 142 endef
 143
 144 define Package/iptables-mod-conntrack-label/description
 145 Match and set label(s) on connection tracking entries
 146
 147  Matches:
 148   - connlabel
 149
 150 endef
 151
 152 define Package/iptables-mod-filter
 153 $(call Package/iptables/Module, +kmod-ipt-filter)
 154   TITLE:=Content inspection extensions
 155 endef
 156
 157 define Package/iptables-mod-filter/description
 158 iptables extensions for packet content inspection.
 159 Includes support for:
 160
 161  Matches:
 162   - string
 163   - bpf
 164
 165 endef
 166
 167 define Package/iptables-mod-ipopt
 168 $(call Package/iptables/Module, +kmod-ipt-ipopt)
 169   TITLE:=IP/Packet option extensions
 170 endef
 171
 172 define Package/iptables-mod-ipopt/description
 173 iptables extensions for matching/changing IP packet options.
 174
 175  Matches:
 176   - dscp
 177   - ecn
 178   - length
 179   - statistic
 180   - tcpmss
 181   - unclean
 182   - hl
 183
 184  Targets:
 185   - DSCP
 186   - CLASSIFY
 187   - ECN
 188   - HL
 189
 190 endef
 191
 192 define Package/iptables-mod-ipsec
 193 $(call Package/iptables/Module, +kmod-ipt-ipsec)
 194   TITLE:=IPsec extensions
 195 endef
 196
 197 define Package/iptables-mod-ipsec/description
 198 iptables extensions for matching ipsec traffic.
 199
 200  Matches:
 201   - ah
 202   - esp
 203   - policy
 204
 205 endef
 206
 207 define Package/iptables-mod-nat-extra
 208 $(call Package/iptables/Module, +kmod-ipt-nat-extra)
 209   TITLE:=Extra NAT extensions
 210 endef
 211
 212 define Package/iptables-mod-nat-extra/description
 213 iptables extensions for extra NAT targets.
 214
 215  Targets:
 216   - MIRROR
 217   - NETMAP
 218 endef
 219
 220 define Package/iptables-mod-ulog
 221 $(call Package/iptables/Module, +kmod-ipt-ulog)
 222   TITLE:=user-space packet logging
 223 endef
 224
 225 define Package/iptables-mod-ulog/description
 226 iptables extensions for user-space packet logging.
 227
 228  Targets:
 229   - ULOG
 230
 231 endef
 232
 233 define Package/iptables-mod-nflog
 234 $(call Package/iptables/Module, +kmod-nfnetlink-log +kmod-ipt-nflog)
 235   TITLE:=Netfilter NFLOG target
 236 endef
 237
 238 define Package/iptables-mod-nflog/description
 239  iptables extension for user-space logging via NFNETLINK.
 240
 241  Includes:
 242   - libxt_NFLOG
 243
 244 endef
 245
 246 define Package/iptables-mod-trace
 247 $(call Package/iptables/Module, +kmod-ipt-debug)
 248   TITLE:=Netfilter TRACE target
 249 endef
 250
 251 define Package/iptables-mod-trace/description
 252  iptables extension for TRACE target
 253
 254  Includes:
 255   - libxt_TRACE
 256
 257 endef
 258
 259
 260 define Package/iptables-mod-nfqueue
 261 $(call Package/iptables/Module, +kmod-nfnetlink-queue +kmod-ipt-nfqueue)
 262   TITLE:=Netfilter NFQUEUE target
 263 endef
 264
 265 define Package/iptables-mod-nfqueue/description
 266  iptables extension for user-space queuing via NFNETLINK.
 267
 268  Includes:
 269   - libxt_NFQUEUE
 270
 271 endef
 272
 273 define Package/iptables-mod-hashlimit
 274 $(call Package/iptables/Module, +kmod-ipt-hashlimit)
 275   TITLE:=hashlimit matching
 276 endef
 277
 278 define Package/iptables-mod-hashlimit/description
 279 iptables extensions for hashlimit matching
 280
 281  Matches:
 282   - hashlimit
 283
 284 endef
 285
 286 define Package/iptables-mod-rpfilter
 287 $(call Package/iptables/Module, +kmod-ipt-rpfilter)
 288   TITLE:=rpfilter iptables extension
 289 endef
 290
 291 define Package/iptables-mod-rpfilter/description
 292 iptables extensions for reverse path filter test on a packet
 293
 294  Matches:
 295   - rpfilter
 296
 297 endef
 298
 299 define Package/iptables-mod-iprange
 300 $(call Package/iptables/Module, +kmod-ipt-iprange)
 301   TITLE:=IP range extension
 302 endef
 303
 304 define Package/iptables-mod-iprange/description
 305 iptables extensions for matching ip ranges.
 306
 307  Matches:
 308   - iprange
 309
 310 endef
 311
 312 define Package/iptables-mod-cluster
 313 $(call Package/iptables/Module, +kmod-ipt-cluster)
 314   TITLE:=Match cluster extension
 315 endef
 316
 317 define Package/iptables-mod-cluster/description
 318 iptables extensions for matching cluster.
 319
 320  Netfilter (IPv4/IPv6) module for matching cluster
 321  This option allows you to build work-load-sharing clusters of
 322  network servers/stateful firewalls without having a dedicated
 323  load-balancing router/server/switch. Basically, this match returns
 324  true when the packet must be handled by this cluster node. Thus,
 325  all nodes see all packets and this match decides which node handles
 326  what packets. The work-load sharing algorithm is based on source
 327  address hashing.
 328
 329  This module is usable for ipv4 and ipv6.
 330
 331  If you select it, it enables kmod-ipt-cluster.
 332
 333  see `iptables -m cluster --help` for more information.
 334 endef
 335
 336 define Package/iptables-mod-clusterip
 337 $(call Package/iptables/Module, +kmod-ipt-clusterip)
 338   TITLE:=Clusterip extension
 339 endef
 340
 341 define Package/iptables-mod-clusterip/description
 342 iptables extensions for CLUSTERIP.
 343  The CLUSTERIP target allows you to build load-balancing clusters of
 344  network servers without having a dedicated load-balancing
 345  router/server/switch.
 346
 347  If you select it, it enables kmod-ipt-clusterip.
 348
 349  see `iptables -j CLUSTERIP --help` for more information.
 350 endef
 351
 352 define Package/iptables-mod-extra
 353 $(call Package/iptables/Module, +kmod-ipt-extra)
 354   TITLE:=Other extra iptables extensions
 355 endef
 356
 357 define Package/iptables-mod-extra/description
 358 Other extra iptables extensions.
 359
 360  Matches:
 361   - addrtype
 362   - condition
 363   - owner
 364   - pkttype
 365   - quota
 366
 367 endef
 368
 369 define Package/iptables-mod-physdev
 370 $(call Package/iptables/Module, +kmod-ipt-physdev)
 371   TITLE:=physdev iptables extension
 372 endef
 373
 374 define Package/iptables-mod-physdev/description
 375 The iptables physdev match.
 376 endef
 377
 378 define Package/iptables-mod-led
 379 $(call Package/iptables/Module, +kmod-ipt-led)
 380   TITLE:=LED trigger iptables extension
 381 endef
 382
 383 define Package/iptables-mod-led/description
 384 iptables extension for triggering a LED.
 385
 386  Targets:
 387   - LED
 388
 389 endef
 390
 391 define Package/iptables-mod-socket
 392 $(call Package/iptables/Module, +kmod-ipt-socket)
 393   TITLE:=Socket match iptables extensions
 394 endef
 395
 396 define Package/iptables-mod-socket/description
 397 Socket match iptables extensions.
 398
 399  Matches:
 400   - socket
 401
 402 endef
 403
 404 define Package/iptables-mod-tproxy
 405 $(call Package/iptables/Module, +kmod-ipt-tproxy)
 406   TITLE:=Transparent proxy iptables extensions
 407 endef
 408
 409 define Package/iptables-mod-tproxy/description
 410 Transparent proxy iptables extensions.
 411
 412  Targets:
 413   - TPROXY
 414
 415 endef
 416
 417 define Package/iptables-mod-tee
 418 $(call Package/iptables/Module, +kmod-ipt-tee)
 419   TITLE:=TEE iptables extensions
 420 endef
 421
 422 define Package/iptables-mod-tee/description
 423 TEE iptables extensions.
 424
 425  Targets:
 426   - TEE
 427
 428 endef
 429
 430 define Package/iptables-mod-u32
 431 $(call Package/iptables/Module, +kmod-ipt-u32)
 432   TITLE:=U32 iptables extensions
 433 endef
 434
 435 define Package/iptables-mod-u32/description
 436 U32 iptables extensions.
 437
 438  Matches:
 439   - u32
 440
 441 endef
 442
 443 define Package/iptables-mod-checksum
 444 $(call Package/iptables/Module, +kmod-ipt-checksum)
 445   TITLE:=IP CHECKSUM target extension
 446 endef
 447
 448 define Package/iptables-mod-checksum/description
 449 iptables extension for the CHECKSUM calculation target
 450 endef
 451
 452 define Package/ip6tables-legacy
 453 $(call Package/iptables/Default)
 454   DEPENDS:=@IPV6 +kmod-ip6tables +iptables-legacy
 455   CATEGORY:=Network
 456   TITLE:=IPv6 firewall administration tool
 457   PROVIDES:=ip6tables
 458   ALTERNATIVES:=\
 459     200:/usr/sbin/ip6tables:/usr/sbin/xtables-legacy-multi \
 460     200:/usr/sbin/ip6tables-restore:/usr/sbin/xtables-legacy-multi \
 461     200:/usr/sbin/ip6tables-save:/usr/sbin/xtables-legacy-multi
 462 endef
 463
 464 define Package/ip6tables-nft
 465 $(call Package/iptables/Default)
 466   DEPENDS:=@IPV6 +kmod-ip6tables +iptables-nft
 467   TITLE:=IP firewall administration tool nft
 468   PROVIDES:=ip6tables
 469   ALTERNATIVES:=\
 470     300:/usr/sbin/ip6tables:/usr/sbin/xtables-nft-multi \
 471     300:/usr/sbin/ip6tables-restore:/usr/sbin/xtables-nft-multi \
 472     300:/usr/sbin/ip6tables-save:/usr/sbin/xtables-nft-multi
 473 endef
 474
 475 define Package/ip6tables-nft/description
 476 Extra ip6tables nftables nft binaries.
 477   ip6tables-nft
 478   ip6tables-nft-restore
 479   ip6tables-nft-save
 480   ip6tables-translate
 481   ip6tables-restore-translate
 482 endef
 483
 484 define Package/ip6tables-extra
 485 $(call Package/iptables/Default)
 486   DEPENDS:=+libxtables +kmod-ip6tables-extra
 487   TITLE:=IPv6 header matching modules
 488 endef
 489
 490 define Package/ip6tables-extra/description
 491 iptables header matching modules for IPv6
 492 endef
 493
 494 define Package/ip6tables-mod-nat
 495 $(call Package/iptables/Default)
 496   DEPENDS:=+libxtables +kmod-ipt-nat6
 497   TITLE:=IPv6 NAT extensions
 498 endef
 499
 500 define Package/ip6tables-mod-nat/description
 501 iptables extensions for IPv6-NAT targets.
 502 endef
 503
 504 define Package/libip4tc
 505 $(call Package/iptables/Default)
 506   SECTION:=libs
 507   CATEGORY:=Libraries
 508   TITLE:=IPv4 firewall - shared libiptc library
 509   ABI_VERSION:=2
 510 endef
 511
 512 define Package/libip6tc
 513 $(call Package/iptables/Default)
 514   SECTION:=libs
 515   CATEGORY:=Libraries
 516   TITLE:=IPv6 firewall - shared libiptc library
 517   ABI_VERSION:=2
 518 endef
 519
 520 define Package/libiptext
 521  $(call Package/iptables/Default)
 522  SECTION:=libs
 523  CATEGORY:=Libraries
 524  TITLE:=IPv4 firewall - shared libiptext library
 525  ABI_VERSION:=0
 526  DEPENDS:=+libxtables
 527 endef
 528
 529 define Package/libiptext6
 530  $(call Package/iptables/Default)
 531  SECTION:=libs
 532  CATEGORY:=Libraries
 533  TITLE:=IPv6 firewall - shared libiptext library
 534  ABI_VERSION:=0
 535  DEPENDS:=+libxtables
 536 endef
 537
 538 define Package/libiptext-nft
 539  $(call Package/iptables/Default)
 540  SECTION:=libs
 541  CATEGORY:=Libraries
 542  TITLE:=IPv4/IPv6 firewall - shared libiptext nft library
 543  ABI_VERSION:=0
 544  DEPENDS:=@IPTABLES_NFTABLES +libxtables
 545 endef
 546
 547 define Package/libxtables
 548  $(call Package/iptables/Default)
 549  SECTION:=libs
 550  CATEGORY:=Libraries
 551  TITLE:=IPv4/IPv6 firewall - shared xtables library
 552  MENU:=1
 553  ABI_VERSION:=12
 554  DEPENDS:=+IPTABLES_CONNLABEL:libnetfilter-conntrack
 555 endef
 556
 557 define Package/libxtables/config
 558   config IPTABLES_CONNLABEL
 559         bool "Enable Connlabel support"
 560         default n
 561         help
 562                 This enable connlabel support in iptables.
 563
 564   config IPTABLES_NFTABLES
 565         bool "Enable Nftables support"
 566         default y
 567         help
 568                 This enable nftables support in iptables.
 569 endef
 570
 571 TARGET_CPPFLAGS := \
 572         -I$(PKG_BUILD_DIR)/include \
 573         -I$(LINUX_DIR)/user_headers/include \
 574         $(TARGET_CPPFLAGS)
 575
 576 TARGET_CFLAGS += \
 577         -I$(PKG_BUILD_DIR)/include \
 578         -I$(LINUX_DIR)/user_headers/include \
 579         -ffunction-sections -fdata-sections \
 580         -DNO_LEGACY
 581
 582 TARGET_LDFLAGS += \
 583         -Wl,--gc-sections
 584
 585 CONFIGURE_ARGS += \
 586         --enable-shared \
 587         --enable-static \
 588         --enable-devel \
 589         --with-kernel="$(LINUX_DIR)/user_headers" \
 590         --with-xtlibdir=/usr/lib/iptables \
 591         --with-xt-lock-name=/var/run/xtables.lock \
 592         $(if $(CONFIG_IPTABLES_CONNLABEL),,--disable-connlabel) \
 593         $(if $(CONFIG_IPTABLES_NFTABLES),,--disable-nftables) \
 594         $(if $(CONFIG_IPV6),,--disable-ipv6)
 595
 596 MAKE_FLAGS := \
 597         $(TARGET_CONFIGURE_OPTS) \
 598         COPT_FLAGS="$(TARGET_CFLAGS)" \
 599         KERNEL_DIR="$(LINUX_DIR)/user_headers/" PREFIX=/usr \
 600         KBUILD_OUTPUT="$(LINUX_DIR)" \
 601         BUILTIN_MODULES="$(patsubst ip6t_%,%,$(patsubst ipt_%,%,$(patsubst xt_%,%,$(IPT_BUILTIN) $(IPT_CONNTRACK-m) $(IPT_NAT-m))))"
 602
 603 ifneq ($(wildcard $(PKG_BUILD_DIR)/.config_*),$(subst .configured_,.config_,$(STAMP_CONFIGURED)))
 604   define Build/Configure/rebuild
 605         $(FIND) $(PKG_BUILD_DIR) -name \*.o -or -name \*.\?o -or -name \*.a | $(XARGS) rm -f
 606         rm -f $(PKG_BUILD_DIR)/.config_*
 607         rm -f $(PKG_BUILD_DIR)/.configured_*
 608         touch $(subst .configured_,.config_,$(STAMP_CONFIGURED))
 609   endef
 610 endif
 611
 612 define Build/Configure
 613 $(Build/Configure/rebuild)
 614 $(Build/Configure/Default)
 615 endef
 616
 617 define Build/InstallDev
 618         $(INSTALL_DIR) $(1)/usr/include
 619         $(INSTALL_DIR) $(1)/usr/include/iptables
 620         $(INSTALL_DIR) $(1)/usr/include/net/netfilter
 621
 622         # XXX: iptables header fixup, some headers are not installed by iptables anymore
 623         $(CP) $(PKG_BUILD_DIR)/include/iptables/*.h $(1)/usr/include/iptables/
 624         $(CP) $(PKG_BUILD_DIR)/include/iptables.h $(1)/usr/include/
 625         $(CP) $(PKG_BUILD_DIR)/include/ip6tables.h $(1)/usr/include/
 626         $(CP) $(PKG_BUILD_DIR)/include/libipulog $(1)/usr/include/
 627         $(CP) $(PKG_BUILD_DIR)/include/libiptc $(1)/usr/include/
 628
 629         $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
 630         $(INSTALL_DIR) $(1)/usr/lib
 631         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so* $(1)/usr/lib/
 632         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip*tc.so* $(1)/usr/lib/
 633         $(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 634         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/xtables.pc $(1)/usr/lib/pkgconfig/
 635         $(CP) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libip*tc.pc $(1)/usr/lib/pkgconfig/
 636
 637         # XXX: needed by firewall3
 638         $(CP) $(PKG_BUILD_DIR)/extensions/libiptext*.so $(1)/usr/lib/
 639 endef
 640
 641 define Package/iptables-legacy/install
 642         $(INSTALL_DIR) $(1)/usr/sbin
 643         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-legacy-multi $(1)/usr/sbin/
 644         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-legacy{,-restore,-save} $(1)/usr/sbin/
 645         $(INSTALL_DIR) $(1)/usr/lib/iptables
 646 endef
 647
 648 define Package/iptables-nft/install
 649         $(INSTALL_DIR) $(1)/usr/sbin
 650         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/xtables-nft-multi $(1)/usr/sbin/
 651         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables-nft{,-restore,-save} $(1)/usr/sbin/
 652         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/iptables{,-restore}-translate $(1)/usr/sbin/
 653 endef
 654
 655 define Package/ip6tables-legacy/install
 656         $(INSTALL_DIR) $(1)/usr/sbin
 657         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-legacy{,-restore,-save} $(1)/usr/sbin/
 658 endef
 659
 660 define Package/ip6tables-nft/install
 661         $(INSTALL_DIR) $(1)/usr/sbin
 662         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables-nft{,-restore,-save} $(1)/usr/sbin/
 663         $(CP) $(PKG_INSTALL_DIR)/usr/sbin/ip6tables{,-restore}-translate $(1)/usr/sbin/
 664 endef
 665
 666 define Package/libip4tc/install
 667         $(INSTALL_DIR) $(1)/usr/lib
 668         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip4tc.so.* $(1)/usr/lib/
 669 endef
 670
 671 define Package/libip6tc/install
 672         $(INSTALL_DIR) $(1)/usr/lib
 673         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libip6tc.so.* $(1)/usr/lib/
 674 endef
 675
 676 define Package/libiptext/install
 677         $(INSTALL_DIR) $(1)/usr/lib
 678         $(CP) $(PKG_BUILD_DIR)/extensions/libiptext.so $(1)/usr/lib/
 679         $(CP) $(PKG_BUILD_DIR)/extensions/libiptext4.so $(1)/usr/lib/
 680 endef
 681
 682 define Package/libiptext6/install
 683         $(INSTALL_DIR) $(1)/usr/lib
 684         $(CP) $(PKG_BUILD_DIR)/extensions/libiptext6.so $(1)/usr/lib/
 685 endef
 686
 687 define Package/libiptext-nft/install
 688         $(INSTALL_DIR) $(1)/usr/lib
 689         $(CP) $(PKG_BUILD_DIR)/extensions/libiptext_*.so $(1)/usr/lib/
 690 endef
 691
 692 define Package/libxtables/install
 693         $(INSTALL_DIR) $(1)/usr/lib
 694         $(CP) $(PKG_INSTALL_DIR)/usr/lib/libxtables.so.* $(1)/usr/lib/
 695 endef
 696
 697 define BuildPlugin
 698   define Package/$(1)/install
 699         $(INSTALL_DIR) $$(1)/usr/lib/iptables
 700         for m in $(patsubst xt_%,ipt_%,$(2)) $(patsubst ipt_%,xt_%,$(2)) $(patsubst xt_%,ip6t_%,$(2)) $(patsubst ip6t_%,xt_%,$(2)); do \
 701                 if [ -f $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so ]; then \
 702                         $(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib$$$$$$$${m}.so $$(1)/usr/lib/iptables/ ; \
 703                 fi; \
 704         done
 705         $(3)
 706   endef
 707
 708   $$(eval $$(call BuildPackage,$(1)))
 709 endef
 710
 711 $(eval $(call BuildPackage,libxtables))
 712 $(eval $(call BuildPackage,libip4tc))
 713 $(eval $(call BuildPackage,libip6tc))
 714 $(eval $(call BuildPackage,libiptext))
 715 $(eval $(call BuildPackage,libiptext6))
 716 $(eval $(call BuildPackage,libiptext-nft))
 717 $(eval $(call BuildPackage,iptables-legacy))
 718 $(eval $(call BuildPackage,iptables-nft))
 719 $(eval $(call BuildPlugin,iptables-mod-conntrack-extra,$(IPT_CONNTRACK_EXTRA-m)))
 720 $(eval $(call BuildPlugin,iptables-mod-conntrack-label,$(IPT_CONNTRACK_LABEL-m)))
 721 $(eval $(call BuildPlugin,iptables-mod-extra,$(IPT_EXTRA-m)))
 722 $(eval $(call BuildPlugin,iptables-mod-physdev,$(IPT_PHYSDEV-m)))
 723 $(eval $(call BuildPlugin,iptables-mod-filter,$(IPT_FILTER-m)))
 724 $(eval $(call BuildPlugin,iptables-mod-ipopt,$(IPT_IPOPT-m)))
 725 $(eval $(call BuildPlugin,iptables-mod-ipsec,$(IPT_IPSEC-m)))
 726 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 727 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 728 $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
 729 $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
 730 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
 731 $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 732 $(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
 733 $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
 734 $(eval $(call BuildPlugin,iptables-mod-socket,$(IPT_SOCKET-m)))
 735 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 736 $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
 737 $(eval $(call BuildPlugin,iptables-mod-u32,$(IPT_U32-m)))
 738 $(eval $(call BuildPlugin,iptables-mod-nflog,$(IPT_NFLOG-m)))
 739 $(eval $(call BuildPlugin,iptables-mod-trace,$(IPT_DEBUG-m)))
 740 $(eval $(call BuildPlugin,iptables-mod-nfqueue,$(IPT_NFQUEUE-m)))
 741 $(eval $(call BuildPlugin,iptables-mod-checksum,$(IPT_CHECKSUM-m)))
 742 $(eval $(call BuildPackage,ip6tables-legacy))
 743 $(eval $(call BuildPackage,ip6tables-nft))
 744 $(eval $(call BuildPlugin,ip6tables-extra,$(IPT_IPV6_EXTRA-m)))
 745 $(eval $(call BuildPlugin,ip6tables-mod-nat,$(IPT_NAT6-m)))
 746