freebsd-dev/sbin/ipfw/Makefile

# $FreeBSD$

.include <src.opts.mk>

PACKAGE=ipfw
PROG=	ipfw
SRCS=	ipfw2.c dummynet.c ipv6.c main.c nat.c tables.c
SRCS+=	nat64lsn.c nat64stl.c nptv6.c
WARNS?=	2

.if ${MK_PF} != "no"
SRCS+=	altq.c
CFLAGS+=-DPF
.endif

LIBADD=	jail util
MAN=	ipfw.8

.include <bsd.prog.mk>
Convert this Makefile to the usual style. 2000-10-06 11:18:11 +00:00			`# $FreeBSD$`
Submitted by: Whistle Communications (archie Cobbs) these are quite extensive additions to the ipfw code. they include a change to the API because the old method was broken, but the user view is kept the same. The new code allows a particular match to skip forward to a particular line number, so that blocks of rules can be used without checking all the intervening rules. There are also many more ways of rejecting connections especially TCP related, and many many more ... see the man page for a complete description. 1997-06-02 05:02:37 +00:00
Use src.opts.mk in preference to bsd.own.mk except where we need stuff from the latter. 2014-05-06 04:22:01 +00:00			`.include <src.opts.mk>`
Fix world build WITHOUT_PF. Sponsored by: Nginx, Inc. 2014-02-12 09:59:48 +00:00
Create packages for atm, ccdconfig, devd, ipf, ipfw, iscsi, natd, nandfs, pf, quotacheck, and routed. Add ping6 and rtsol to the runtime package. Sponsored by: The FreeBSD Foundation 2016-02-09 19:30:31 +00:00			`PACKAGE=ipfw`
Convert this Makefile to the usual style. 2000-10-06 11:18:11 +00:00			`PROG= ipfw`
Move further to eliminate next pieces of number-assuming code inside tables. Kernel changes: * Add IP_FW_OBJ_FLUSH opcode (flush table based on its name/set) * Add IP_FW_OBJ_DUMP opcode (dumps table data based on its names/set) * Add IP_FW_OBJ_LISTSIZE / IP_FW_OBJ_LIST opcodes (get list of kernel tables) Userland changes: * move tables code to separate tables.c file * get rid of tables_max * switch "all"/list handling to new opcodes 2014-06-14 22:47:25 +00:00			`SRCS= ipfw2.c dummynet.c ipv6.c main.c nat.c tables.c`
Add ipfw_nat64 module that implements stateless and stateful NAT64. The module works together with ipfw(4) and implemented as its external action module. Stateless NAT64 registers external action with name nat64stl. This keyword should be used to create NAT64 instance and to address this instance in rules. Stateless NAT64 uses two lookup tables with mapped IPv4->IPv6 and IPv6->IPv4 addresses to perform translation. A configuration of instance should looks like this: 1. Create lookup tables: # ipfw table T46 create type addr valtype ipv6 # ipfw table T64 create type addr valtype ipv4 2. Fill T46 and T64 tables. 3. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 4. Create NAT64 instance: # ipfw nat64stl NAT create table4 T46 table6 T64 5. Add rules that matches the traffic: # ipfw add nat64stl NAT ip from any to table(T46) # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96 6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Stateful NAT64 registers external action with name nat64lsn. The only one option required to create nat64lsn instance - prefix4. It defines the pool of IPv4 addresses used for translation. A configuration of instance should looks like this: 1. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 2. Create NAT64 instance: # ipfw nat64lsn NAT create prefix4 A.B.C.D/28 3. Add rules that matches the traffic: # ipfw add nat64lsn NAT ip from any to A.B.C.D/28 # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96 4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D6434 2016-08-13 16:09:49 +00:00			`SRCS+= nat64lsn.c nat64stl.c nptv6.c`
fix printing of uint64_t values, so we can use WARNS=2 2009-01-27 20:26:45 +00:00			`WARNS?= 2`
Fix world build WITHOUT_PF. Sponsored by: Nginx, Inc. 2014-02-12 09:59:48 +00:00
			`.if ${MK_PF} != "no"`
			`SRCS+= altq.c`
			`CFLAGS+=-DPF`
			`.endif`

Allow jail names (not just IDs) to be specified for: cpuset(1), ipfw(8), sockstat(1), ugidfw(8) These are the last of the jail-aware userland utilities that didn't work with names. PR: 229266 MFC after: 3 days Differential Revision: D16047 2018-07-03 23:47:20 +00:00			`LIBADD= jail util`
- Backout botched attempt to introduce MANSECT feature. - MAN[1-9] -> MAN. 2001-03-26 14:33:27 +00:00			`MAN= ipfw.8`
New man pages from Ugen. Delete my old, first attempt. I only hope that the english in Ugen's two replacement pages is not too impenetrable! :-) [Note: Poul - please pull these into the BETA branch along with the other firewall changes] Submitted by: ugen 1994-11-17 09:50:30 +00:00
Add the ipfw command, for IP firewall construction. Submitted by: danny ugen 1994-10-28 15:06:53 +00:00			`.include <bsd.prog.mk>`