freebsd-skq/sys/modules/ipfw/Makefile

# $FreeBSD$

.include <bsd.own.mk>

.PATH: ${.CURDIR}/../../netinet

KMOD=	ipfw
SRCS=	ip_fw2.c ip_fw_pfil.c
SRCS+=	opt_inet6.h opt_ipsec.h opt_mac.h

CFLAGS+= -DIPFIREWALL
CFLAGS+= -I${.CURDIR}/../../contrib/pf
#
#If you want it verbose
#CFLAGS+= -DIPFIREWALL_VERBOSE
#CFLAGS+= -DIPFIREWALL_VERBOSE_LIMIT=100
#
#If you want it to pass all packets by default
#CFLAGS+= -DIPFIREWALL_DEFAULT_TO_ACCEPT
#

.if !defined(KERNBUILDDIR)
.if ${MK_INET6_SUPPORT} != "no"
opt_inet6.h:
	echo "#define INET6 1" > ${.TARGET}
.endif
.endif

.include <bsd.kmod.mk>
$Id$ -> $FreeBSD$ 1999-08-28 01:08:13 +00:00			`# $FreeBSD$`
Firewall can be used as lkm module.To use it firewall should NOT be compiled into kernel. Then it can be loaded.This is misc module but i'v got no problemms with it,so shouldn't you i suppose.. BTW this is very stupid to have one module in CVS for ALL lkm's... 1995-01-12 13:03:02 +00:00
Reimplementation of world/kernel build options. For details, see: http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html The src.conf(5) manpage is to follow in a few days. Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine) 2006-03-17 18:54:44 +00:00			`.include <bsd.own.mk>`

Use a consistent style and one much closer to the rest of /usr/src 2001-01-06 14:00:42 +00:00			`.PATH: ${.CURDIR}/../../netinet`

Sample initial set of kld-ified modules. Not all have been completely converted yet. These are more of a starting point. This is NOT connected to the parent Makefile. OK'ed by jkh (who is ever so patiently waiting) 1998-10-16 04:30:52 +00:00			`KMOD= ipfw`
Revert the last change to sys/modules/ipfw/Makefile and fix a standalone module build in a better way. Silence from: andre MFC after: 3 days 2004-08-26 14:18:30 +00:00			`SRCS= ip_fw2.c ip_fw_pfil.c`
Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate 2006-09-12 04:25:13 +00:00			`SRCS+= opt_inet6.h opt_ipsec.h opt_mac.h`
Use a consistent style and one much closer to the rest of /usr/src 2001-01-06 14:00:42 +00:00
No need to use a magic IPFIREWALL_MODULE - the build system supplies one already we can test for. 1999-04-20 14:31:23 +00:00			`CFLAGS+= -DIPFIREWALL`
Link pf 4.1 to the build: - move ftp-proxy from libexec to usr.sbin - add tftp-proxy - new altq mtag link Approved by: re (kensmith) 2007-07-03 12:46:08 +00:00			`CFLAGS+= -I${.CURDIR}/../../contrib/pf`
Firewall can be used as lkm module.To use it firewall should NOT be compiled into kernel. Then it can be loaded.This is misc module but i'v got no problemms with it,so shouldn't you i suppose.. BTW this is very stupid to have one module in CVS for ALL lkm's... 1995-01-12 13:03:02 +00:00			`#`
Checking new lkm structure.. 1995-01-12 13:57:51 +00:00			`#If you want it verbose`
Firewall can be used as lkm module.To use it firewall should NOT be compiled into kernel. Then it can be loaded.This is misc module but i'v got no problemms with it,so shouldn't you i suppose.. BTW this is very stupid to have one module in CVS for ALL lkm's... 1995-01-12 13:03:02 +00:00			`#CFLAGS+= -DIPFIREWALL_VERBOSE`
Use IPFIREWALL_MODULE instead of ACTUALLY_LKM_NOT_KERNEL to indicate LKM'ness. ACTUALLY_LKM_NOT_KERNEL is supposed to be so ugly that it only gets used until <machine/conf.h> goes away. bsd.kmod.mk should define a better-named general macro for this. Some places use PSEUDO_LKM. This is another bad name. Makefile: Added IPFIREWALL_VERBOSE_LIMIT option (commented out). 1996-06-23 14:28:02 +00:00			`#CFLAGS+= -DIPFIREWALL_VERBOSE_LIMIT=100`
Firewall can be used as lkm module.To use it firewall should NOT be compiled into kernel. Then it can be loaded.This is misc module but i'v got no problemms with it,so shouldn't you i suppose.. BTW this is very stupid to have one module in CVS for ALL lkm's... 1995-01-12 13:03:02 +00:00			`#`
Add example for IPFIREWALL_DEFAULT_TO_ACCEPT 1997-09-10 04:19:07 +00:00			`#If you want it to pass all packets by default`
			`#CFLAGS+= -DIPFIREWALL_DEFAULT_TO_ACCEPT`
			`#`
Firewall can be used as lkm module.To use it firewall should NOT be compiled into kernel. Then it can be loaded.This is misc module but i'v got no problemms with it,so shouldn't you i suppose.. BTW this is very stupid to have one module in CVS for ALL lkm's... 1995-01-12 13:03:02 +00:00
obey opt_inet6.h and opt_ipsec.h in kernel build directory. Requested by: hrs 2005-11-29 17:56:11 +00:00			`.if !defined(KERNBUILDDIR)`
Reimplementation of world/kernel build options. For details, see: http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html The src.conf(5) manpage is to follow in a few days. Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine) 2006-03-17 18:54:44 +00:00			`.if ${MK_INET6_SUPPORT} != "no"`
obey opt_inet6.h and opt_ipsec.h in kernel build directory. Requested by: hrs 2005-11-29 17:56:11 +00:00			`opt_inet6.h:`
			`echo "#define INET6 1" > ${.TARGET}`
			`.endif`
			`.endif`

Use .include <bsd.kmod.mk> to get to ../../*/conf/kmod.mk instead of encoding the relative path. 2000-05-27 01:14:33 +00:00			`.include <bsd.kmod.mk>`