install/overlays/tools/networking/shorewall6/default.nix

   1 { stdenv
   2 , fetchurl
   3 , perl
   4 , coreutils
   5 , iproute
   6 , ipset
   7 , iptables
   8 , ebtables
   9 , shorewall-core
  10 , shorewall
  11 , utillinux
  12 , gnugrep
  13 , gnused
  14 }:
  15 let
  16   PATH = stdenv.lib.concatStringsSep ":"
  17            [ "${coreutils}/bin"
  18              "${iproute}/bin"
  19              "${iptables}/bin"
  20              "${ipset}/bin"
  21              "${ebtables}/bin"
  22              "${utillinux}/bin"
  23              "${gnugrep}/bin"
  24              "${gnused}/bin"
  25            ];
  26 in
  27 stdenv.mkDerivation rec {
  28   baseName = "shorewall6";
  29   version = "5.2.0.5";
  30   name = "${baseName}-${version}";
  31
  32   src = fetchurl {
  33     url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2";
  34     sha256 = "1a46jnr6wknlmfkhjpdvak85wj0mr99qn02r185qswhcyfwyaapl";
  35   };
  36
  37   buildInputs = [
  38     coreutils
  39     iproute
  40     ipset
  41     iptables
  42     ebtables
  43     shorewall-core
  44     utillinux
  45     gnugrep
  46     gnused
  47     shorewall
  48   ];
  49   configurePhase = ''
  50     substituteInPlace ./configure --replace '#!/bin/bash' ${stdenv.shell}
  51     PATH=$PATH:${shorewall-core}/bin \
  52     ./configure \
  53       HOST=linux \
  54       PREFIX=$out \
  55       CONFDIR=\$PREFIX/etc \
  56       SBINDIR=\$PREFIX/sbin \
  57       SYSCONFDIR=\$PREFIX/etc/default \
  58       VARLIB=/var/lib \
  59       INITSOURCE= \
  60       INITDIR= \
  61       INITFILE= \
  62       DEFAULT_PAGER=
  63   '';
  64   installPhase = ''
  65     # Merge with shorewall and shorewall-core
  66     mkdir -p $out/share/
  67     cp -r -s ${shorewall}/share/shorewall $out/share/
  68     chmod u+w $out $out/*/ $out/*/*/ $out/*/*/*/
  69     mkdir $out/bin
  70     ln -fns bin $out/sbin
  71     # Install shorewallrc and shorewall6
  72     cp --remove-destination shorewallrc $out/share/shorewall/
  73     #ln -s ${shorewall}/share/shorewall/compiler.pl $out/share/shorewall/
  74     substituteInPlace ./install.sh --replace '#!/bin/sh' ${stdenv.shell}
  75     ./install.sh
  76     cp --remove-destination ${shorewall-core}/sbin/shorewall $out/sbin/shorewall6
  77     # Actual config will be expected in /etc/shorewall6
  78     sed -i $out/share/shorewall/shorewallrc \
  79         -e 's~^CONFDIR=.*~CONFDIR=/etc~'
  80     # Fix PATH
  81     sed -i $out/sbin/shorewall6 \
  82         -e 's~^\. ${shorewall-core}\(/share/shorewall/shorewallrc\)~. '$out'\1~' \
  83         -e 's~^PRODUCT=.*~&\nexport PATH=${PATH}''${PATH:+:}$PATH~'
  84     # Fix shorewall.conf
  85     sed -i $out/etc/shorewall6/shorewall6.conf \
  86         -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall6.log|' \
  87         -e 's|^PATH=.*|PATH=${PATH}|' \
  88         -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \
  89         -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|' \
  90         -e 's|^CONFIG_PATH=.*|CONFIG_PATH=:''${CONFDIR}/shorewall6:''${SHAREDIR}/shorewall6:''${SHAREDIR}/shorewall|'
  91     # NOTE: the CONFIG_PATH fix is because ''${SHAREDIR}/shorewall6
  92     #       must replace the default /usr/share/shorewall6,
  93     #       otherwise it can fail in subtle ways,
  94     #       like using shorewall's macro.Ping instead of shorewall6's,
  95     #       hence not using the right icmp-type (8 instead of 128 here).
  96   '';
  97
  98   meta = {
  99     homepage = http://www.shorewall.net/;
 100     description = "An IPv6 gateway/firewall configuration tool for GNU/Linux";
 101     longDescription = ''
 102       Shorewall is a high-level tool for configuring Netfilter. You describe your
 103       firewall/gateway requirements using entries in a set of configuration
 104       files. Shorewall reads those configuration files and with the help of the
 105       iptables, iptables-restore, ip and tc utilities, Shorewall configures
 106       Netfilter and the Linux networking subsystem to match your requirements.
 107       Shorewall can be used on a dedicated firewall system, a multi-function
 108       gateway/router/server or on a standalone GNU/Linux system. Shorewall does
 109       not use Netfilter's ipchains compatibility mode and can thus take
 110       advantage of Netfilter's connection state tracking capabilities.
 111     '';
 112     license = stdenv.lib.licenses.gpl2Plus;
 113     platforms = stdenv.lib.platforms.linux;
 114   };
 115 }