install/overlays/tools/networking/shorewall/default.nix

   1 { stdenv
   2 , fetchurl
   3 , perl
   4 , coreutils
   5 , iproute
   6 , ipset
   7 , iptables
   8 , ebtables
   9 , shorewall-core
  10 , logger
  11 , gnugrep
  12 , gnused
  13 }:
  14 let
  15   PATH = stdenv.lib.concatStringsSep ":"
  16            [ "${coreutils}/bin"
  17              "${iproute}/bin"
  18              "${iptables}/bin"
  19              "${ipset}/bin"
  20              "${ebtables}/bin"
  21              "${logger}/bin"
  22              "${gnugrep}/bin"
  23              "${gnused}/bin"
  24            ];
  25 in
  26 stdenv.mkDerivation rec {
  27   baseName = "shorewall";
  28   version = "5.2.0.5";
  29   name = "${baseName}-${version}";
  30
  31   src = fetchurl {
  32     url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2";
  33     sha256 = "005qv6kybk1jn1i63rchf86kwbxwwn463cxkp03q0mpc0cnj018w";
  34   };
  35
  36   buildInputs = [
  37     coreutils
  38     iproute
  39     ipset
  40     iptables
  41     ebtables
  42     shorewall-core
  43     logger
  44     gnugrep
  45     gnused
  46   ];
  47   configurePhase = ''
  48     PATH=$PATH:${shorewall-core}/bin \
  49     ./configure \
  50       HOST=linux \
  51       PREFIX=$out \
  52       CONFDIR=\$PREFIX/etc \
  53       SBINDIR=\$PREFIX/sbin \
  54       SYSCONFDIR=\$PREFIX/etc/default \
  55       VARLIB=/var/lib \
  56       INITSOURCE= \
  57       INITDIR= \
  58       INITFILE= \
  59       DEFAULT_PAGER=
  60   '';
  61   installPhase = ''
  62     # Merge with shorewall-core
  63     cp -r -s ${shorewall-core} $out
  64     chmod u+w $out $out/*/ $out/*/*/ $out/*/*/*/
  65     ln -fns bin $out/sbin
  66     # Install shorewallrc and shorewall
  67     cp --remove-destination shorewallrc $out/share/shorewall/
  68     ./install.sh
  69     cp ${shorewall-core}/sbin/shorewall $out/sbin/shorewall4
  70     ln -fns shorewall4 $out/sbin/shorewall
  71     # Actual config will be expected in /etc/shorewall
  72     sed -i $out/share/shorewall/shorewallrc \
  73         -e 's~^CONFDIR=.*~CONFDIR=/etc~'
  74     # Fix PATH
  75     sed -i $out/sbin/shorewall \
  76         -e 's~^\. ${shorewall-core}\(/share/shorewall/shorewallrc\)~. '$out'\1~' \
  77         -e 's~^PRODUCT=.*~&\nexport PATH=${PATH}''${PATH:+:}$PATH~'
  78     # Fix shorewall.conf
  79     sed -i $out/etc/shorewall/shorewall.conf \
  80         -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall.log|' \
  81         -e 's|^PATH=.*|PATH=${PATH}|' \
  82         -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \
  83         -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|'
  84     # FIXME: the default GEOIPDIR=/usr/share/xt_geoip/LE may require attention.
  85   '';
  86
  87   meta = {
  88     homepage = http://www.shorewall.net/;
  89     description = "An IPv4 gateway/firewall configuration tool for GNU/Linux";
  90     longDescription = ''
  91       Shorewall is a high-level tool for configuring Netfilter. You describe your
  92       firewall/gateway requirements using entries in a set of configuration
  93       files. Shorewall reads those configuration files and with the help of the
  94       iptables, iptables-restore, ip and tc utilities, Shorewall configures
  95       Netfilter and the Linux networking subsystem to match your requirements.
  96       Shorewall can be used on a dedicated firewall system, a multi-function
  97       gateway/router/server or on a standalone GNU/Linux system. Shorewall does
  98       not use Netfilter's ipchains compatibility mode and can thus take
  99       advantage of Netfilter's connection state tracking capabilities.
 100     '';
 101     license = stdenv.lib.licenses.gpl2Plus;
 102     platforms = stdenv.lib.platforms.linux;
 103   };
 104 }