]> Git — Sourcephile - sourcephile-nix.git/blob - install/overlays/tools/networking/shorewall6/default.nix
rspamd: brittle install
[sourcephile-nix.git] / install / overlays / tools / networking / shorewall6 / default.nix
1 { stdenv
2 , fetchurl
3 , perl
4 , coreutils
5 , iproute
6 , ipset
7 , iptables
8 , ebtables
9 , shorewall-core
10 , shorewall
11 , logger
12 , gnugrep
13 , gnused
14 }:
15 let
16 PATH = stdenv.lib.concatStringsSep ":"
17 [ "${coreutils}/bin"
18 "${iproute}/bin"
19 "${iptables}/bin"
20 "${ipset}/bin"
21 "${ebtables}/bin"
22 "${logger}/bin"
23 "${gnugrep}/bin"
24 "${gnused}/bin"
25 ];
26 in
27 stdenv.mkDerivation rec {
28 baseName = "shorewall6";
29 version = "5.2.0.5";
30 name = "${baseName}-${version}";
31
32 src = fetchurl {
33 url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2";
34 sha256 = "1a46jnr6wknlmfkhjpdvak85wj0mr99qn02r185qswhcyfwyaapl";
35 };
36
37 buildInputs = [
38 coreutils
39 iproute
40 ipset
41 iptables
42 ebtables
43 shorewall-core
44 logger
45 gnugrep
46 gnused
47 shorewall
48 ];
49 configurePhase = ''
50 PATH=$PATH:${shorewall-core}/bin \
51 ./configure \
52 HOST=linux \
53 PREFIX=$out \
54 CONFDIR=\$PREFIX/etc \
55 SBINDIR=\$PREFIX/sbin \
56 SYSCONFDIR=\$PREFIX/etc/default \
57 VARLIB=/var/lib \
58 INITSOURCE= \
59 INITDIR= \
60 INITFILE= \
61 DEFAULT_PAGER=
62 '';
63 installPhase = ''
64 # Merge with shorewall and shorewall-core
65 mkdir -p $out/share/
66 cp -r -s ${shorewall}/share/shorewall $out/share/
67 chmod u+w $out $out/*/ $out/*/*/ $out/*/*/*/
68 mkdir $out/bin
69 ln -fns bin $out/sbin
70 # Install shorewallrc and shorewall6
71 cp --remove-destination shorewallrc $out/share/shorewall/
72 #ln -s ${shorewall}/share/shorewall/compiler.pl $out/share/shorewall/
73 ./install.sh
74 cp --remove-destination ${shorewall-core}/sbin/shorewall $out/sbin/shorewall6
75 # Actual config will be expected in /etc/shorewall6
76 sed -i $out/share/shorewall/shorewallrc \
77 -e 's~^CONFDIR=.*~CONFDIR=/etc~'
78 # Fix PATH
79 sed -i $out/sbin/shorewall6 \
80 -e 's~^\. ${shorewall-core}\(/share/shorewall/shorewallrc\)~. '$out'\1~' \
81 -e 's~^PRODUCT=.*~&\nexport PATH=${PATH}''${PATH:+:}$PATH~'
82 # Fix shorewall.conf
83 sed -i $out/etc/shorewall6/shorewall6.conf \
84 -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall6.log|' \
85 -e 's|^PATH=.*|PATH=${PATH}|' \
86 -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \
87 -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|' \
88 -e 's|^CONFIG_PATH=.*|CONFIG_PATH=:''${CONFDIR}/shorewall6:''${SHAREDIR}/shorewall6:''${SHAREDIR}/shorewall|'
89 # NOTE: the CONFIG_PATH fix is because ''${SHAREDIR}/shorewall6
90 # must replace the default /usr/share/shorewall6,
91 # otherwise it can fail in subtle ways,
92 # like using shorewall's macro.Ping instead of shorewall6's,
93 # hence not using the right icmp-type (8 instead of 128 here).
94 '';
95
96 meta = {
97 homepage = http://www.shorewall.net/;
98 description = "An IPv6 gateway/firewall configuration tool for GNU/Linux";
99 longDescription = ''
100 Shorewall is a high-level tool for configuring Netfilter. You describe your
101 firewall/gateway requirements using entries in a set of configuration
102 files. Shorewall reads those configuration files and with the help of the
103 iptables, iptables-restore, ip and tc utilities, Shorewall configures
104 Netfilter and the Linux networking subsystem to match your requirements.
105 Shorewall can be used on a dedicated firewall system, a multi-function
106 gateway/router/server or on a standalone GNU/Linux system. Shorewall does
107 not use Netfilter's ipchains compatibility mode and can thus take
108 advantage of Netfilter's connection state tracking capabilities.
109 '';
110 license = stdenv.lib.licenses.gpl2Plus;
111 platforms = stdenv.lib.platforms.linux;
112 };
113 }