{ stdenv , fetchurl , perl , coreutils , iproute , ipset , iptables , ebtables , shorewall-core , shorewall , utillinux , gnugrep , gnused }: let PATH = stdenv.lib.concatStringsSep ":" [ "${coreutils}/bin" "${iproute}/bin" "${iptables}/bin" "${ipset}/bin" "${ebtables}/bin" "${utillinux}/bin" "${gnugrep}/bin" "${gnused}/bin" ]; in stdenv.mkDerivation rec { baseName = "shorewall6"; version = "5.2.0.5"; name = "${baseName}-${version}"; src = fetchurl { url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2"; sha256 = "1a46jnr6wknlmfkhjpdvak85wj0mr99qn02r185qswhcyfwyaapl"; }; buildInputs = [ coreutils iproute ipset iptables ebtables shorewall-core utillinux gnugrep gnused shorewall ]; configurePhase = '' substituteInPlace ./configure --replace '#!/bin/bash' ${stdenv.shell} PATH=$PATH:${shorewall-core}/bin \ ./configure \ HOST=linux \ PREFIX=$out \ CONFDIR=\$PREFIX/etc \ SBINDIR=\$PREFIX/sbin \ SYSCONFDIR=\$PREFIX/etc/default \ VARLIB=/var/lib \ INITSOURCE= \ INITDIR= \ INITFILE= \ DEFAULT_PAGER= ''; installPhase = '' # Merge with shorewall and shorewall-core mkdir -p $out/share/ cp -r -s ${shorewall}/share/shorewall $out/share/ chmod u+w $out $out/*/ $out/*/*/ $out/*/*/*/ mkdir $out/bin ln -fns bin $out/sbin # Install shorewallrc and shorewall6 cp --remove-destination shorewallrc $out/share/shorewall/ #ln -s ${shorewall}/share/shorewall/compiler.pl $out/share/shorewall/ substituteInPlace ./install.sh --replace '#!/bin/sh' ${stdenv.shell} ./install.sh cp --remove-destination ${shorewall-core}/sbin/shorewall $out/sbin/shorewall6 # Actual config will be expected in /etc/shorewall6 sed -i $out/share/shorewall/shorewallrc \ -e 's~^CONFDIR=.*~CONFDIR=/etc~' # Fix PATH sed -i $out/sbin/shorewall6 \ -e 's~^\. ${shorewall-core}\(/share/shorewall/shorewallrc\)~. '$out'\1~' \ -e 's~^PRODUCT=.*~&\nexport PATH=${PATH}''${PATH:+:}$PATH~' # Fix shorewall.conf sed -i $out/etc/shorewall6/shorewall6.conf \ -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall6.log|' \ -e 's|^PATH=.*|PATH=${PATH}|' \ -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \ -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|' \ -e 's|^CONFIG_PATH=.*|CONFIG_PATH=:''${CONFDIR}/shorewall6:''${SHAREDIR}/shorewall6:''${SHAREDIR}/shorewall|' # NOTE: the CONFIG_PATH fix is because ''${SHAREDIR}/shorewall6 # must replace the default /usr/share/shorewall6, # otherwise it can fail in subtle ways, # like using shorewall's macro.Ping instead of shorewall6's, # hence not using the right icmp-type (8 instead of 128 here). ''; meta = { homepage = http://www.shorewall.net/; description = "An IPv6 gateway/firewall configuration tool for GNU/Linux"; longDescription = '' Shorewall is a high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and with the help of the iptables, iptables-restore, ip and tc utilities, Shorewall configures Netfilter and the Linux networking subsystem to match your requirements. Shorewall can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system. Shorewall does not use Netfilter's ipchains compatibility mode and can thus take advantage of Netfilter's connection state tracking capabilities. ''; license = stdenv.lib.licenses.gpl2Plus; platforms = stdenv.lib.platforms.linux; }; }