mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-17 01:46:58 +02:00
Merge pull request #2433 from flatcar/dongsu/iptables-1.8.8
net-firewall/iptables: update to 1.8.8-r5
This commit is contained in:
Dongsu Park
GitHub
commit
5b21f36eca
1
sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md
vendored
Normal file
1
sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md
vendored
Normal file
@ -0,0 +1 @@
|
||||
- iptables ([1.8.8](https://www.netfilter.org/projects/iptables/files/changes-iptables-1.8.8.txt))
|
||||
@ -1 +1 @@
|
||||
DIST iptables-1.8.7.tar.bz2 717862 BLAKE2B fd4dcff142eaadde2a14ce3eb5e45d41c326752553b52900c77fd2e2a20c0685d0a04b95755995e914df47658834d52216d6465c2ae9cd6abc6eb122b95cc976 SHA512 c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75
|
||||
DIST iptables-1.8.8.tar.bz2 746985 BLAKE2B 0da021cc7313b86af331768904956dab3eee3de245a7b03965129f3d7f13097fc03fbb1390167dcd971eff216eabad9e59b261a9c0f54bfc48a77453aa40d164 SHA512 f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59
|
||||
|
||||
@ -0,0 +1,21 @@
|
||||
https://git.netfilter.org/iptables/commit/?id=b72eb12ea5a61df0655ad99d5048994e916be83a
|
||||
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 13 May 2022 16:51:58 +0200
|
||||
Subject: xshared: Fix build for -Werror=format-security
|
||||
|
||||
Gcc complains about the omitted format string.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg)
|
||||
return;
|
||||
|
||||
if (args->family != NFPROTO_ARP)
|
||||
- xtables_error(PARAMETER_PROBLEM, msg);
|
||||
+ xtables_error(PARAMETER_PROBLEM, "%s", msg);
|
||||
|
||||
fprintf(stderr, "%s", msg);
|
||||
}
|
||||
cgit v1.2.3
|
||||
@ -0,0 +1,59 @@
|
||||
https://git.netfilter.org/iptables/commit/?id=0e7cf0ad306cdf95dc3c28d15a254532206a888e
|
||||
https://bugs.gentoo.org/846377
|
||||
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 18 May 2022 16:04:09 +0200
|
||||
Subject: Revert "fix build for missing ETH_ALEN definition"
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke
|
||||
compiling against musl libc. Might be a bug in the latter, but for the
|
||||
time being try to please both by avoiding the include and instead
|
||||
defining ETH_ALEN if unset.
|
||||
|
||||
While being at it, move netinet/ether.h include up.
|
||||
|
||||
Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Reviewed-by: Maciej Żenczykowski <maze@google.com>
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -28,6 +28,7 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
+#include <netinet/ether.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/statfs.h>
|
||||
@@ -45,7 +46,6 @@
|
||||
|
||||
#include <xtables.h>
|
||||
#include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */
|
||||
-#include <linux/if_ether.h> /* ETH_ALEN */
|
||||
#include <linux/netfilter_ipv4/ip_tables.h>
|
||||
#include <linux/netfilter_ipv6/ip6_tables.h>
|
||||
#include <libiptc/libxtc.h>
|
||||
@@ -72,6 +72,10 @@
|
||||
#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
|
||||
#endif
|
||||
|
||||
+#ifndef ETH_ALEN
|
||||
+#define ETH_ALEN 6
|
||||
+#endif
|
||||
+
|
||||
/* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the
|
||||
* current line of the input file, in order to give a more precise error
|
||||
* message. ip6?tables itself doesn't need this, so it is initialized to the
|
||||
@@ -2245,8 +2249,6 @@ void xtables_print_num(uint64_t number, unsigned int format)
|
||||
printf(FMT("%4lluT ","%lluT "), (unsigned long long)number);
|
||||
}
|
||||
|
||||
-#include <netinet/ether.h>
|
||||
-
|
||||
static const unsigned char mac_type_unicast[ETH_ALEN] = {};
|
||||
static const unsigned char msk_type_unicast[ETH_ALEN] = {1};
|
||||
static const unsigned char mac_type_multicast[ETH_ALEN] = {1};
|
||||
cgit v1.2.3
|
||||
@ -0,0 +1,26 @@
|
||||
https://git.netfilter.org/iptables/commit/?id=0ebf52fc951b2a4d98a166afb34af4f364bbeece
|
||||
|
||||
From: Ben Brown <ben@demerara.io>
|
||||
Date: Wed, 25 May 2022 16:26:13 +0100
|
||||
Subject: build: Fix error during out of tree build
|
||||
|
||||
Fixes the following error:
|
||||
|
||||
../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory
|
||||
52 | #include <libiptc/linux_list.h>
|
||||
|
||||
Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table")
|
||||
Signed-off-by: Ben Brown <ben@demerara.io>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
--- a/libxtables/Makefile.am
|
||||
+++ b/libxtables/Makefile.am
|
||||
@@ -1,7 +1,7 @@
|
||||
# -*- Makefile -*-
|
||||
|
||||
AM_CFLAGS = ${regular_CFLAGS}
|
||||
-AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables ${kinclude_CPPFLAGS}
|
||||
+AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables -I${top_srcdir} ${kinclude_CPPFLAGS}
|
||||
|
||||
lib_LTLIBRARIES = libxtables.la
|
||||
libxtables_la_SOURCES = xtables.c xtoptions.c getethertype.c
|
||||
cgit v1.2.3
|
||||
@ -0,0 +1,135 @@
|
||||
https://git.netfilter.org/iptables/commit/?id=f319389525b066b7dc6d389c88f16a0df3b8f189
|
||||
|
||||
From: Nick Hainke <vincent@systemli.org>
|
||||
Date: Mon, 16 May 2022 18:16:41 +0200
|
||||
Subject: treewide: use uint* instead of u_int*
|
||||
|
||||
Gcc complains about missing types. Some commits introduced u_int* instead
|
||||
of uint*. Use uint treewide.
|
||||
|
||||
Fixes errors in the form of:
|
||||
In file included from xtables-legacy-multi.c:5:
|
||||
xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'?
|
||||
83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
|
||||
| ^~~~~~~~~
|
||||
| uint16_t
|
||||
make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1
|
||||
|
||||
Avoid libipq API breakage by adjusting libipq.h include accordingly. For
|
||||
arpt_mangle.h kernel uAPI header, apply same change as in kernel commit
|
||||
e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t").
|
||||
|
||||
Signed-off-by: Nick Hainke <vincent@systemli.org>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
--- a/extensions/libxt_conntrack.c
|
||||
+++ b/extensions/libxt_conntrack.c
|
||||
@@ -778,7 +778,7 @@ matchinfo_print(const void *ip, const struct xt_entry_match *match, int numeric,
|
||||
|
||||
static void
|
||||
conntrack_dump_ports(const char *prefix, const char *opt,
|
||||
- u_int16_t port_low, u_int16_t port_high)
|
||||
+ uint16_t port_low, uint16_t port_high)
|
||||
{
|
||||
if (port_high == 0 || port_low == port_high)
|
||||
printf(" %s%s %u", prefix, opt, port_low);
|
||||
--- a/include/libipq/libipq.h
|
||||
+++ b/include/libipq/libipq.h
|
||||
@@ -24,7 +24,7 @@
|
||||
#include <errno.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
-#include <sys/types.h>
|
||||
+#include <stdint.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/uio.h>
|
||||
#include <asm/types.h>
|
||||
@@ -48,19 +48,19 @@ typedef unsigned long ipq_id_t;
|
||||
struct ipq_handle
|
||||
{
|
||||
int fd;
|
||||
- u_int8_t blocking;
|
||||
+ uint8_t blocking;
|
||||
struct sockaddr_nl local;
|
||||
struct sockaddr_nl peer;
|
||||
};
|
||||
|
||||
-struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol);
|
||||
+struct ipq_handle *ipq_create_handle(uint32_t flags, uint32_t protocol);
|
||||
|
||||
int ipq_destroy_handle(struct ipq_handle *h);
|
||||
|
||||
ssize_t ipq_read(const struct ipq_handle *h,
|
||||
unsigned char *buf, size_t len, int timeout);
|
||||
|
||||
-int ipq_set_mode(const struct ipq_handle *h, u_int8_t mode, size_t len);
|
||||
+int ipq_set_mode(const struct ipq_handle *h, uint8_t mode, size_t len);
|
||||
|
||||
ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf);
|
||||
|
||||
--- a/include/libiptc/libxtc.h
|
||||
+++ b/include/libiptc/libxtc.h
|
||||
@@ -10,7 +10,7 @@ extern "C" {
|
||||
#endif
|
||||
|
||||
#ifndef XT_MIN_ALIGN
|
||||
-/* xt_entry has pointers and u_int64_t's in it, so if you align to
|
||||
+/* xt_entry has pointers and uint64_t's in it, so if you align to
|
||||
it, you'll also align to any crazy matches and targets someone
|
||||
might write */
|
||||
#define XT_MIN_ALIGN (__alignof__(struct xt_entry))
|
||||
--- a/include/linux/netfilter_arp/arpt_mangle.h
|
||||
+++ b/include/linux/netfilter_arp/arpt_mangle.h
|
||||
@@ -13,7 +13,7 @@ struct arpt_mangle
|
||||
union {
|
||||
struct in_addr tgt_ip;
|
||||
} u_t;
|
||||
- u_int8_t flags;
|
||||
+ __u8 flags;
|
||||
int target;
|
||||
};
|
||||
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -1025,7 +1025,7 @@ static const int inverse_for_options[NUMBER_OF_OPT] =
|
||||
};
|
||||
|
||||
void
|
||||
-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
|
||||
+set_option(unsigned int *options, unsigned int option, uint16_t *invflg,
|
||||
bool invert)
|
||||
{
|
||||
if (*options & option)
|
||||
--- a/iptables/xshared.h
|
||||
+++ b/iptables/xshared.h
|
||||
@@ -80,7 +80,7 @@ struct xtables_target;
|
||||
#define IPT_INV_ARPHRD 0x0800
|
||||
|
||||
void
|
||||
-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
|
||||
+set_option(unsigned int *options, unsigned int option, uint16_t *invflg,
|
||||
bool invert);
|
||||
|
||||
/**
|
||||
--- a/libipq/ipq_create_handle.3
|
||||
+++ b/libipq/ipq_create_handle.3
|
||||
@@ -24,7 +24,7 @@ ipq_create_handle, ipq_destroy_handle \(em create and destroy libipq handles.
|
||||
.br
|
||||
.B #include <libipq.h>
|
||||
.sp
|
||||
-.BI "struct ipq_handle *ipq_create_handle(u_int32_t " flags ", u_int32_t " protocol ");"
|
||||
+.BI "struct ipq_handle *ipq_create_handle(uint32_t " flags ", uint32_t " protocol ");"
|
||||
.br
|
||||
.BI "int ipq_destroy_handle(struct ipq_handle *" h );
|
||||
.SH DESCRIPTION
|
||||
--- a/libipq/ipq_set_mode.3
|
||||
+++ b/libipq/ipq_set_mode.3
|
||||
@@ -24,7 +24,7 @@ ipq_set_mode \(em set the ip_queue queuing mode
|
||||
.br
|
||||
.B #include <libipq.h>
|
||||
.sp
|
||||
-.BI "int ipq_set_mode(const struct ipq_handle *" h ", u_int8_t " mode ", size_t " range );
|
||||
+.BI "int ipq_set_mode(const struct ipq_handle *" h ", uint8_t " mode ", size_t " range );
|
||||
.SH DESCRIPTION
|
||||
The
|
||||
.B ipq_set_mode
|
||||
cgit v1.2.3
|
||||
@ -1,5 +1,5 @@
|
||||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2018 Gentoo Authors
|
||||
# Copyright 1999-2022 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
extra_commands="check save panic"
|
||||
@ -38,7 +38,7 @@ set_table_policy() {
|
||||
|
||||
local chain
|
||||
for chain in ${chains} ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy}
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -t ${table} -P ${chain} ${policy}
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
|
||||
@ -69,7 +69,7 @@ start_pre() {
|
||||
|
||||
start() {
|
||||
ebegin "Loading ${iptables_name} state and starting firewall"
|
||||
${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
${iptables_bin}-restore --wait ${iptables_lock_wait_time} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
@ -88,10 +88,10 @@ stop() {
|
||||
set_table_policy $a ACCEPT
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend ${has_errors}
|
||||
@ -103,10 +103,10 @@ reload() {
|
||||
ebegin "Flushing firewall"
|
||||
local has_errors=0 a
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend ${has_errors}
|
||||
@ -136,7 +136,7 @@ save() {
|
||||
panic() {
|
||||
# use iptables autoload capability to load at least all required
|
||||
# modules and filter table
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -S >/dev/null
|
||||
if [ $? -ne 0 ] ; then
|
||||
eerror "${iptables_bin} failed to load"
|
||||
return 1
|
||||
@ -149,10 +149,10 @@ panic() {
|
||||
local has_errors=0 a
|
||||
ebegin "Dropping all packets"
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
if [ "${a}" != "nat" ]; then
|
||||
@ -1,9 +1,9 @@
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Copyright 1999-2022 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
EAPI=8
|
||||
|
||||
inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
||||
inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
||||
|
||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
||||
@ -13,51 +13,50 @@ LICENSE="GPL-2"
|
||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
||||
# the last time.
|
||||
SLOT="0/1.8.3"
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
||||
IUSE="conntrack ipv6 netlink nftables pcap static-libs"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
||||
IUSE="conntrack netlink nftables pcap static-libs"
|
||||
|
||||
BUILD_DEPEND="
|
||||
>=app-eselect/eselect-iptables-20200508
|
||||
"
|
||||
COMMON_DEPEND="
|
||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
||||
netlink? ( net-libs/libnfnetlink )
|
||||
nftables? (
|
||||
>=net-libs/libmnl-1.0:0=
|
||||
>=net-libs/libnftnl-1.1.6:0=
|
||||
>=net-libs/libmnl-1.0:=
|
||||
>=net-libs/libnftnl-1.1.6:=
|
||||
)
|
||||
pcap? ( net-libs/libpcap )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}
|
||||
DEPEND="
|
||||
${COMMON_DEPEND}
|
||||
virtual/os-headers
|
||||
>=sys-kernel/linux-headers-4.4:0
|
||||
"
|
||||
# Flatcar: Rename virtual/yacc to app-alternatives/yacc. The former is
|
||||
# gone in favor of the latter in Gentoo. This modification will be
|
||||
# dropped when we update this ebuild from Gentoo.
|
||||
BDEPEND="${BUILD_DEPEND}
|
||||
app-eselect/eselect-iptables
|
||||
BDEPEND="
|
||||
virtual/pkgconfig
|
||||
nftables? (
|
||||
sys-devel/flex
|
||||
app-alternatives/yacc
|
||||
)
|
||||
"
|
||||
# Flatcar: Drop BUILD_DEPEND, as we would not like to ship
|
||||
# eselect in the final image. Also, drop net-firewall/arptables as we don't
|
||||
# ship arptables
|
||||
RDEPEND="${COMMON_DEPEND}
|
||||
# Flatcar: Drop net-firewall/arptables as we don't ship arptables.
|
||||
RDEPEND="
|
||||
${COMMON_DEPEND}
|
||||
nftables? ( net-misc/ethertypes )
|
||||
!<net-firewall/ebtables-2.0.11-r1
|
||||
"
|
||||
# Flatcar: Do not ship eselect-iptables.
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/iptables-1.8.4-no-symlinks.patch"
|
||||
"${FILESDIR}/iptables-1.8.2-link.patch"
|
||||
|
||||
"${FILESDIR}/${P}-format-security.patch"
|
||||
"${FILESDIR}/${P}-uint-musl.patch"
|
||||
"${FILESDIR}/${P}-musl-headers.patch"
|
||||
"${FILESDIR}/${P}-out-of-tree-build.patch"
|
||||
)
|
||||
|
||||
src_prepare() {
|
||||
# use the saner headers from the kernel
|
||||
# Use the saner headers from the kernel
|
||||
rm include/linux/{kernel,types}.h || die
|
||||
|
||||
default
|
||||
@ -65,10 +64,11 @@ src_prepare() {
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Some libs use $(AR) rather than libtool to build #444282
|
||||
# Some libs use $(AR) rather than libtool to build, bug #444282
|
||||
tc-export AR
|
||||
|
||||
# Hack around struct mismatches between userland & kernel for some ABIs. #472388
|
||||
# Hack around struct mismatches between userland & kernel for some ABIs
|
||||
# bug #472388
|
||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
||||
|
||||
sed -i \
|
||||
@ -80,13 +80,14 @@ src_configure() {
|
||||
--sbindir="${EPREFIX}/sbin"
|
||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
||||
--enable-devel
|
||||
--enable-ipv6
|
||||
--enable-shared
|
||||
$(use_enable nftables)
|
||||
$(use_enable pcap bpf-compiler)
|
||||
$(use_enable pcap nfsynproxy)
|
||||
$(use_enable static-libs static)
|
||||
$(use_enable ipv6)
|
||||
)
|
||||
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
@ -96,9 +97,14 @@ src_compile() {
|
||||
|
||||
src_install() {
|
||||
default
|
||||
|
||||
# Managed by eselect-iptables
|
||||
# https://bugs.gentoo.org/881295
|
||||
rm "${ED}/usr/bin/iptables-xml" || die
|
||||
|
||||
dodoc INCOMPATIBILITIES iptables/iptables.xslt
|
||||
|
||||
# all the iptables binaries are in /sbin, so might as well
|
||||
# All the iptables binaries are in /sbin, so might as well
|
||||
# put these small files in with them
|
||||
into /
|
||||
dosbin iptables/iptables-apply
|
||||
@ -106,24 +112,21 @@ src_install() {
|
||||
doman iptables/iptables-apply.8
|
||||
|
||||
insinto /usr/include
|
||||
doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
|
||||
doins include/ip{,6}tables.h
|
||||
insinto /usr/include/iptables
|
||||
doins include/iptables/internal.h
|
||||
|
||||
keepdir /var/lib/iptables
|
||||
newinitd "${FILESDIR}"/${PN}-r2.init iptables
|
||||
keepdir /var/lib/ip{,6}tables
|
||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
||||
if use ipv6 ; then
|
||||
keepdir /var/lib/ip6tables
|
||||
dosym iptables /etc/init.d/ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
||||
fi
|
||||
dosym iptables /etc/init.d/ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
||||
|
||||
if use nftables; then
|
||||
# Bug 647458
|
||||
# Bug #647458
|
||||
rm "${ED}"/etc/ethertypes || die
|
||||
|
||||
# Bugs 660886 and 669894
|
||||
# Bugs #660886 and #669894
|
||||
# Flatcar: We don't provide arptables* binaries.
|
||||
# Flatcar: Keeping the ebtables binaries
|
||||
rm "${ED}"/sbin/arptables{{,-{save,restore}},-nft{,-{save,restore}}} || die
|
||||
@ -131,12 +134,9 @@ src_install() {
|
||||
|
||||
# Flatcar: Gentoo upstream dropped the iptables & ip6tables services
|
||||
# but we continue to ship them
|
||||
systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
|
||||
if use ipv6 ; then
|
||||
systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
|
||||
fi
|
||||
systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables{,-{re,}store}.service
|
||||
|
||||
# Move important libs to /lib #332175
|
||||
# Move important libs to /lib, bug #332175
|
||||
gen_usr_ldscript -a ip{4,6}tc xtables
|
||||
|
||||
find "${ED}" -type f -name "*.la" -delete || die
|
||||
@ -165,14 +165,16 @@ pkg_postinst() {
|
||||
}
|
||||
|
||||
pkg_prerm() {
|
||||
elog "Unsetting iptables symlinks before removal"
|
||||
eselect iptables unset
|
||||
if [[ -z ${REPLACED_BY_VERSION} ]]; then
|
||||
elog "Unsetting iptables symlinks before removal"
|
||||
eselect iptables unset
|
||||
fi
|
||||
|
||||
if ! has_version 'net-firewall/ebtables'; then
|
||||
elog "Unsetting ebtables symlinks before removal"
|
||||
eselect ebtables unset
|
||||
fi
|
||||
|
||||
# the eselect module failing should not be fatal
|
||||
# The eselect module failing should not be fatal
|
||||
return 0
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="project">
|
||||
<email>base-system@gentoo.org</email>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user