From 0f2d35cc291502625653b5b5f164fda4ffc8d722 Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Fri, 3 Feb 2023 14:05:25 +0100 Subject: [PATCH 1/3] net-firewall/iptables: update to 1.8.8-r5 Update iptables to 1.8.8-r5. Gentoo ref: 02b17c9bb64e147affc4acecaa0ff4151b2329bf --- .../net-firewall/iptables/Manifest | 2 +- .../iptables-1.8.8-format-security.patch | 21 +++ .../files/iptables-1.8.8-musl-headers.patch | 59 ++++++++ .../iptables-1.8.8-out-of-tree-build.patch | 26 ++++ .../files/iptables-1.8.8-uint-musl.patch | 135 ++++++++++++++++++ .../{iptables-r2.init => iptables-r3.init} | 20 +-- .../iptables/files/systemd/ip6tables.service | 6 - .../iptables/files/systemd/iptables.service | 6 - ...-1.8.7.ebuild => iptables-1.8.8-r5.ebuild} | 115 ++++++++------- .../net-firewall/iptables/metadata.xml | 2 +- 10 files changed, 314 insertions(+), 78 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-format-security.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-musl-headers.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-out-of-tree-build.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-uint-musl.patch rename sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/{iptables-r2.init => iptables-r3.init} (75%) delete mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service delete mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service rename sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/{iptables-1.8.7.ebuild => iptables-1.8.8-r5.ebuild} (54%) diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/Manifest b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/Manifest index 20be9ec24c..44c1d5abb4 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/Manifest @@ -1 +1 @@ -DIST iptables-1.8.7.tar.bz2 717862 BLAKE2B fd4dcff142eaadde2a14ce3eb5e45d41c326752553b52900c77fd2e2a20c0685d0a04b95755995e914df47658834d52216d6465c2ae9cd6abc6eb122b95cc976 SHA512 c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75 +DIST iptables-1.8.8.tar.bz2 746985 BLAKE2B 0da021cc7313b86af331768904956dab3eee3de245a7b03965129f3d7f13097fc03fbb1390167dcd971eff216eabad9e59b261a9c0f54bfc48a77453aa40d164 SHA512 f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-format-security.patch b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-format-security.patch new file mode 100644 index 0000000000..fafc435379 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-format-security.patch @@ -0,0 +1,21 @@ +https://git.netfilter.org/iptables/commit/?id=b72eb12ea5a61df0655ad99d5048994e916be83a + +From: Phil Sutter +Date: Fri, 13 May 2022 16:51:58 +0200 +Subject: xshared: Fix build for -Werror=format-security + +Gcc complains about the omitted format string. + +Signed-off-by: Phil Sutter +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + return; + + if (args->family != NFPROTO_ARP) +- xtables_error(PARAMETER_PROBLEM, msg); ++ xtables_error(PARAMETER_PROBLEM, "%s", msg); + + fprintf(stderr, "%s", msg); + } +cgit v1.2.3 diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-musl-headers.patch b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-musl-headers.patch new file mode 100644 index 0000000000..52e2c70199 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-musl-headers.patch @@ -0,0 +1,59 @@ +https://git.netfilter.org/iptables/commit/?id=0e7cf0ad306cdf95dc3c28d15a254532206a888e +https://bugs.gentoo.org/846377 + +From: Phil Sutter +Date: Wed, 18 May 2022 16:04:09 +0200 +Subject: Revert "fix build for missing ETH_ALEN definition" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This reverts commit c5d9a723b5159a28f547b577711787295a14fd84 as it broke +compiling against musl libc. Might be a bug in the latter, but for the +time being try to please both by avoiding the include and instead +defining ETH_ALEN if unset. + +While being at it, move netinet/ether.h include up. + +Fixes: 1bdb5535f561a ("libxtables: Extend MAC address printing/parsing support") +Signed-off-by: Phil Sutter +Reviewed-by: Maciej Żenczykowski +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -45,7 +46,6 @@ + + #include + #include /* INT_MAX in ip_tables.h/ip6_tables.h */ +-#include /* ETH_ALEN */ + #include + #include + #include +@@ -72,6 +72,10 @@ + #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" + #endif + ++#ifndef ETH_ALEN ++#define ETH_ALEN 6 ++#endif ++ + /* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the + * current line of the input file, in order to give a more precise error + * message. ip6?tables itself doesn't need this, so it is initialized to the +@@ -2245,8 +2249,6 @@ void xtables_print_num(uint64_t number, unsigned int format) + printf(FMT("%4lluT ","%lluT "), (unsigned long long)number); + } + +-#include +- + static const unsigned char mac_type_unicast[ETH_ALEN] = {}; + static const unsigned char msk_type_unicast[ETH_ALEN] = {1}; + static const unsigned char mac_type_multicast[ETH_ALEN] = {1}; +cgit v1.2.3 diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-out-of-tree-build.patch b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-out-of-tree-build.patch new file mode 100644 index 0000000000..ee9e218b5d --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-out-of-tree-build.patch @@ -0,0 +1,26 @@ +https://git.netfilter.org/iptables/commit/?id=0ebf52fc951b2a4d98a166afb34af4f364bbeece + +From: Ben Brown +Date: Wed, 25 May 2022 16:26:13 +0100 +Subject: build: Fix error during out of tree build + +Fixes the following error: + + ../../libxtables/xtables.c:52:10: fatal error: libiptc/linux_list.h: No such file or directory + 52 | #include + +Fixes: f58b0d7406451 ("libxtables: Implement notargets hash table") +Signed-off-by: Ben Brown +Signed-off-by: Phil Sutter +--- a/libxtables/Makefile.am ++++ b/libxtables/Makefile.am +@@ -1,7 +1,7 @@ + # -*- Makefile -*- + + AM_CFLAGS = ${regular_CFLAGS} +-AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables ${kinclude_CPPFLAGS} ++AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables -I${top_srcdir} ${kinclude_CPPFLAGS} + + lib_LTLIBRARIES = libxtables.la + libxtables_la_SOURCES = xtables.c xtoptions.c getethertype.c +cgit v1.2.3 diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-uint-musl.patch b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-uint-musl.patch new file mode 100644 index 0000000000..40302f624e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.8-uint-musl.patch @@ -0,0 +1,135 @@ +https://git.netfilter.org/iptables/commit/?id=f319389525b066b7dc6d389c88f16a0df3b8f189 + +From: Nick Hainke +Date: Mon, 16 May 2022 18:16:41 +0200 +Subject: treewide: use uint* instead of u_int* + +Gcc complains about missing types. Some commits introduced u_int* instead +of uint*. Use uint treewide. + +Fixes errors in the form of: +In file included from xtables-legacy-multi.c:5: +xshared.h:83:56: error: unknown type name 'u_int16_t'; did you mean 'uint16_t'? + 83 | set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, + | ^~~~~~~~~ + | uint16_t +make[6]: *** [Makefile:712: xtables_legacy_multi-xtables-legacy-multi.o] Error 1 + +Avoid libipq API breakage by adjusting libipq.h include accordingly. For +arpt_mangle.h kernel uAPI header, apply same change as in kernel commit +e91ded8db5747 ("uapi: netfilter_arp: use __u8 instead of u_int8_t"). + +Signed-off-by: Nick Hainke +Signed-off-by: Phil Sutter +--- a/extensions/libxt_conntrack.c ++++ b/extensions/libxt_conntrack.c +@@ -778,7 +778,7 @@ matchinfo_print(const void *ip, const struct xt_entry_match *match, int numeric, + + static void + conntrack_dump_ports(const char *prefix, const char *opt, +- u_int16_t port_low, u_int16_t port_high) ++ uint16_t port_low, uint16_t port_high) + { + if (port_high == 0 || port_low == port_high) + printf(" %s%s %u", prefix, opt, port_low); +--- a/include/libipq/libipq.h ++++ b/include/libipq/libipq.h +@@ -24,7 +24,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -48,19 +48,19 @@ typedef unsigned long ipq_id_t; + struct ipq_handle + { + int fd; +- u_int8_t blocking; ++ uint8_t blocking; + struct sockaddr_nl local; + struct sockaddr_nl peer; + }; + +-struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol); ++struct ipq_handle *ipq_create_handle(uint32_t flags, uint32_t protocol); + + int ipq_destroy_handle(struct ipq_handle *h); + + ssize_t ipq_read(const struct ipq_handle *h, + unsigned char *buf, size_t len, int timeout); + +-int ipq_set_mode(const struct ipq_handle *h, u_int8_t mode, size_t len); ++int ipq_set_mode(const struct ipq_handle *h, uint8_t mode, size_t len); + + ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf); + +--- a/include/libiptc/libxtc.h ++++ b/include/libiptc/libxtc.h +@@ -10,7 +10,7 @@ extern "C" { + #endif + + #ifndef XT_MIN_ALIGN +-/* xt_entry has pointers and u_int64_t's in it, so if you align to ++/* xt_entry has pointers and uint64_t's in it, so if you align to + it, you'll also align to any crazy matches and targets someone + might write */ + #define XT_MIN_ALIGN (__alignof__(struct xt_entry)) +--- a/include/linux/netfilter_arp/arpt_mangle.h ++++ b/include/linux/netfilter_arp/arpt_mangle.h +@@ -13,7 +13,7 @@ struct arpt_mangle + union { + struct in_addr tgt_ip; + } u_t; +- u_int8_t flags; ++ __u8 flags; + int target; + }; + +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1025,7 +1025,7 @@ static const int inverse_for_options[NUMBER_OF_OPT] = + }; + + void +-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, ++set_option(unsigned int *options, unsigned int option, uint16_t *invflg, + bool invert) + { + if (*options & option) +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,7 @@ struct xtables_target; + #define IPT_INV_ARPHRD 0x0800 + + void +-set_option(unsigned int *options, unsigned int option, u_int16_t *invflg, ++set_option(unsigned int *options, unsigned int option, uint16_t *invflg, + bool invert); + + /** +--- a/libipq/ipq_create_handle.3 ++++ b/libipq/ipq_create_handle.3 +@@ -24,7 +24,7 @@ ipq_create_handle, ipq_destroy_handle \(em create and destroy libipq handles. + .br + .B #include + .sp +-.BI "struct ipq_handle *ipq_create_handle(u_int32_t " flags ", u_int32_t " protocol ");" ++.BI "struct ipq_handle *ipq_create_handle(uint32_t " flags ", uint32_t " protocol ");" + .br + .BI "int ipq_destroy_handle(struct ipq_handle *" h ); + .SH DESCRIPTION +--- a/libipq/ipq_set_mode.3 ++++ b/libipq/ipq_set_mode.3 +@@ -24,7 +24,7 @@ ipq_set_mode \(em set the ip_queue queuing mode + .br + .B #include + .sp +-.BI "int ipq_set_mode(const struct ipq_handle *" h ", u_int8_t " mode ", size_t " range ); ++.BI "int ipq_set_mode(const struct ipq_handle *" h ", uint8_t " mode ", size_t " range ); + .SH DESCRIPTION + The + .B ipq_set_mode +cgit v1.2.3 diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r2.init b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r3.init similarity index 75% rename from sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r2.init rename to sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r3.init index 3dcabb0dfb..53eb4246c5 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r2.init +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r3.init @@ -1,5 +1,5 @@ #!/sbin/openrc-run -# Copyright 1999-2018 Gentoo Authors +# Copyright 1999-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 extra_commands="check save panic" @@ -38,7 +38,7 @@ set_table_policy() { local chain for chain in ${chains} ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy} + ${iptables_bin} --wait ${iptables_lock_wait_time} -t ${table} -P ${chain} ${policy} [ $? -ne 0 ] && has_errors=1 done @@ -69,7 +69,7 @@ start_pre() { start() { ebegin "Loading ${iptables_name} state and starting firewall" - ${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" + ${iptables_bin}-restore --wait ${iptables_lock_wait_time} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" eend $? } @@ -88,10 +88,10 @@ stop() { set_table_policy $a ACCEPT [ $? -ne 0 ] && has_errors=1 - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a [ $? -ne 0 ] && has_errors=1 - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a [ $? -ne 0 ] && has_errors=1 done eend ${has_errors} @@ -103,10 +103,10 @@ reload() { ebegin "Flushing firewall" local has_errors=0 a for a in $(cat ${iptables_proc}) ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a [ $? -ne 0 ] && has_errors=1 - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a [ $? -ne 0 ] && has_errors=1 done eend ${has_errors} @@ -136,7 +136,7 @@ save() { panic() { # use iptables autoload capability to load at least all required # modules and filter table - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null + ${iptables_bin} --wait ${iptables_lock_wait_time} -S >/dev/null if [ $? -ne 0 ] ; then eerror "${iptables_bin} failed to load" return 1 @@ -149,10 +149,10 @@ panic() { local has_errors=0 a ebegin "Dropping all packets" for a in $(cat ${iptables_proc}) ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a [ $? -ne 0 ] && has_errors=1 - ${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a + ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a [ $? -ne 0 ] && has_errors=1 if [ "${a}" != "nat" ]; then diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service deleted file mode 100644 index 0a6d7fa1c8..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service +++ /dev/null @@ -1,6 +0,0 @@ -[Unit] -Description=Store and restore ip6tables firewall rules - -[Install] -Also=ip6tables-store.service -Also=ip6tables-restore.service diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service deleted file mode 100644 index 3643a3e310..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service +++ /dev/null @@ -1,6 +0,0 @@ -[Unit] -Description=Store and restore iptables firewall rules - -[Install] -Also=iptables-store.service -Also=iptables-restore.service diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild similarity index 54% rename from sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild rename to sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild index 69ab247e39..992da3a8d4 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild @@ -1,9 +1,9 @@ -# Copyright 1999-2021 Gentoo Authors +# Copyright 1999-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=7 +EAPI=8 -inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript +inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools" HOMEPAGE="https://www.netfilter.org/projects/iptables/" @@ -13,51 +13,50 @@ LICENSE="GPL-2" # Subslot reflects PV when libxtables and/or libip*tc was changed # the last time. SLOT="0/1.8.3" -KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86" -IUSE="conntrack ipv6 netlink nftables pcap static-libs" +KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86" +IUSE="conntrack netlink nftables pcap static-libs" -BUILD_DEPEND=" - >=app-eselect/eselect-iptables-20200508 -" COMMON_DEPEND=" conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 ) netlink? ( net-libs/libnfnetlink ) nftables? ( - >=net-libs/libmnl-1.0:0= - >=net-libs/libnftnl-1.1.6:0= + >=net-libs/libmnl-1.0:= + >=net-libs/libnftnl-1.1.6:= ) pcap? ( net-libs/libpcap ) " -DEPEND="${COMMON_DEPEND} +DEPEND=" + ${COMMON_DEPEND} virtual/os-headers >=sys-kernel/linux-headers-4.4:0 " -# Flatcar: Rename virtual/yacc to app-alternatives/yacc. The former is -# gone in favor of the latter in Gentoo. This modification will be -# dropped when we update this ebuild from Gentoo. -BDEPEND="${BUILD_DEPEND} - app-eselect/eselect-iptables +BDEPEND=" virtual/pkgconfig nftables? ( sys-devel/flex app-alternatives/yacc ) " -# Flatcar: Drop BUILD_DEPEND, as we would not like to ship -# eselect in the final image. Also, drop net-firewall/arptables as we don't -# ship arptables -RDEPEND="${COMMON_DEPEND} +RDEPEND=" + ${COMMON_DEPEND} nftables? ( net-misc/ethertypes ) !/dev/null; then elog "Current iptables implementation is unset, setting to ${default_iptables}" eselect iptables set "${default_iptables}" fi - # Flatcar: Drop the arptables, but retain the `for` structure in favor of lesser diff - # to upstream + if use nftables; then local tables - for tables in ebtables; do + for tables in {arp,eb}tables; do if ! eselect ${tables} show &>/dev/null; then elog "Current ${tables} implementation is unset, setting to ${default_iptables}" - eselect ${tables} set "${default_iptables}" + eselect ${tables} set xtables-nft-multi fi done fi @@ -165,14 +159,27 @@ pkg_postinst() { } pkg_prerm() { - elog "Unsetting iptables symlinks before removal" - eselect iptables unset + if [[ -z ${REPLACED_BY_VERSION} ]]; then + elog "Unsetting iptables symlinks before removal" + eselect iptables unset + fi if ! has_version 'net-firewall/ebtables'; then elog "Unsetting ebtables symlinks before removal" eselect ebtables unset + elif [[ -z ${REPLACED_BY_VERSION} ]]; then + elog "Resetting ebtables symlinks to ebtables-legacy" + eselect ebtables set ebtables-legacy fi - # the eselect module failing should not be fatal + if ! has_version 'net-firewall/arptables'; then + elog "Unsetting arptables symlinks before removal" + eselect arptables unset + elif [[ -z ${REPLACED_BY_VERSION} ]]; then + elog "Resetting arptables symlinks to arptables-legacy" + eselect arptables set arptables-legacy + fi + + # The eselect module failing should not be fatal return 0 } diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/metadata.xml b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/metadata.xml index 0b5f57f8bf..88c9e1780f 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/metadata.xml +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/metadata.xml @@ -1,5 +1,5 @@ - + base-system@gentoo.org From 6a48109132b6e3fe32ed6fd39de4446c21dfafae Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Mon, 14 Jun 2021 20:54:27 +0530 Subject: [PATCH 2/3] net-firewall/iptables: Apply the Flatcar patches Signed-off-by: Sayan Chowdhury --- .../iptables/files/systemd/ip6tables.service | 6 ++++ .../iptables/files/systemd/iptables.service | 6 ++++ .../iptables/iptables-1.8.8-r5.ebuild | 33 ++++++++----------- 3 files changed, 26 insertions(+), 19 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service create mode 100644 sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service new file mode 100644 index 0000000000..0a6d7fa1c8 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/ip6tables.service @@ -0,0 +1,6 @@ +[Unit] +Description=Store and restore ip6tables firewall rules + +[Install] +Also=ip6tables-store.service +Also=ip6tables-restore.service diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service new file mode 100644 index 0000000000..3643a3e310 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/systemd/iptables.service @@ -0,0 +1,6 @@ +[Unit] +Description=Store and restore iptables firewall rules + +[Install] +Also=iptables-store.service +Also=iptables-restore.service diff --git a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild index 992da3a8d4..f5aff78b2e 100644 --- a/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.8-r5.ebuild @@ -37,13 +37,13 @@ BDEPEND=" app-alternatives/yacc ) " +# Flatcar: Drop net-firewall/arptables as we don't ship arptables. RDEPEND=" ${COMMON_DEPEND} nftables? ( net-misc/ethertypes ) !/dev/null; then elog "Current iptables implementation is unset, setting to ${default_iptables}" eselect iptables set "${default_iptables}" fi - + # Flatcar: Drop the arptables, but retain the `for` structure in favor of lesser diff + # to upstream if use nftables; then local tables - for tables in {arp,eb}tables; do + for tables in ebtables; do if ! eselect ${tables} show &>/dev/null; then elog "Current ${tables} implementation is unset, setting to ${default_iptables}" - eselect ${tables} set xtables-nft-multi + eselect ${tables} set "${default_iptables}" fi done fi @@ -167,17 +173,6 @@ pkg_prerm() { if ! has_version 'net-firewall/ebtables'; then elog "Unsetting ebtables symlinks before removal" eselect ebtables unset - elif [[ -z ${REPLACED_BY_VERSION} ]]; then - elog "Resetting ebtables symlinks to ebtables-legacy" - eselect ebtables set ebtables-legacy - fi - - if ! has_version 'net-firewall/arptables'; then - elog "Unsetting arptables symlinks before removal" - eselect arptables unset - elif [[ -z ${REPLACED_BY_VERSION} ]]; then - elog "Resetting arptables symlinks to arptables-legacy" - eselect arptables set arptables-legacy fi # The eselect module failing should not be fatal From 353a9ba2a585ded3a3bde0327a9d8392872b6c19 Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Mon, 6 Feb 2023 09:47:32 +0100 Subject: [PATCH 3/3] changelog: add changelog for iptables 1.8.8 --- .../changelog/updates/2023-02-03-iptables-1.8.8.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md new file mode 100644 index 0000000000..6f3e814a2f --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2023-02-03-iptables-1.8.8.md @@ -0,0 +1 @@ +- iptables ([1.8.8](https://www.netfilter.org/projects/iptables/files/changes-iptables-1.8.8.txt))