mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-17 18:06:59 +02:00
Merge pull request #1079 from flatcar-linux/sayan/update-iptables-1.8.7
net-firewall/{ip,eb,nf}tables: Sync with Gentoo upstream; iptables 1.8.7; ebtables 2.0.11; nftables 0.9.9
This commit is contained in:
Sayan Chowdhury
GitHub
commit
acf6871237
1
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/Manifest
vendored
Normal file
1
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/Manifest
vendored
Normal file
@ -0,0 +1 @@
|
||||
DIST ebtables-2.0.11.tar.gz 428411 BLAKE2B 62af4c38ad21498e43f41ef96c8abb5704e8d8a48f1327c587b664f36fdfa9849a9a37e59958db56d38019465d8bf1775914f7387fde99a441615913702cf504 SHA512 43a04c6174c8028c501591ef260526297e0f018016f226e2a3bcf80766fddf53d4605c347554d6da7c4ab5e2131584a18da20916ffddcbf2d26ac93b00c5777f
|
||||
107
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild
vendored
Normal file
107
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild
vendored
Normal file
@ -0,0 +1,107 @@
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI="7"
|
||||
|
||||
inherit autotools
|
||||
|
||||
MY_PV="$(ver_rs 3 '-' )"
|
||||
MY_P="${PN}-${MY_PV}"
|
||||
|
||||
DESCRIPTION="Controls Ethernet frame filtering on a Linux bridge, MAC NAT and brouting"
|
||||
HOMEPAGE="https://ebtables.netfilter.org/"
|
||||
SRC_URI="http://ftp.netfilter.org/pub/${PN}/${MY_P}.tar.gz"
|
||||
S="${WORKDIR}/${MY_P}"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 ~riscv x86"
|
||||
IUSE="+perl static"
|
||||
|
||||
BDEPEND=">=app-eselect/eselect-iptables-20200508"
|
||||
# The ebtables-save script is written in perl.
|
||||
RDEPEND="${BDEPEND}
|
||||
perl? ( dev-lang/perl )
|
||||
net-misc/ethertypes"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}-2.0.11-makefile.patch"
|
||||
|
||||
# Enhance ebtables-save to take table names as parameters bug #189315
|
||||
"${FILESDIR}/${PN}-2.0.11-ebt-save.patch"
|
||||
|
||||
# from upstream git
|
||||
"${FILESDIR}/ebtables-2.0.11-remove-stray-atsign.patch"
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use static; then
|
||||
ewarn "You've chosen static build which is useful for embedded devices."
|
||||
ewarn "It has no init script. Make sure that's really what you want."
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
# Don't install perl scripts if USE=perl is disabled.
|
||||
if ! use perl; then
|
||||
sed -i -e '/^sbin_SCRIPTS/ d' Makefile.am || die
|
||||
fi
|
||||
|
||||
# The bundled autotools are borked, so force a rebuild.
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
econf \
|
||||
--bindir="/bin" \
|
||||
--sbindir="/sbin" \
|
||||
--libdir="/$(get_libdir)/${PN}" \
|
||||
$(use_enable static)
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
emake $(usex static 'static ebtables-legacy.8' '')
|
||||
}
|
||||
|
||||
src_install() {
|
||||
local -a DOCS=( ChangeLog THANKS )
|
||||
|
||||
if ! use static; then
|
||||
emake DESTDIR="${D}" install
|
||||
newinitd "${FILESDIR}"/ebtables.initd-r1 ebtables
|
||||
newconfd "${FILESDIR}"/ebtables.confd-r1 ebtables
|
||||
|
||||
find "${D}" -name '*.la' -type f -delete || die
|
||||
|
||||
# The ethertypes package installs this for us.
|
||||
rm "${ED}"/etc/ethertypes || die
|
||||
else
|
||||
into /
|
||||
newsbin static ebtables
|
||||
fi
|
||||
|
||||
newman ebtables-legacy.8 ebtables.8
|
||||
einstalldocs
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
# Flatcar: Use the xtables-nft-multi to use the nft_backend instead of the legacy
|
||||
if ! eselect ebtables show &>/dev/null; then
|
||||
elog "Current ebtables implementation is unset, setting to xtables-nft-multi"
|
||||
eselect ebtables set xtables-nft-multi
|
||||
fi
|
||||
|
||||
eselect ebtables show
|
||||
}
|
||||
|
||||
pkg_prerm() {
|
||||
if [[ -z ${REPLACED_BY_VERSION} ]] && has_version 'net-firewall/iptables[nftables]'; then
|
||||
elog "Resetting ebtables symlinks to xtables-nft-multi before removal"
|
||||
eselect ebtables set xtables-nft-multi
|
||||
else
|
||||
elog "Unsetting ebtables symlinks before removal"
|
||||
eselect ebtables unset
|
||||
fi
|
||||
}
|
||||
@ -0,0 +1,26 @@
|
||||
diff --git a/ebtables-save.in b/ebtables-save.in
|
||||
index 17924a2..c7a64c3 100644
|
||||
--- a/ebtables-save.in
|
||||
+++ b/ebtables-save.in
|
||||
@@ -12,6 +12,7 @@ my $ebtables = "@sbindir@/ebtables";
|
||||
my $cnt = "";
|
||||
my $version = "1.0";
|
||||
my $table_name;
|
||||
+my @table_names;
|
||||
|
||||
# ========================================================
|
||||
# Process filter table
|
||||
@@ -49,6 +50,13 @@ sub process_table {
|
||||
}
|
||||
# ========================================================
|
||||
|
||||
+if ($#ARGV + 1 == 0) {
|
||||
+ @table_names =split("\n", `grep -E '^ebtable_' /proc/modules | cut -f1 -d' ' | sed s/ebtable_//`);
|
||||
+}
|
||||
+else {
|
||||
+ @table_names = @ARGV;
|
||||
+}
|
||||
+# ========================================================
|
||||
unless (-x $ebtables) { exit -1 };
|
||||
print "# Generated by ebtables-save v$version (legacy) on " . `date`;
|
||||
if (defined($ENV{'EBTABLES_SAVE_COUNTER'}) && $ENV{'EBTABLES_SAVE_COUNTER'} eq "yes") {
|
||||
@ -0,0 +1,13 @@
|
||||
diff --git a/Makefile.am b/Makefile.am
|
||||
index 6181003..de01139 100644
|
||||
--- a/Makefile.am
|
||||
+++ b/Makefile.am
|
||||
@@ -50,7 +50,7 @@ ebtables_legacy_LDADD = libebtc.la
|
||||
ebtablesd_LDADD = libebtc.la
|
||||
ebtables_legacy_restore_SOURCES = ebtables-restore.c
|
||||
ebtables_legacy_restore_LDADD = libebtc.la
|
||||
-static_SOURCES = ebtables.c
|
||||
+static_SOURCES = ebtables.c ebtables-standalone.c
|
||||
static_LDFLAGS = -static
|
||||
static_LDADD = libebtc.la
|
||||
examples_ulog_test_ulog_SOURCES = examples/ulog/test_ulog.c getethertype.c
|
||||
@ -0,0 +1,32 @@
|
||||
From 7d00e58157bc61168a057cde91a6e5b54dca573b Mon Sep 17 00:00:00 2001
|
||||
From: Jan Engelhardt <jengelh@inai.de>
|
||||
Date: Mon, 2 Dec 2019 20:52:04 +0100
|
||||
Subject: build: remove stray @ sign in manpage
|
||||
|
||||
Because the sed command was not matching the trailing @, it
|
||||
was left in the manpage, leading to
|
||||
|
||||
NAME
|
||||
ebtables-legacy (2.0.11@) - Ethernet bridge frame table administration (legacy)
|
||||
|
||||
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
---
|
||||
Makefile.am | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Makefile.am b/Makefile.am
|
||||
index b879941..6181003 100644
|
||||
--- a/Makefile.am
|
||||
+++ b/Makefile.am
|
||||
@@ -64,6 +64,6 @@ ebtables-legacy-save: ebtables-save.in ${top_builddir}/config.status
|
||||
${AM_V_GEN}sed -e 's![@]sbindir@!${sbindir}!g' <$< >$@
|
||||
|
||||
ebtables-legacy.8: ebtables-legacy.8.in ${top_builddir}/config.status
|
||||
- ${AM_V_GEN}sed -e 's![@]PACKAGE_VERSION!${PACKAGE_VERSION}!g' \
|
||||
+ ${AM_V_GEN}sed -e 's![@]PACKAGE_VERSION@!${PACKAGE_VERSION}!g' \
|
||||
-e 's![@]PACKAGE_DATE@!${PROGDATE}!g' \
|
||||
-e 's![@]LOCKFILE@!${LOCKFILE}!g' <$< >$@
|
||||
--
|
||||
cgit v1.2.1
|
||||
|
||||
@ -1,13 +1,13 @@
|
||||
# /etc/conf.d/ip6tables
|
||||
# /etc/conf.d/ebtables
|
||||
|
||||
# Location in which iptables initscript will save set rules on
|
||||
# Location in which ebtables initscript will save set rules on
|
||||
# service shutdown
|
||||
IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
|
||||
EBTABLES_SAVE="/var/lib/ebtables/rules-save"
|
||||
|
||||
# Options to pass to iptables-save and iptables-restore
|
||||
SAVE_RESTORE_OPTIONS="-c"
|
||||
# Options to pass to ebtables-save and ebtables-restore
|
||||
SAVE_RESTORE_OPTIONS=""
|
||||
|
||||
# Save state on stopping iptables
|
||||
# Save state on stopping ebtables
|
||||
SAVE_ON_STOP="yes"
|
||||
|
||||
# If you need to log iptables messages as soon as iptables starts,
|
||||
101
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables.initd-r1
vendored
Normal file
101
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables.initd-r1
vendored
Normal file
@ -0,0 +1,101 @@
|
||||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
extra_commands="save panic"
|
||||
extra_started_commands="reload"
|
||||
|
||||
ebtables_bin="/sbin/ebtables"
|
||||
ebtables_save=${EBTABLES_SAVE}
|
||||
|
||||
depend() {
|
||||
before net
|
||||
}
|
||||
|
||||
ebtables_tables() {
|
||||
local table
|
||||
for table in filter nat broute; do
|
||||
if ${ebtables_bin} -t ${table} -L > /dev/null 2>&1; then
|
||||
printf '%s' "${table} "
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
set_table_policy() {
|
||||
local chains table=$1 policy=$2
|
||||
case ${table} in
|
||||
nat) chains="PREROUTING POSTROUTING OUTPUT";;
|
||||
broute) chains="BROUTING";;
|
||||
filter) chains="INPUT FORWARD OUTPUT";;
|
||||
*) chains="";;
|
||||
esac
|
||||
local chain
|
||||
for chain in ${chains} ; do
|
||||
${ebtables_bin} -t ${table} -P ${chain} ${policy}
|
||||
done
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [ ! -f ${ebtables_save} ] ; then
|
||||
eerror "Not starting ebtables. First create some rules then run:"
|
||||
eerror "/etc/init.d/ebtables save"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
checkconfig || return 1
|
||||
ebegin "Loading ebtables state and starting bridge firewall"
|
||||
${ebtables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${ebtables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ "${SAVE_ON_STOP}" = "yes" ] ; then
|
||||
save || return 1
|
||||
fi
|
||||
ebegin "Stopping bridge firewall"
|
||||
local a
|
||||
for a in $(ebtables_tables); do
|
||||
set_table_policy $a ACCEPT
|
||||
|
||||
${ebtables_bin} -t $a -F
|
||||
${ebtables_bin} -t $a -X
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Flushing bridge firewall"
|
||||
local a
|
||||
for a in $(ebtables_tables); do
|
||||
${ebtables_bin} -t $a -F
|
||||
${ebtables_bin} -t $a -X
|
||||
done
|
||||
eend $?
|
||||
|
||||
start
|
||||
}
|
||||
|
||||
save() {
|
||||
ebegin "Saving ebtables state"
|
||||
checkpath -d -m 0755 "${ebtables_save%/*}"
|
||||
checkpath -f -m 0600 "${ebtables_save}"
|
||||
${ebtables_bin}-save $(ebtables_tables) ${SAVE_RESTORE_OPTIONS} > "${ebtables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
panic() {
|
||||
service_started ebtables && svc_stop
|
||||
|
||||
local a
|
||||
ebegin "Dropping all packets forwarded on bridges"
|
||||
for a in $(ebtables_tables); do
|
||||
${ebtables_bin} -t $a -F
|
||||
${ebtables_bin} -t $a -X
|
||||
|
||||
set_table_policy $a DROP
|
||||
done
|
||||
eend $?
|
||||
}
|
||||
15
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/metadata.xml
vendored
Normal file
15
sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/metadata.xml
vendored
Normal file
@ -0,0 +1,15 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="project">
|
||||
<email>base-system@gentoo.org</email>
|
||||
<name>Gentoo Base System</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="perl">Install the ebtables-save script which uses perl</flag>
|
||||
</use>
|
||||
<upstream>
|
||||
<remote-id type="sourceforge">ebtables</remote-id>
|
||||
<remote-id type="cpe">cpe:/a:netfilter:ebtables</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
@ -1 +1 @@
|
||||
DIST iptables-1.6.2.tar.bz2 639785 BLAKE2B 3d129756fd33c8c73d56d57e3c5595896db86ded14834a45db21b964d82840b62216ce3cea4ae4960e8c5f0671df3cc6bfb222f68d29cf3a8c99e0eee14bf017 SHA512 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
|
||||
DIST iptables-1.8.7.tar.bz2 717862 BLAKE2B fd4dcff142eaadde2a14ce3eb5e45d41c326752553b52900c77fd2e2a20c0685d0a04b95755995e914df47658834d52216d6465c2ae9cd6abc6eb122b95cc976 SHA512 c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75
|
||||
|
||||
27
sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/ip6tables-r1.confd
vendored
Normal file
27
sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/ip6tables-r1.confd
vendored
Normal file
@ -0,0 +1,27 @@
|
||||
# /etc/conf.d/ip6tables
|
||||
|
||||
# Set wait option for xtables lock in seconds
|
||||
# DEFAULT: 60
|
||||
#IPTABLES_LOCK_WAIT_TIME="60"
|
||||
|
||||
# Set wait interval option for xtables lock in microseconds
|
||||
# DEFAULT: 1000
|
||||
#IPTABLES_LOCK_WAIT_INTERVAL="1000"
|
||||
|
||||
# Location in which ip6tables initscript will save set rules on
|
||||
# service shutdown
|
||||
IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
|
||||
|
||||
# Options to pass to ip6tables-save and ip6tables-restore
|
||||
SAVE_RESTORE_OPTIONS="-c"
|
||||
|
||||
# Save state on stopping ip6tables
|
||||
SAVE_ON_STOP="yes"
|
||||
|
||||
# If you need to log ip6tables messages as soon as ip6tables starts,
|
||||
# AND your logger does NOT depend on the network, then you may wish
|
||||
# to uncomment the next line.
|
||||
# If your logger depends on the network, and you uncomment this line
|
||||
# you will create an unresolvable circular dependency during startup.
|
||||
# After commenting or uncommenting this line, you must run 'rc-update -u'.
|
||||
#rc_use="logger"
|
||||
@ -0,0 +1,24 @@
|
||||
From ee4fc7c558d9eb9c37035250046d4eac9af3fa28 Mon Sep 17 00:00:00 2001
|
||||
From: Sebastian Pipping <sebastian@pipping.org>
|
||||
Date: Thu, 27 Dec 2018 23:47:33 +0100
|
||||
Subject: [PATCH] Fix link errors for USE="conntrack static-libs" (bug #586106)
|
||||
|
||||
---
|
||||
iptables/Makefile.am | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
|
||||
index 581dc32..2c3db86 100644
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -26,6 +26,7 @@ xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
|
||||
endif
|
||||
xtables_legacy_multi_SOURCES += xshared.c
|
||||
xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
|
||||
+xtables_legacy_multi_LDADD += ${libnetfilter_conntrack_LIBS}
|
||||
|
||||
# iptables using nf_tables api
|
||||
if ENABLE_NFTABLES
|
||||
--
|
||||
2.19.1
|
||||
|
||||
@ -0,0 +1,19 @@
|
||||
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
|
||||
index 71b1b1d4..30c77f9a 100644
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -71,12 +71,10 @@ CLEANFILES = iptables.8 xtables-monitor.8 \
|
||||
|
||||
vx_bin_links = iptables-xml
|
||||
if ENABLE_IPV4
|
||||
-v4_sbin_links = iptables-legacy iptables-legacy-restore iptables-legacy-save \
|
||||
- iptables iptables-restore iptables-save
|
||||
+v4_sbin_links = iptables-legacy iptables-legacy-restore iptables-legacy-save
|
||||
endif
|
||||
if ENABLE_IPV6
|
||||
-v6_sbin_links = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save \
|
||||
- ip6tables ip6tables-restore ip6tables-save
|
||||
+v6_sbin_links = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save
|
||||
endif
|
||||
if ENABLE_NFTABLES
|
||||
x_sbin_links = iptables-nft iptables-nft-restore iptables-nft-save \
|
||||
@ -1,5 +1,13 @@
|
||||
# /etc/conf.d/iptables
|
||||
|
||||
# Set wait option for xtables lock in seconds
|
||||
# DEFAULT: 60
|
||||
#IPTABLES_LOCK_WAIT_TIME="60"
|
||||
|
||||
# Set wait interval option for xtables lock in microseconds
|
||||
# DEFAULT: 1000
|
||||
#IPTABLES_LOCK_WAIT_INTERVAL="1000"
|
||||
|
||||
# Location in which iptables initscript will save set rules on
|
||||
# service shutdown
|
||||
IPTABLES_SAVE="/var/lib/iptables/rules-save"
|
||||
@ -1,14 +1,17 @@
|
||||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2013 Gentoo Foundation
|
||||
# Copyright 1999-2018 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
extra_commands="check save panic"
|
||||
extra_started_commands="reload"
|
||||
|
||||
iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"}
|
||||
iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"}
|
||||
|
||||
iptables_name=${SVCNAME}
|
||||
case ${iptables_name} in
|
||||
iptables|ip6tables) ;;
|
||||
*) iptables_name="iptables" ;;
|
||||
iptables|ip6tables) ;;
|
||||
*) iptables_name="iptables" ;;
|
||||
esac
|
||||
|
||||
iptables_bin="/sbin/${iptables_name}"
|
||||
@ -25,17 +28,21 @@ depend() {
|
||||
}
|
||||
|
||||
set_table_policy() {
|
||||
local chains table=$1 policy=$2
|
||||
local has_errors=0 chains table=$1 policy=$2
|
||||
case ${table} in
|
||||
nat) chains="PREROUTING POSTROUTING OUTPUT";;
|
||||
mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
|
||||
filter) chains="INPUT FORWARD OUTPUT";;
|
||||
*) chains="";;
|
||||
esac
|
||||
|
||||
local chain
|
||||
for chain in ${chains} ; do
|
||||
${iptables_bin} -w -t ${table} -P ${chain} ${policy}
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy}
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
|
||||
return ${has_errors}
|
||||
}
|
||||
|
||||
checkkernel() {
|
||||
@ -46,8 +53,9 @@ checkkernel() {
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [ ! -f ${iptables_save} ] ; then
|
||||
if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then
|
||||
eerror "Not starting ${iptables_name}. First create some rules then run:"
|
||||
eerror "/etc/init.d/${iptables_name} save"
|
||||
return 1
|
||||
@ -55,39 +63,53 @@ checkconfig() {
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
start_pre() {
|
||||
checkconfig || return 1
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Loading ${iptables_name} state and starting firewall"
|
||||
${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop_pre() {
|
||||
checkkernel || return 1
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ "${SAVE_ON_STOP}" = "yes" ] ; then
|
||||
save || return 1
|
||||
fi
|
||||
checkkernel || return 1
|
||||
|
||||
ebegin "Stopping firewall"
|
||||
local a
|
||||
local has_errors=0 a
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
set_table_policy $a ACCEPT
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} -w -F -t $a
|
||||
${iptables_bin} -w -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend $?
|
||||
eend ${has_errors}
|
||||
}
|
||||
|
||||
reload() {
|
||||
checkkernel || return 1
|
||||
checkrules || return 1
|
||||
ebegin "Flushing firewall"
|
||||
local a
|
||||
local has_errors=0 a
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} -w -F -t $a
|
||||
${iptables_bin} -w -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend $?
|
||||
eend ${has_errors}
|
||||
|
||||
start
|
||||
}
|
||||
@ -112,18 +134,32 @@ save() {
|
||||
}
|
||||
|
||||
panic() {
|
||||
checkkernel || return 1
|
||||
# use iptables autoload capability to load at least all required
|
||||
# modules and filter table
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null
|
||||
if [ $? -ne 0 ] ; then
|
||||
eerror "${iptables_bin} failed to load"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if service_started ${iptables_name}; then
|
||||
rc-service ${iptables_name} stop
|
||||
fi
|
||||
|
||||
local a
|
||||
local has_errors=0 a
|
||||
ebegin "Dropping all packets"
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} -w -F -t $a
|
||||
${iptables_bin} -w -X -t $a
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
if [ "${a}" != "nat" ]; then
|
||||
# The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.
|
||||
set_table_policy $a DROP
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
fi
|
||||
done
|
||||
eend $?
|
||||
eend ${has_errors}
|
||||
}
|
||||
@ -1,123 +0,0 @@
|
||||
# Copyright 1999-2018 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
# Force users doing their own patches to install their own tools
|
||||
AUTOTOOLS_AUTO_DEPEND=no
|
||||
|
||||
inherit ltprune multilib systemd toolchain-funcs autotools flag-o-matic
|
||||
|
||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
# Subslot tracks libxtables as that's the one other packages generally link
|
||||
# against and iptables changes. Will have to revisit if other sonames change.
|
||||
SLOT="0/12"
|
||||
KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
|
||||
IUSE="conntrack ipv6 netlink nftables pcap static-libs"
|
||||
|
||||
COMMON_DEPEND="
|
||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
||||
netlink? ( net-libs/libnfnetlink )
|
||||
nftables? (
|
||||
>=net-libs/libmnl-1.0:0=
|
||||
>=net-libs/libnftnl-1.0.5:0=
|
||||
)
|
||||
pcap? ( net-libs/libpcap )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}
|
||||
virtual/os-headers
|
||||
>=sys-kernel/linux-headers-4.4:0
|
||||
virtual/pkgconfig
|
||||
nftables? (
|
||||
sys-devel/flex
|
||||
virtual/yacc
|
||||
)
|
||||
"
|
||||
RDEPEND="${COMMON_DEPEND}
|
||||
nftables? ( net-misc/ethertypes )
|
||||
"
|
||||
|
||||
src_prepare() {
|
||||
# use the saner headers from the kernel
|
||||
rm -f include/linux/{kernel,types}.h
|
||||
|
||||
# Only run autotools if user patched something
|
||||
eapply_user && eautoreconf || elibtoolize
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Some libs use $(AR) rather than libtool to build #444282
|
||||
tc-export AR
|
||||
|
||||
# Hack around struct mismatches between userland & kernel for some ABIs. #472388
|
||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
||||
|
||||
sed -i \
|
||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
||||
configure || die
|
||||
|
||||
local myeconfargs=(
|
||||
--sbindir="${EPREFIX}/sbin"
|
||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
||||
--enable-devel
|
||||
--enable-shared
|
||||
$(use_enable nftables)
|
||||
$(use_enable pcap bpf-compiler)
|
||||
$(use_enable pcap nfsynproxy)
|
||||
$(use_enable static-libs static)
|
||||
$(use_enable ipv6)
|
||||
)
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
# Deal with parallel build errors.
|
||||
use nftables && emake -C iptables xtables-config-parser.h
|
||||
emake V=1
|
||||
}
|
||||
|
||||
src_install() {
|
||||
default
|
||||
dodoc INCOMPATIBILITIES iptables/iptables.xslt
|
||||
|
||||
# all the iptables binaries are in /sbin, so might as well
|
||||
# put these small files in with them
|
||||
into /
|
||||
dosbin iptables/iptables-apply
|
||||
dosym iptables-apply /sbin/ip6tables-apply
|
||||
doman iptables/iptables-apply.8
|
||||
|
||||
insinto /usr/include
|
||||
doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
|
||||
insinto /usr/include/iptables
|
||||
doins include/iptables/internal.h
|
||||
|
||||
keepdir /var/lib/iptables
|
||||
newinitd "${FILESDIR}"/${PN}.init iptables
|
||||
newconfd "${FILESDIR}"/${PN}-1.4.13.confd iptables
|
||||
if use ipv6 ; then
|
||||
keepdir /var/lib/ip6tables
|
||||
newinitd "${FILESDIR}"/iptables.init ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-1.4.13.confd ip6tables
|
||||
fi
|
||||
|
||||
if use nftables; then
|
||||
# Bug 647458
|
||||
rm "${ED%/}"/etc/ethertypes || die
|
||||
fi
|
||||
|
||||
systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
|
||||
if use ipv6 ; then
|
||||
systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
|
||||
fi
|
||||
|
||||
# Move important libs to /lib #332175
|
||||
gen_usr_ldscript -a ip{4,6}tc iptc xtables
|
||||
|
||||
prune_libtool_files
|
||||
}
|
||||
175
sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild
vendored
Normal file
175
sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild
vendored
Normal file
@ -0,0 +1,175 @@
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
|
||||
inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
||||
|
||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
||||
# the last time.
|
||||
SLOT="0/1.8.3"
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
|
||||
IUSE="conntrack ipv6 netlink nftables pcap static-libs"
|
||||
|
||||
BUILD_DEPEND="
|
||||
>=app-eselect/eselect-iptables-20200508
|
||||
"
|
||||
COMMON_DEPEND="
|
||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
||||
netlink? ( net-libs/libnfnetlink )
|
||||
nftables? (
|
||||
>=net-libs/libmnl-1.0:0=
|
||||
>=net-libs/libnftnl-1.1.6:0=
|
||||
)
|
||||
pcap? ( net-libs/libpcap )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}
|
||||
virtual/os-headers
|
||||
>=sys-kernel/linux-headers-4.4:0
|
||||
"
|
||||
BDEPEND="${BUILD_DEPEND}
|
||||
app-eselect/eselect-iptables
|
||||
virtual/pkgconfig
|
||||
nftables? (
|
||||
sys-devel/flex
|
||||
virtual/yacc
|
||||
)
|
||||
"
|
||||
# Flatcar: Drop BUILD_DEPEND, as we would not like to ship
|
||||
# eselect in the final image. Also, drop net-firewall/arptables as we don't
|
||||
# ship arptables
|
||||
RDEPEND="${COMMON_DEPEND}
|
||||
nftables? ( net-misc/ethertypes )
|
||||
!<net-firewall/ebtables-2.0.11-r1
|
||||
"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/iptables-1.8.4-no-symlinks.patch"
|
||||
"${FILESDIR}/iptables-1.8.2-link.patch"
|
||||
)
|
||||
|
||||
src_prepare() {
|
||||
# use the saner headers from the kernel
|
||||
rm include/linux/{kernel,types}.h || die
|
||||
|
||||
default
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Some libs use $(AR) rather than libtool to build #444282
|
||||
tc-export AR
|
||||
|
||||
# Hack around struct mismatches between userland & kernel for some ABIs. #472388
|
||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
||||
|
||||
sed -i \
|
||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
||||
configure || die
|
||||
|
||||
local myeconfargs=(
|
||||
--sbindir="${EPREFIX}/sbin"
|
||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
||||
--enable-devel
|
||||
--enable-shared
|
||||
$(use_enable nftables)
|
||||
$(use_enable pcap bpf-compiler)
|
||||
$(use_enable pcap nfsynproxy)
|
||||
$(use_enable static-libs static)
|
||||
$(use_enable ipv6)
|
||||
)
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
emake V=1
|
||||
}
|
||||
|
||||
src_install() {
|
||||
default
|
||||
dodoc INCOMPATIBILITIES iptables/iptables.xslt
|
||||
|
||||
# all the iptables binaries are in /sbin, so might as well
|
||||
# put these small files in with them
|
||||
into /
|
||||
dosbin iptables/iptables-apply
|
||||
dosym iptables-apply /sbin/ip6tables-apply
|
||||
doman iptables/iptables-apply.8
|
||||
|
||||
insinto /usr/include
|
||||
doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
|
||||
insinto /usr/include/iptables
|
||||
doins include/iptables/internal.h
|
||||
|
||||
keepdir /var/lib/iptables
|
||||
newinitd "${FILESDIR}"/${PN}-r2.init iptables
|
||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
||||
if use ipv6 ; then
|
||||
keepdir /var/lib/ip6tables
|
||||
dosym iptables /etc/init.d/ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
||||
fi
|
||||
|
||||
if use nftables; then
|
||||
# Bug 647458
|
||||
rm "${ED}"/etc/ethertypes || die
|
||||
|
||||
# Bugs 660886 and 669894
|
||||
# Flatcar: We don't provide arptables* binaries.
|
||||
# Flatcar: Keeping the ebtables binaries
|
||||
rm "${ED}"/sbin/arptables{{,-{save,restore}},-nft{,-{save,restore}}} || die
|
||||
fi
|
||||
|
||||
# Flatcar: Gentoo upstream dropped the iptables & ip6tables services
|
||||
# but we continue to ship them
|
||||
systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
|
||||
if use ipv6 ; then
|
||||
systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
|
||||
fi
|
||||
|
||||
# Move important libs to /lib #332175
|
||||
gen_usr_ldscript -a ip{4,6}tc xtables
|
||||
|
||||
find "${ED}" -type f -name "*.la" -delete || die
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
# Flatcar: Use xtables-nft-multi to use the nft backend instead of legacy backend
|
||||
local default_iptables="xtables-nft-multi"
|
||||
if ! eselect iptables show &>/dev/null; then
|
||||
elog "Current iptables implementation is unset, setting to ${default_iptables}"
|
||||
eselect iptables set "${default_iptables}"
|
||||
fi
|
||||
# Flatcar: Drop the arptables, but retain the `for` structure in favor of lesser diff
|
||||
# to upstream
|
||||
if use nftables; then
|
||||
local tables
|
||||
for tables in ebtables; do
|
||||
if ! eselect ${tables} show &>/dev/null; then
|
||||
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
|
||||
eselect ${tables} set "${default_iptables}"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
eselect iptables show
|
||||
}
|
||||
|
||||
pkg_prerm() {
|
||||
elog "Unsetting iptables symlinks before removal"
|
||||
eselect iptables unset
|
||||
|
||||
if ! has_version 'net-firewall/ebtables'; then
|
||||
elog "Unsetting ebtables symlinks before removal"
|
||||
eselect ebtables unset
|
||||
fi
|
||||
|
||||
# the eselect module failing should not be fatal
|
||||
return 0
|
||||
}
|
||||
@ -1 +1 @@
|
||||
DIST nftables-0.6.tar.gz 252523 SHA256 85dd7fa4e741c0be02efddbc57b5d300e1147f09ec6f81d0399110f96dc958f0 SHA512 17f3b94687865e077dc082cf61b29ab2854fd1ffe18212a8d424f2876aef8db9780dd4d06dca8e6d093498151d47bab73e40e1f54062a83a23a3cbe75f27e921 WHIRLPOOL d15eaf81426d73bea28752f96727d291120120fb2aaa994d421d900974eb45062957435e077664fb916780f636ed9b61889dbec8b627d5d309512bae96f02874
|
||||
DIST nftables-0.9.9.tar.bz2 922624 BLAKE2B 8de2709576a26ca84a8d694f7cb06cad2bb2fb4671ba21ffc32c0d5997e8124ae7cd794dafddf4db48d8a49c280b48b07d2a31b6c18f6647fdb67cfe7f065b61 SHA512 dfdd3ffc0ffc1742ca0494a3f8fac1c7b2fe942849e60d33fc3cb8a51e27bd39e1ccfeda2195191377a32bb5363ea244f4c3e71b4a6d930f33bf87e17a534fab
|
||||
|
||||
@ -1,52 +0,0 @@
|
||||
Update configure script to include option to enable and disable PDF man page
|
||||
generation.
|
||||
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -27,10 +27,16 @@
|
||||
AC_CONFIG_HEADER([config.h])
|
||||
|
||||
AC_DEFINE([_GNU_SOURCE], [], [Enable various GNU extensions])
|
||||
AC_DEFINE([_STDC_FORMAT_MACROS], [], [printf-style format macros])
|
||||
|
||||
+AC_ARG_ENABLE([pdf-doc],
|
||||
+ AS_HELP_STRING([--disable-pdf-doc], [Disable PDF documentation]),
|
||||
+ AS_IF([test "x$enable_pdf_doc" = "xno"], [enable_pdf_doc=no],
|
||||
+ [enable_pdf_doc=yes]), [enable_pdf_doc=yes])
|
||||
+AM_CONDITIONAL([BUILD_PDF], [test "x$enable_pdf_doc" == "xyes" ])
|
||||
+
|
||||
AC_ARG_ENABLE([debug],
|
||||
AS_HELP_STRING([--enable-debug], [Disable debugging]),
|
||||
AS_IF([test "x$enable_debug" = "xno"], [with_debug=no], [with_debug=yes]),
|
||||
[with_debug=yes])
|
||||
AC_SUBST(with_debug)
|
||||
@@ -61,15 +67,15 @@
|
||||
)]
|
||||
)
|
||||
AC_SUBST(DB2MAN)
|
||||
AM_CONDITIONAL([BUILD_MAN], [test -n "$DB2MAN"])
|
||||
|
||||
-AC_CHECK_PROG(DBLATEX, [dblatex], [found], [no])
|
||||
-AS_IF([test "$DBLATEX" == "no"],
|
||||
- [AC_MSG_WARN([dblatex not found, no PDF manpages will be built])]
|
||||
-)
|
||||
-AM_CONDITIONAL([BUILD_PDF], [test "$DBLATEX" == "found"])
|
||||
+AM_COND_IF([BUILD_PDF], [
|
||||
+ AC_CHECK_PROG(DBLATEX, [dblatex], [found], [no])
|
||||
+ AS_IF([test "$DBLATEX" == "no"],
|
||||
+ [AC_MSG_ERROR([dblatex not found])])
|
||||
+])
|
||||
|
||||
# Checks for libraries.
|
||||
PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
|
||||
PKG_CHECK_MODULES([LIBNFTNL], [libnftnl >= 1.0.5])
|
||||
|
||||
@@ -134,6 +140,7 @@
|
||||
|
||||
echo "
|
||||
nft configuration:
|
||||
cli support: ${with_cli}
|
||||
enable debugging: ${with_debug}
|
||||
- use mini-gmp: ${with_mini_gmp}"
|
||||
+ use mini-gmp: ${with_mini_gmp}
|
||||
+ enable pdf documentation: ${enable_pdf_doc}"
|
||||
@ -1,14 +0,0 @@
|
||||
diff --git a/src/payload.c b/src/payload.c
|
||||
index ac0e917..9ba980a 100644
|
||||
--- a/src/payload.c
|
||||
+++ b/src/payload.c
|
||||
@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
|
||||
base = ctx->protocol[left->payload.base].desc;
|
||||
desc = proto_find_upper(base, proto);
|
||||
|
||||
+ if (!desc)
|
||||
+ return;
|
||||
+
|
||||
assert(desc->base <= PROTO_BASE_MAX);
|
||||
if (desc->base == base->base) {
|
||||
assert(base->length > 0);
|
||||
@ -0,0 +1,13 @@
|
||||
This fixes build with sys-devel/slibtool
|
||||
|
||||
--- nftables-0.9.8/src/Makefile.am
|
||||
+++ nftables-0.9.8/src/Makefile.am
|
||||
@@ -90,7 +90,7 @@
|
||||
|
||||
libnftables_la_LIBADD = ${LIBMNL_LIBS} ${LIBNFTNL_LIBS} libparser.la
|
||||
libnftables_la_LDFLAGS = -version-info ${libnftables_LIBVERSION} \
|
||||
- --version-script=$(srcdir)/libnftables.map
|
||||
+ -Wl,--version-script=$(srcdir)/libnftables.map
|
||||
|
||||
if BUILD_MINIGMP
|
||||
noinst_LTLIBRARIES += libminigmp.la
|
||||
@ -1,12 +1,22 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<maintainer type="person">
|
||||
<email>mrueg@gentoo.org</email>
|
||||
<name>Manuel Rüger</name>
|
||||
</maintainer>
|
||||
<maintainer type="project">
|
||||
<email>base-system@gentoo.org</email>
|
||||
<name>Gentoo Base System</name>
|
||||
</maintainer>
|
||||
<maintainer type="person">
|
||||
<email>prometheanfire@gentoo.org</email>
|
||||
<name>Matthew Thode</name>
|
||||
</maintainer>
|
||||
<maintainer type="person" proxied="yes">
|
||||
<email>klondike@gentoo.org</email>
|
||||
<name>Francisco Blas Izquierdo Riera</name>
|
||||
</maintainer>
|
||||
<use>
|
||||
<flag name="doc">Create man pages for the package (requires <pkg>app-text/asciidoc</pkg>)</flag>
|
||||
<flag name="json">Enable JSON support via <pkg>dev-libs/jansson</pkg></flag>
|
||||
<flag name="modern-kernel">Install init scripts for 3.18 or higher kernels with atomic rule updates</flag>
|
||||
<flag name="xtables">Add libxtables support to try to automatically translate rules added by iptables-compat</flag>
|
||||
</use>
|
||||
</pkgmetadata>
|
||||
|
||||
@ -1,57 +0,0 @@
|
||||
# Copyright 1999-2016 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
inherit autotools linux-info systemd
|
||||
|
||||
DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="http://netfilter.org/projects/nftables/"
|
||||
SRC_URI="http://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 arm64 ~arm ~x86"
|
||||
IUSE="debug doc gmp +readline xml"
|
||||
|
||||
RDEPEND=">=net-libs/libmnl-1.0.3
|
||||
gmp? ( dev-libs/gmp:0= )
|
||||
readline? ( sys-libs/readline:0= )
|
||||
>=net-libs/libnftnl-1.0.6[xml(-)?]
|
||||
"
|
||||
DEPEND="${RDEPEND}
|
||||
doc? ( >=app-text/docbook2X-0.8.8-r4 >=app-text/dblatex-0.3.7 )
|
||||
sys-devel/bison
|
||||
sys-devel/flex
|
||||
virtual/pkgconfig"
|
||||
|
||||
S="${WORKDIR}/v${PV}"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}-0.5-pdf-doc.patch"
|
||||
"${FILESDIR}/${P}-null-payload-desc-fix.patch"
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if kernel_is ge 3 13; then
|
||||
CONFIG_CHECK="~NF_TABLES"
|
||||
linux-info_pkg_setup
|
||||
else
|
||||
eerror "This package requires kernel version 3.13 or newer to work properly."
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
econf \
|
||||
--sysconfdir="${EPREFIX}"/usr/share \
|
||||
--sbindir="${EPREFIX}"/sbin \
|
||||
$(use_enable doc pdf-doc) \
|
||||
$(use_enable debug) \
|
||||
$(use_with readline cli) \
|
||||
$(use_with !gmp mini_gmp)
|
||||
}
|
||||
121
sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/nftables-0.9.9.ebuild
vendored
Normal file
121
sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/nftables-0.9.9.ebuild
vendored
Normal file
@ -0,0 +1,121 @@
|
||||
# Copyright 1999-2021 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=7
|
||||
|
||||
PYTHON_COMPAT=( python3_7 )
|
||||
|
||||
inherit autotools linux-info python-r1 systemd
|
||||
|
||||
DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://netfilter.org/projects/nftables/"
|
||||
|
||||
if [[ ${PV} =~ ^[9]{4,}$ ]]; then
|
||||
inherit git-r3
|
||||
EGIT_REPO_URI="https://git.netfilter.org/${PN}"
|
||||
|
||||
BDEPEND="
|
||||
sys-devel/bison
|
||||
sys-devel/flex
|
||||
"
|
||||
else
|
||||
SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
|
||||
KEYWORDS="amd64 arm arm64 ~ia64 ppc ~ppc64 ~riscv sparc x86"
|
||||
fi
|
||||
|
||||
LICENSE="GPL-2"
|
||||
SLOT="0/1"
|
||||
IUSE="debug doc +gmp json libedit +modern-kernel python +readline static-libs xtables"
|
||||
|
||||
RDEPEND="
|
||||
>=net-libs/libmnl-1.0.4:0=
|
||||
>=net-libs/libnftnl-1.2.0:0=
|
||||
gmp? ( dev-libs/gmp:0= )
|
||||
json? ( dev-libs/jansson:= )
|
||||
python? ( ${PYTHON_DEPS} )
|
||||
readline? ( sys-libs/readline:0= )
|
||||
xtables? ( >=net-firewall/iptables-1.6.1 )
|
||||
"
|
||||
|
||||
DEPEND="${RDEPEND}"
|
||||
|
||||
BDEPEND+="
|
||||
doc? (
|
||||
app-text/asciidoc
|
||||
>=app-text/docbook2X-0.8.8-r4
|
||||
)
|
||||
virtual/pkgconfig
|
||||
"
|
||||
|
||||
REQUIRED_USE="
|
||||
python? ( ${PYTHON_REQUIRED_USE} )
|
||||
libedit? ( !readline )
|
||||
"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}-0.9.8-slibtool.patch"
|
||||
)
|
||||
|
||||
python_make() {
|
||||
emake \
|
||||
-C py \
|
||||
abs_builddir="${S}" \
|
||||
DESTDIR="${D}" \
|
||||
PYTHON_BIN="${PYTHON}" \
|
||||
"${@}"
|
||||
}
|
||||
|
||||
pkg_setup() {
|
||||
if kernel_is ge 3 13; then
|
||||
if use modern-kernel && kernel_is lt 3 18; then
|
||||
eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
|
||||
fi
|
||||
CONFIG_CHECK="~NF_TABLES"
|
||||
linux-info_pkg_setup
|
||||
else
|
||||
eerror "This package requires kernel version 3.13 or newer to work properly."
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
# fix installation path for doc stuff
|
||||
sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels@' \
|
||||
-i files/nftables/Makefile.am || die
|
||||
sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels/osf@' \
|
||||
-i files/osf/Makefile.am || die
|
||||
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
local myeconfargs=(
|
||||
# We handle python separately
|
||||
--disable-python
|
||||
--sbindir="${EPREFIX}"/sbin
|
||||
--sysconfdir="${EPREFIX}"/usr/share
|
||||
$(use_enable debug)
|
||||
$(use_enable doc man-doc)
|
||||
$(use_with !gmp mini_gmp)
|
||||
$(use_with json)
|
||||
$(use_with libedit cli editline)
|
||||
$(use_with readline cli readline)
|
||||
$(use_enable static-libs static)
|
||||
$(use_with xtables)
|
||||
)
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
default
|
||||
|
||||
if use python; then
|
||||
python_foreach_impl python_make
|
||||
fi
|
||||
}
|
||||
|
||||
src_install() {
|
||||
default
|
||||
find "${ED}" -type f -name "*.la" -delete || die
|
||||
}
|
||||
@ -60,8 +60,6 @@ dev-util/checkbashisms
|
||||
# https://bugs.gentoo.org/686744
|
||||
=dev-lang/spidermonkey-1.8.5-r7
|
||||
|
||||
=net-firewall/iptables-1.6.2-r2 ~arm64
|
||||
|
||||
=sys-firmware/edk2-ovmf-201905 ~arm64
|
||||
|
||||
=sys-auth/google-oslogin-20180611 **
|
||||
@ -104,3 +102,5 @@ dev-util/checkbashisms
|
||||
=dev-libs/libxml2-2.9.12-r2 ~amd64 ~arm64
|
||||
|
||||
=dev-libs/libgcrypt-1.9.3 ~amd64 ~arm64
|
||||
|
||||
=net-libs/libnftnl-1.2.0 ~amd64 ~arm64
|
||||
|
||||
@ -138,3 +138,6 @@ net-fs/samba -regedit
|
||||
|
||||
# Drop extra dependencies
|
||||
sys-libs/ldb -lmdb -python
|
||||
|
||||
# Enable nftables backend for the iptables instead of legacy backend
|
||||
net-firewall/iptables nftables
|
||||
|
||||
@ -11,6 +11,9 @@ app-eselect/eselect-pinentry-0.7
|
||||
app-admin/eselect-vi-1.1.5
|
||||
app-eselect/eselect-vi-1.1.7-r1
|
||||
|
||||
# pulled in by net-firewall/iptables
|
||||
app-eselect/eselect-iptables-20200508
|
||||
|
||||
# pulled in by app-admin/sudo
|
||||
app-misc/editor-wrapper-4
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user