Merge pull request #1079 from flatcar-linux/sayan/update-iptables-1.8.7

net-firewall/{ip,eb,nf}tables: Sync with Gentoo upstream; iptables 1.8.7; ebtables 2.0.11; nftables 0.9.9

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/Manifest

@@ -0,0 +1 @@
+DIST ebtables-2.0.11.tar.gz 428411 BLAKE2B 62af4c38ad21498e43f41ef96c8abb5704e8d8a48f1327c587b664f36fdfa9849a9a37e59958db56d38019465d8bf1775914f7387fde99a441615913702cf504 SHA512 43a04c6174c8028c501591ef260526297e0f018016f226e2a3bcf80766fddf53d4605c347554d6da7c4ab5e2131584a18da20916ffddcbf2d26ac93b00c5777f

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild

@@ -0,0 +1,107 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit autotools
+
+MY_PV="$(ver_rs 3 '-' )"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="Controls Ethernet frame filtering on a Linux bridge, MAC NAT and brouting"
+HOMEPAGE="https://ebtables.netfilter.org/"
+SRC_URI="http://ftp.netfilter.org/pub/${PN}/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 ~riscv x86"
+IUSE="+perl static"
+
+BDEPEND=">=app-eselect/eselect-iptables-20200508"
+# The ebtables-save script is written in perl.
+RDEPEND="${BDEPEND}
+	perl? ( dev-lang/perl )
+	net-misc/ethertypes"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.0.11-makefile.patch"
+
+	# Enhance ebtables-save to take table names as parameters bug #189315
+	"${FILESDIR}/${PN}-2.0.11-ebt-save.patch"
+
+	# from upstream git
+	"${FILESDIR}/ebtables-2.0.11-remove-stray-atsign.patch"
+)
+
+pkg_setup() {
+	if use static; then
+		ewarn "You've chosen static build which is useful for embedded devices."
+		ewarn "It has no init script. Make sure that's really what you want."
+	fi
+}
+
+src_prepare() {
+	default
+
+	# Don't install perl scripts if USE=perl is disabled.
+	if ! use perl; then
+		sed -i -e '/^sbin_SCRIPTS/ d' Makefile.am || die
+	fi
+
+	# The bundled autotools are borked, so force a rebuild.
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--bindir="/bin" \
+		--sbindir="/sbin" \
+		--libdir="/$(get_libdir)/${PN}" \
+		$(use_enable static)
+}
+
+src_compile() {
+	emake $(usex static 'static ebtables-legacy.8' '')
+}
+
+src_install() {
+	local -a DOCS=( ChangeLog THANKS )
+
+	if ! use static; then
+		emake DESTDIR="${D}" install
+		newinitd "${FILESDIR}"/ebtables.initd-r1 ebtables
+		newconfd "${FILESDIR}"/ebtables.confd-r1 ebtables
+
+		find "${D}" -name '*.la' -type f -delete || die
+
+		# The ethertypes package installs this for us.
+		rm "${ED}"/etc/ethertypes || die
+	else
+		into /
+		newsbin static ebtables
+	fi
+
+	newman ebtables-legacy.8 ebtables.8
+	einstalldocs
+}
+
+pkg_postinst() {
+	# Flatcar: Use the xtables-nft-multi to use the nft_backend instead of the legacy
+	if ! eselect ebtables show &>/dev/null; then
+		elog "Current ebtables implementation is unset, setting to xtables-nft-multi"
+		eselect ebtables set xtables-nft-multi
+	fi
+
+	eselect ebtables show
+}
+
+pkg_prerm() {
+	if [[ -z ${REPLACED_BY_VERSION} ]] && has_version 'net-firewall/iptables[nftables]'; then
+		elog "Resetting ebtables symlinks to xtables-nft-multi before removal"
+		eselect ebtables set xtables-nft-multi
+	else
+		elog "Unsetting ebtables symlinks before removal"
+		eselect ebtables unset
+	fi
+}

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables-2.0.11-ebt-save.patch

@@ -0,0 +1,26 @@
+diff --git a/ebtables-save.in b/ebtables-save.in
+index 17924a2..c7a64c3 100644
+--- a/ebtables-save.in
++++ b/ebtables-save.in
+@@ -12,6 +12,7 @@ my $ebtables = "@sbindir@/ebtables";
+ my $cnt = "";
+ my $version = "1.0";
+ my $table_name;
++my @table_names;
+ 
+ # ========================================================
+ # Process filter table
+@@ -49,6 +50,13 @@ sub process_table {
+ }
+ # ========================================================
+ 
++if ($#ARGV + 1 == 0) {
++   @table_names =split("\n", `grep -E '^ebtable_' /proc/modules | cut -f1 -d' ' | sed s/ebtable_//`);
++}
++else {
++   @table_names = @ARGV;
++}
++# ========================================================
+ unless (-x $ebtables) { exit -1 };
+ print "# Generated by ebtables-save v$version (legacy) on " . `date`;
+ if (defined($ENV{'EBTABLES_SAVE_COUNTER'}) && $ENV{'EBTABLES_SAVE_COUNTER'} eq "yes") {

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables-2.0.11-makefile.patch

@@ -0,0 +1,13 @@
+diff --git a/Makefile.am b/Makefile.am
+index 6181003..de01139 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -50,7 +50,7 @@ ebtables_legacy_LDADD = libebtc.la
+ ebtablesd_LDADD = libebtc.la
+ ebtables_legacy_restore_SOURCES = ebtables-restore.c
+ ebtables_legacy_restore_LDADD = libebtc.la
+-static_SOURCES = ebtables.c
++static_SOURCES = ebtables.c ebtables-standalone.c
+ static_LDFLAGS = -static
+ static_LDADD = libebtc.la
+ examples_ulog_test_ulog_SOURCES = examples/ulog/test_ulog.c getethertype.c

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables-2.0.11-remove-stray-atsign.patch

@@ -0,0 +1,32 @@
+From 7d00e58157bc61168a057cde91a6e5b54dca573b Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@inai.de>
+Date: Mon, 2 Dec 2019 20:52:04 +0100
+Subject: build: remove stray @ sign in manpage
+
+Because the sed command was not matching the trailing @, it
+was left in the manpage, leading to
+
+NAME
+       ebtables-legacy (2.0.11@) - Ethernet bridge frame table administration (legacy)
+
+Signed-off-by: Jan Engelhardt <jengelh@inai.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index b879941..6181003 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -64,6 +64,6 @@ ebtables-legacy-save: ebtables-save.in ${top_builddir}/config.status
+ 	${AM_V_GEN}sed -e 's![@]sbindir@!${sbindir}!g' <$< >$@
+ 
+ ebtables-legacy.8: ebtables-legacy.8.in ${top_builddir}/config.status
+-	${AM_V_GEN}sed -e 's![@]PACKAGE_VERSION!${PACKAGE_VERSION}!g' \
++	${AM_V_GEN}sed -e 's![@]PACKAGE_VERSION@!${PACKAGE_VERSION}!g' \
+ 		-e 's![@]PACKAGE_DATE@!${PROGDATE}!g' \
+ 		-e 's![@]LOCKFILE@!${LOCKFILE}!g' <$< >$@
+-- 
+cgit v1.2.1
+

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables.confd-r1

@@ -1,13 +1,13 @@
-# /etc/conf.d/ip6tables
+# /etc/conf.d/ebtables
 
-# Location in which iptables initscript will save set rules on 
+# Location in which ebtables initscript will save set rules on 
 # service shutdown
-IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+EBTABLES_SAVE="/var/lib/ebtables/rules-save"
 
-# Options to pass to iptables-save and iptables-restore 
-SAVE_RESTORE_OPTIONS="-c"
+# Options to pass to ebtables-save and ebtables-restore 
+SAVE_RESTORE_OPTIONS=""
 
-# Save state on stopping iptables
+# Save state on stopping ebtables
 SAVE_ON_STOP="yes"
 
 # If you need to log iptables messages as soon as iptables starts,

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/files/ebtables.initd-r1

@@ -0,0 +1,101 @@
+#!/sbin/openrc-run
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="save panic"
+extra_started_commands="reload"
+
+ebtables_bin="/sbin/ebtables"
+ebtables_save=${EBTABLES_SAVE}
+
+depend() {
+	before net
+}
+
+ebtables_tables() {
+	local table
+	for table in filter nat broute; do
+		if ${ebtables_bin} -t ${table} -L > /dev/null 2>&1; then
+			printf '%s' "${table} "
+		fi
+	done
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		broute) chains="BROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${ebtables_bin} -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkconfig() {
+	if [ ! -f ${ebtables_save} ] ; then
+		eerror "Not starting ebtables.  First create some rules then run:"
+		eerror "/etc/init.d/ebtables save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ebtables state and starting bridge firewall"
+	${ebtables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${ebtables_save}"
+	eend $?
+}
+
+stop() {
+	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+		save || return 1
+	fi
+	ebegin "Stopping bridge firewall"
+	local a
+	for a in $(ebtables_tables); do
+		set_table_policy $a ACCEPT
+
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing bridge firewall"
+	local a
+	for a in $(ebtables_tables); do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ebtables state"
+	checkpath -d -m 0755 "${ebtables_save%/*}"
+	checkpath -f -m 0600 "${ebtables_save}"
+	${ebtables_bin}-save $(ebtables_tables) ${SAVE_RESTORE_OPTIONS} > "${ebtables_save}"
+	eend $?
+}
+
+panic() {
+	service_started ebtables && svc_stop
+
+	local a
+	ebegin "Dropping all packets forwarded on bridges"
+	for a in $(ebtables_tables); do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}

sdk_container/src/third_party/coreos-overlay/net-firewall/ebtables/metadata.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>base-system@gentoo.org</email>
+		<name>Gentoo Base System</name>
+	</maintainer>
+	<use>
+		<flag name="perl">Install the ebtables-save script which uses perl</flag>
+	</use>
+	<upstream>
+		<remote-id type="sourceforge">ebtables</remote-id>
+		<remote-id type="cpe">cpe:/a:netfilter:ebtables</remote-id>
+	</upstream>
+</pkgmetadata>

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/Manifest

@@ -1 +1 @@
-DIST iptables-1.6.2.tar.bz2 639785 BLAKE2B 3d129756fd33c8c73d56d57e3c5595896db86ded14834a45db21b964d82840b62216ce3cea4ae4960e8c5f0671df3cc6bfb222f68d29cf3a8c99e0eee14bf017 SHA512 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
+DIST iptables-1.8.7.tar.bz2 717862 BLAKE2B fd4dcff142eaadde2a14ce3eb5e45d41c326752553b52900c77fd2e2a20c0685d0a04b95755995e914df47658834d52216d6465c2ae9cd6abc6eb122b95cc976 SHA512 c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/ip6tables-r1.confd

@@ -0,0 +1,27 @@
+# /etc/conf.d/ip6tables
+
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which ip6tables initscript will save set rules on
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to ip6tables-save and ip6tables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping ip6tables
+SAVE_ON_STOP="yes"
+
+# If you need to log ip6tables messages as soon as ip6tables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.2-link.patch

@@ -0,0 +1,24 @@
+From ee4fc7c558d9eb9c37035250046d4eac9af3fa28 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Thu, 27 Dec 2018 23:47:33 +0100
+Subject: [PATCH] Fix link errors for USE="conntrack static-libs" (bug #586106)
+
+---
+ iptables/Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/Makefile.am b/iptables/Makefile.am
+index 581dc32..2c3db86 100644
+--- a/iptables/Makefile.am
++++ b/iptables/Makefile.am
+@@ -26,6 +26,7 @@ xtables_legacy_multi_LDADD   += ../libiptc/libip6tc.la ../extensions/libext6.a
+ endif
+ xtables_legacy_multi_SOURCES += xshared.c
+ xtables_legacy_multi_LDADD   += ../libxtables/libxtables.la -lm
++xtables_legacy_multi_LDADD   += ${libnetfilter_conntrack_LIBS}
+ 
+ # iptables using nf_tables api
+ if ENABLE_NFTABLES
+-- 
+2.19.1
+

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-1.8.4-no-symlinks.patch

@@ -0,0 +1,19 @@
+diff --git a/iptables/Makefile.am b/iptables/Makefile.am
+index 71b1b1d4..30c77f9a 100644
+--- a/iptables/Makefile.am
++++ b/iptables/Makefile.am
+@@ -71,12 +71,10 @@ CLEANFILES       = iptables.8 xtables-monitor.8 \
+ 
+ vx_bin_links   = iptables-xml
+ if ENABLE_IPV4
+-v4_sbin_links  = iptables-legacy iptables-legacy-restore iptables-legacy-save \
+-		 iptables iptables-restore iptables-save
++v4_sbin_links  = iptables-legacy iptables-legacy-restore iptables-legacy-save
+ endif
+ if ENABLE_IPV6
+-v6_sbin_links  = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save \
+-		 ip6tables ip6tables-restore ip6tables-save
++v6_sbin_links  = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save
+ endif
+ if ENABLE_NFTABLES
+ x_sbin_links  = iptables-nft iptables-nft-restore iptables-nft-save \

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r1.confd

@@ -1,6 +1,14 @@
 # /etc/conf.d/iptables
 
-# Location in which iptables initscript will save set rules on 
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which iptables initscript will save set rules on
 # service shutdown
 IPTABLES_SAVE="/var/lib/iptables/rules-save"
 

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/files/iptables-r2.init

@@ -1,14 +1,17 @@
 #!/sbin/openrc-run
-# Copyright 1999-2013 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 extra_commands="check save panic"
 extra_started_commands="reload"
 
+iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"}
+iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"}
+
 iptables_name=${SVCNAME}
 case ${iptables_name} in
-iptables|ip6tables) ;;
-*) iptables_name="iptables" ;;
+	iptables|ip6tables) ;;
+	*) iptables_name="iptables" ;;
 esac
 
 iptables_bin="/sbin/${iptables_name}"
@@ -25,17 +28,21 @@ depend() {
 }
 
 set_table_policy() {
-	local chains table=$1 policy=$2
+	local has_errors=0 chains table=$1 policy=$2
 	case ${table} in
 		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
 		mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
 		filter) chains="INPUT FORWARD OUTPUT";;
 		*)      chains="";;
 	esac
+
 	local chain
 	for chain in ${chains} ; do
-		${iptables_bin} -w -t ${table} -P ${chain} ${policy}
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy}
+		[ $? -ne 0 ] && has_errors=1
 	done
+
+	return ${has_errors}
 }
 
 checkkernel() {
@@ -46,8 +53,9 @@ checkkernel() {
 	fi
 	return 0
 }
+
 checkconfig() {
-	if [ ! -f ${iptables_save} ] ; then
+	if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then
 		eerror "Not starting ${iptables_name}.  First create some rules then run:"
 		eerror "/etc/init.d/${iptables_name} save"
 		return 1
@@ -55,39 +63,53 @@ checkconfig() {
 	return 0
 }
 
-start() {
+start_pre() {
 	checkconfig || return 1
+}
+
+start() {
 	ebegin "Loading ${iptables_name} state and starting firewall"
-	${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
 	eend $?
 }
 
+stop_pre() {
+	checkkernel || return 1
+}
+
 stop() {
 	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
 		save || return 1
 	fi
-	checkkernel || return 1
+
 	ebegin "Stopping firewall"
-	local a
+	local has_errors=0 a
 	for a in $(cat ${iptables_proc}) ; do
 		set_table_policy $a ACCEPT
+		[ $? -ne 0 ] && has_errors=1
 
-		${iptables_bin} -w -F -t $a
-		${iptables_bin} -w -X -t $a
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
 	done
-	eend $?
+	eend ${has_errors}
 }
 
 reload() {
 	checkkernel || return 1
 	checkrules || return 1
 	ebegin "Flushing firewall"
-	local a
+	local has_errors=0 a
 	for a in $(cat ${iptables_proc}) ; do
-		${iptables_bin} -w -F -t $a
-		${iptables_bin} -w -X -t $a
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
 	done
-	eend $?
+	eend ${has_errors}
 
 	start
 }
@@ -112,18 +134,32 @@ save() {
 }
 
 panic() {
-	checkkernel || return 1
+	# use iptables autoload capability to load at least all required
+	# modules and filter table
+	${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null
+	if [ $? -ne 0 ] ; then
+		eerror "${iptables_bin} failed to load"
+		return 1
+	fi
+
 	if service_started ${iptables_name}; then
 		rc-service ${iptables_name} stop
 	fi
 
-	local a
+	local has_errors=0 a
 	ebegin "Dropping all packets"
 	for a in $(cat ${iptables_proc}) ; do
-		${iptables_bin} -w -F -t $a
-		${iptables_bin} -w -X -t $a
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a
+		[ $? -ne 0 ] && has_errors=1
 
-		set_table_policy $a DROP
+		${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a
+		[ $? -ne 0 ] && has_errors=1
+
+		if [ "${a}" != "nat" ]; then
+			# The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.
+			set_table_policy $a DROP
+			[ $? -ne 0 ] && has_errors=1
+		fi
 	done
-	eend $?
+	eend ${has_errors}
 }

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.6.2-r2.ebuild

@@ -1,123 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-# Force users doing their own patches to install their own tools
-AUTOTOOLS_AUTO_DEPEND=no
-
-inherit ltprune multilib systemd toolchain-funcs autotools flag-o-matic
-
-DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://www.netfilter.org/projects/iptables/"
-SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
-
-LICENSE="GPL-2"
-# Subslot tracks libxtables as that's the one other packages generally link
-# against and iptables changes.  Will have to revisit if other sonames change.
-SLOT="0/12"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
-IUSE="conntrack ipv6 netlink nftables pcap static-libs"
-
-COMMON_DEPEND="
-	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
-	netlink? ( net-libs/libnfnetlink )
-	nftables? (
-		>=net-libs/libmnl-1.0:0=
-		>=net-libs/libnftnl-1.0.5:0=
-	)
-	pcap? ( net-libs/libpcap )
-"
-DEPEND="${COMMON_DEPEND}
-	virtual/os-headers
-	>=sys-kernel/linux-headers-4.4:0
-	virtual/pkgconfig
-	nftables? (
-		sys-devel/flex
-		virtual/yacc
-	)
-"
-RDEPEND="${COMMON_DEPEND}
-	nftables? ( net-misc/ethertypes )
-"
-
-src_prepare() {
-	# use the saner headers from the kernel
-	rm -f include/linux/{kernel,types}.h
-
-	# Only run autotools if user patched something
-	eapply_user && eautoreconf || elibtoolize
-}
-
-src_configure() {
-	# Some libs use $(AR) rather than libtool to build #444282
-	tc-export AR
-
-	# Hack around struct mismatches between userland & kernel for some ABIs. #472388
-	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
-
-	sed -i \
-		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
-		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
-		configure || die
-
-	local myeconfargs=(
-		--sbindir="${EPREFIX}/sbin"
-		--libexecdir="${EPREFIX}/$(get_libdir)"
-		--enable-devel
-		--enable-shared
-		$(use_enable nftables)
-		$(use_enable pcap bpf-compiler)
-		$(use_enable pcap nfsynproxy)
-		$(use_enable static-libs static)
-		$(use_enable ipv6)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	# Deal with parallel build errors.
-	use nftables && emake -C iptables xtables-config-parser.h
-	emake V=1
-}
-
-src_install() {
-	default
-	dodoc INCOMPATIBILITIES iptables/iptables.xslt
-
-	# all the iptables binaries are in /sbin, so might as well
-	# put these small files in with them
-	into /
-	dosbin iptables/iptables-apply
-	dosym iptables-apply /sbin/ip6tables-apply
-	doman iptables/iptables-apply.8
-
-	insinto /usr/include
-	doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
-	insinto /usr/include/iptables
-	doins include/iptables/internal.h
-
-	keepdir /var/lib/iptables
-	newinitd "${FILESDIR}"/${PN}.init iptables
-	newconfd "${FILESDIR}"/${PN}-1.4.13.confd iptables
-	if use ipv6 ; then
-		keepdir /var/lib/ip6tables
-		newinitd "${FILESDIR}"/iptables.init ip6tables
-		newconfd "${FILESDIR}"/ip6tables-1.4.13.confd ip6tables
-	fi
-
-	if use nftables; then
-		# Bug 647458
-		rm "${ED%/}"/etc/ethertypes || die
-	fi
-
-	systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
-	if use ipv6 ; then
-		systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
-	fi
-
-	# Move important libs to /lib #332175
-	gen_usr_ldscript -a ip{4,6}tc iptc xtables
-
-	prune_libtool_files
-}

sdk_container/src/third_party/coreos-overlay/net-firewall/iptables/iptables-1.8.7.ebuild

@@ -0,0 +1,175 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://www.netfilter.org/projects/iptables/"
+SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+# Subslot reflects PV when libxtables and/or libip*tc was changed
+# the last time.
+SLOT="0/1.8.3"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="conntrack ipv6 netlink nftables pcap static-libs"
+
+BUILD_DEPEND="
+	>=app-eselect/eselect-iptables-20200508
+"
+COMMON_DEPEND="
+	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
+	netlink? ( net-libs/libnfnetlink )
+	nftables? (
+		>=net-libs/libmnl-1.0:0=
+		>=net-libs/libnftnl-1.1.6:0=
+	)
+	pcap? ( net-libs/libpcap )
+"
+DEPEND="${COMMON_DEPEND}
+	virtual/os-headers
+	>=sys-kernel/linux-headers-4.4:0
+"
+BDEPEND="${BUILD_DEPEND}
+	app-eselect/eselect-iptables
+	virtual/pkgconfig
+	nftables? (
+		sys-devel/flex
+		virtual/yacc
+	)
+"
+# Flatcar: Drop BUILD_DEPEND, as we would not like to ship
+# eselect in the final image. Also, drop net-firewall/arptables as we don't 
+# ship arptables
+RDEPEND="${COMMON_DEPEND}
+	nftables? ( net-misc/ethertypes )
+	!<net-firewall/ebtables-2.0.11-r1
+"
+
+PATCHES=(
+	"${FILESDIR}/iptables-1.8.4-no-symlinks.patch"
+	"${FILESDIR}/iptables-1.8.2-link.patch"
+)
+
+src_prepare() {
+	# use the saner headers from the kernel
+	rm include/linux/{kernel,types}.h || die
+
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Some libs use $(AR) rather than libtool to build #444282
+	tc-export AR
+
+	# Hack around struct mismatches between userland & kernel for some ABIs. #472388
+	use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
+
+	sed -i \
+		-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
+		-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
+		configure || die
+
+	local myeconfargs=(
+		--sbindir="${EPREFIX}/sbin"
+		--libexecdir="${EPREFIX}/$(get_libdir)"
+		--enable-devel
+		--enable-shared
+		$(use_enable nftables)
+		$(use_enable pcap bpf-compiler)
+		$(use_enable pcap nfsynproxy)
+		$(use_enable static-libs static)
+		$(use_enable ipv6)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=1
+}
+
+src_install() {
+	default
+	dodoc INCOMPATIBILITIES iptables/iptables.xslt
+
+	# all the iptables binaries are in /sbin, so might as well
+	# put these small files in with them
+	into /
+	dosbin iptables/iptables-apply
+	dosym iptables-apply /sbin/ip6tables-apply
+	doman iptables/iptables-apply.8
+
+	insinto /usr/include
+	doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
+	insinto /usr/include/iptables
+	doins include/iptables/internal.h
+
+	keepdir /var/lib/iptables
+	newinitd "${FILESDIR}"/${PN}-r2.init iptables
+	newconfd "${FILESDIR}"/${PN}-r1.confd iptables
+	if use ipv6 ; then
+		keepdir /var/lib/ip6tables
+		dosym iptables /etc/init.d/ip6tables
+		newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
+	fi
+
+	if use nftables; then
+		# Bug 647458
+		rm "${ED}"/etc/ethertypes || die
+
+		# Bugs 660886 and 669894
+		# Flatcar: We don't provide arptables* binaries.
+		# Flatcar: Keeping the ebtables binaries
+		rm "${ED}"/sbin/arptables{{,-{save,restore}},-nft{,-{save,restore}}} || die
+	fi
+
+	# Flatcar: Gentoo upstream dropped the iptables & ip6tables services
+	# but we continue to ship them
+	systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
+	if use ipv6 ; then
+		systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
+	fi
+
+	# Move important libs to /lib #332175
+	gen_usr_ldscript -a ip{4,6}tc xtables
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	# Flatcar: Use xtables-nft-multi to use the nft backend instead of legacy backend 
+	local default_iptables="xtables-nft-multi"
+	if ! eselect iptables show &>/dev/null; then
+		elog "Current iptables implementation is unset, setting to ${default_iptables}"
+		eselect iptables set "${default_iptables}"
+	fi
+	# Flatcar: Drop the arptables, but retain the `for` structure in favor of lesser diff
+	# to upstream
+	if use nftables; then
+		local tables
+		for tables in ebtables; do
+			if ! eselect ${tables} show &>/dev/null; then
+				elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
+				eselect ${tables} set "${default_iptables}"
+			fi
+		done
+	fi
+
+	eselect iptables show
+}
+
+pkg_prerm() {
+	elog "Unsetting iptables symlinks before removal"
+	eselect iptables unset
+
+	if ! has_version 'net-firewall/ebtables'; then
+		elog "Unsetting ebtables symlinks before removal"
+		eselect ebtables unset
+	fi
+
+	# the eselect module failing should not be fatal
+	return 0
+}

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/Manifest

@@ -1 +1 @@
-DIST nftables-0.6.tar.gz 252523 SHA256 85dd7fa4e741c0be02efddbc57b5d300e1147f09ec6f81d0399110f96dc958f0 SHA512 17f3b94687865e077dc082cf61b29ab2854fd1ffe18212a8d424f2876aef8db9780dd4d06dca8e6d093498151d47bab73e40e1f54062a83a23a3cbe75f27e921 WHIRLPOOL d15eaf81426d73bea28752f96727d291120120fb2aaa994d421d900974eb45062957435e077664fb916780f636ed9b61889dbec8b627d5d309512bae96f02874
+DIST nftables-0.9.9.tar.bz2 922624 BLAKE2B 8de2709576a26ca84a8d694f7cb06cad2bb2fb4671ba21ffc32c0d5997e8124ae7cd794dafddf4db48d8a49c280b48b07d2a31b6c18f6647fdb67cfe7f065b61 SHA512 dfdd3ffc0ffc1742ca0494a3f8fac1c7b2fe942849e60d33fc3cb8a51e27bd39e1ccfeda2195191377a32bb5363ea244f4c3e71b4a6d930f33bf87e17a534fab

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/files/nftables-0.5-pdf-doc.patch

@@ -1,52 +0,0 @@
-Update configure script to include option to enable and disable PDF man page
-generation.
-
---- a/configure.ac
-+++ b/configure.ac
-@@ -27,10 +27,16 @@
- AC_CONFIG_HEADER([config.h])
- 
- AC_DEFINE([_GNU_SOURCE], [], [Enable various GNU extensions])
- AC_DEFINE([_STDC_FORMAT_MACROS], [], [printf-style format macros])
- 
-+AC_ARG_ENABLE([pdf-doc],
-+	      AS_HELP_STRING([--disable-pdf-doc], [Disable PDF documentation]),
-+	      AS_IF([test "x$enable_pdf_doc" = "xno"], [enable_pdf_doc=no],
-+	      [enable_pdf_doc=yes]), [enable_pdf_doc=yes])
-+AM_CONDITIONAL([BUILD_PDF], [test "x$enable_pdf_doc" == "xyes" ])
-+
- AC_ARG_ENABLE([debug],
- 	      AS_HELP_STRING([--enable-debug], [Disable debugging]),
- 	      AS_IF([test "x$enable_debug" = "xno"], [with_debug=no], [with_debug=yes]),
- 	      [with_debug=yes])
- AC_SUBST(with_debug)
-@@ -61,15 +67,15 @@
- 	)]
- )
- AC_SUBST(DB2MAN)
- AM_CONDITIONAL([BUILD_MAN], [test -n "$DB2MAN"])
- 
--AC_CHECK_PROG(DBLATEX, [dblatex], [found], [no])
--AS_IF([test "$DBLATEX" == "no"],
--	[AC_MSG_WARN([dblatex not found, no PDF manpages will be built])]
--)
--AM_CONDITIONAL([BUILD_PDF], [test "$DBLATEX" == "found"])
-+AM_COND_IF([BUILD_PDF], [
-+	AC_CHECK_PROG(DBLATEX, [dblatex], [found], [no])
-+	AS_IF([test "$DBLATEX" == "no"],
-+	      [AC_MSG_ERROR([dblatex not found])])
-+])
- 
- # Checks for libraries.
- PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
- PKG_CHECK_MODULES([LIBNFTNL], [libnftnl >= 1.0.5])
- 
-@@ -134,6 +140,7 @@
- 
- echo "
- nft configuration:
-   cli support:			${with_cli}
-   enable debugging:		${with_debug}
--  use mini-gmp:			${with_mini_gmp}"
-+  use mini-gmp:			${with_mini_gmp}
-+  enable pdf documentation:	${enable_pdf_doc}"

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/files/nftables-0.6-null-payload-desc-fix.patch

@@ -1,14 +0,0 @@
-diff --git a/src/payload.c b/src/payload.c
-index ac0e917..9ba980a 100644
---- a/src/payload.c
-+++ b/src/payload.c
-@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
- 	base = ctx->protocol[left->payload.base].desc;
- 	desc = proto_find_upper(base, proto);
- 
-+	if (!desc)
-+		return;
-+
- 	assert(desc->base <= PROTO_BASE_MAX);
- 	if (desc->base == base->base) {
- 		assert(base->length > 0);

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/files/nftables-0.9.8-slibtool.patch

@@ -0,0 +1,13 @@
+This fixes build with sys-devel/slibtool
+
+--- nftables-0.9.8/src/Makefile.am
++++ nftables-0.9.8/src/Makefile.am
+@@ -90,7 +90,7 @@
+ 
+ libnftables_la_LIBADD = ${LIBMNL_LIBS} ${LIBNFTNL_LIBS} libparser.la
+ libnftables_la_LDFLAGS = -version-info ${libnftables_LIBVERSION} \
+-			 --version-script=$(srcdir)/libnftables.map
++			 -Wl,--version-script=$(srcdir)/libnftables.map
+ 
+ if BUILD_MINIGMP
+ noinst_LTLIBRARIES += libminigmp.la

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/metadata.xml

@@ -1,12 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>mrueg@gentoo.org</email>
-		<name>Manuel Rüger</name>
-	</maintainer>
 	<maintainer type="project">
 		<email>base-system@gentoo.org</email>
 		<name>Gentoo Base System</name>
 	</maintainer>
+	<maintainer type="person">
+		<email>prometheanfire@gentoo.org</email>
+		<name>Matthew Thode</name>
+	</maintainer>
+	<maintainer type="person" proxied="yes">
+		<email>klondike@gentoo.org</email>
+		<name>Francisco Blas Izquierdo Riera</name>
+	</maintainer>
+	<use>
+		<flag name="doc">Create man pages for the package (requires <pkg>app-text/asciidoc</pkg>)</flag>
+		<flag name="json">Enable JSON support via <pkg>dev-libs/jansson</pkg></flag>
+		<flag name="modern-kernel">Install init scripts for 3.18 or higher kernels with atomic rule updates</flag>
+		<flag name="xtables">Add libxtables support to try to automatically translate rules added by iptables-compat</flag>
+	</use>
 </pkgmetadata>

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/nftables-0.6-r4.ebuild

@@ -1,57 +0,0 @@
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools linux-info systemd
-
-DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
-HOMEPAGE="http://netfilter.org/projects/nftables/"
-SRC_URI="http://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="amd64 arm64 ~arm ~x86"
-IUSE="debug doc gmp +readline xml"
-
-RDEPEND=">=net-libs/libmnl-1.0.3
-	gmp? ( dev-libs/gmp:0= )
-	readline? ( sys-libs/readline:0= )
-	>=net-libs/libnftnl-1.0.6[xml(-)?]
-	"
-DEPEND="${RDEPEND}
-	doc? ( >=app-text/docbook2X-0.8.8-r4 >=app-text/dblatex-0.3.7 )
-	sys-devel/bison
-	sys-devel/flex
-	virtual/pkgconfig"
-
-S="${WORKDIR}/v${PV}"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-0.5-pdf-doc.patch"
-	"${FILESDIR}/${P}-null-payload-desc-fix.patch"
-)
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	econf \
-		--sysconfdir="${EPREFIX}"/usr/share \
-		--sbindir="${EPREFIX}"/sbin \
-		$(use_enable doc pdf-doc) \
-		$(use_enable debug) \
-		$(use_with readline cli) \
-		$(use_with !gmp mini_gmp)
-}

sdk_container/src/third_party/coreos-overlay/net-firewall/nftables/nftables-0.9.9.ebuild

@@ -0,0 +1,121 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_7 )
+
+inherit autotools linux-info python-r1 systemd
+
+DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+
+if [[ ${PV} =~ ^[9]{4,}$ ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
+
+	BDEPEND="
+		sys-devel/bison
+		sys-devel/flex
+	"
+else
+	SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
+	KEYWORDS="amd64 arm arm64 ~ia64 ppc ~ppc64 ~riscv sparc x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/1"
+IUSE="debug doc +gmp json libedit +modern-kernel python +readline static-libs xtables"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:0=
+	>=net-libs/libnftnl-1.2.0:0=
+	gmp? ( dev-libs/gmp:0= )
+	json? ( dev-libs/jansson:= )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	xtables? ( >=net-firewall/iptables-1.6.1 )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND+="
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+	libedit? ( !readline )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.9.8-slibtool.patch"
+)
+
+python_make() {
+	emake \
+		-C py \
+		abs_builddir="${S}" \
+		DESTDIR="${D}" \
+		PYTHON_BIN="${PYTHON}" \
+		"${@}"
+}
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		if use modern-kernel && kernel_is lt 3 18; then
+			eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
+		fi
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+
+	# fix installation path for doc stuff
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels@' \
+		-i files/nftables/Makefile.am || die
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels/osf@' \
+		-i files/osf/Makefile.am || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		# We handle python separately
+		--disable-python
+		--sbindir="${EPREFIX}"/sbin
+		--sysconfdir="${EPREFIX}"/usr/share 
+		$(use_enable debug)
+		$(use_enable doc man-doc)
+		$(use_with !gmp mini_gmp)
+		$(use_with json)
+		$(use_with libedit cli editline)
+		$(use_with readline cli readline)
+		$(use_enable static-libs static)
+		$(use_with xtables)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		python_foreach_impl python_make
+	fi
+}
+
+src_install() {
+	default
+	find "${ED}" -type f -name "*.la" -delete || die
+}

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -60,8 +60,6 @@ dev-util/checkbashisms
 # https://bugs.gentoo.org/686744
 =dev-lang/spidermonkey-1.8.5-r7
 
-=net-firewall/iptables-1.6.2-r2 ~arm64
-
 =sys-firmware/edk2-ovmf-201905 ~arm64
 
 =sys-auth/google-oslogin-20180611 **
@@ -104,3 +102,5 @@ dev-util/checkbashisms
 =dev-libs/libxml2-2.9.12-r2 ~amd64 ~arm64
 
 =dev-libs/libgcrypt-1.9.3 ~amd64 ~arm64
+
+=net-libs/libnftnl-1.2.0 ~amd64 ~arm64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use

@@ -138,3 +138,6 @@ net-fs/samba -regedit
 
 # Drop extra dependencies
 sys-libs/ldb -lmdb -python
+
+# Enable nftables backend for the iptables instead of legacy backend
+net-firewall/iptables nftables

sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided

@@ -11,6 +11,9 @@ app-eselect/eselect-pinentry-0.7
 app-admin/eselect-vi-1.1.5
 app-eselect/eselect-vi-1.1.7-r1
 
+# pulled in by net-firewall/iptables
+app-eselect/eselect-iptables-20200508
+
 # pulled in by app-admin/sudo
 app-misc/editor-wrapper-4