mirror of
https://github.com/flatcar/scripts.git
synced 2026-05-05 20:26:44 +02:00
net-firewall/iptables: Sync with Gentoo
It's from Gentoo commit 22bfc072bebd72ec9724d73be037287cdfc9563a. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
This commit is contained in:
Flatcar Buildbot
Krzesimir Nowak
parent
ff257baa45
commit
b0f5d1627d
@ -1 +1,3 @@
|
||||
DIST iptables-1.8.11.tar.xz 649284 BLAKE2B 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1 SHA512 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
|
||||
DIST iptables-1.8.12.tar.xz 652440 BLAKE2B 5516aadcf413efde272b09d1747e78e19f1d9e5481cdfdfe2360ca5f16926bb17535f58e4014a3616c59da83f41b39fc71e591c916bc309c7ca31701785a9e7e SHA512 b25bd6f6f78a6192699bce44c2b29ca65351ef71198a84fa26d29c47cb24ed695ee0406f6581fa81ece4d30445bb0680def5dc328f7fc708b80cadcd0230fe49
|
||||
DIST iptables-1.8.12.tar.xz.sig 566 BLAKE2B aaa2574b6ad3848d8bb6603481a0f0734e2a529c0e0a351ee0178848dd981d507fbebff3a2756f2bd91bce373d7c398f572195c9767457e0ea096a20d2fc32a5 SHA512 c1a22b6c6104a0395823a8695eafca6459d82af3467e70e88dc5625aeb6d3feba485a3f2baaf0e8e6ff1b979dc1c764427a6d6614a070476078d1e2f8cd3fd34
|
||||
|
||||
@ -1,165 +0,0 @@
|
||||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2022 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
extra_commands="check save panic"
|
||||
extra_started_commands="reload"
|
||||
|
||||
iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"}
|
||||
iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"}
|
||||
|
||||
iptables_name=${SVCNAME}
|
||||
case ${iptables_name} in
|
||||
iptables|ip6tables) ;;
|
||||
*) iptables_name="iptables" ;;
|
||||
esac
|
||||
|
||||
iptables_bin="/sbin/${iptables_name}"
|
||||
case ${iptables_name} in
|
||||
iptables) iptables_proc="/proc/net/ip_tables_names"
|
||||
iptables_save=${IPTABLES_SAVE};;
|
||||
ip6tables) iptables_proc="/proc/net/ip6_tables_names"
|
||||
iptables_save=${IP6TABLES_SAVE};;
|
||||
esac
|
||||
|
||||
depend() {
|
||||
need localmount #434774
|
||||
before net
|
||||
}
|
||||
|
||||
set_table_policy() {
|
||||
local has_errors=0 chains table=$1 policy=$2
|
||||
case ${table} in
|
||||
nat) chains="PREROUTING POSTROUTING OUTPUT";;
|
||||
mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
|
||||
filter) chains="INPUT FORWARD OUTPUT";;
|
||||
*) chains="";;
|
||||
esac
|
||||
|
||||
local chain
|
||||
for chain in ${chains} ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -t ${table} -P ${chain} ${policy}
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
|
||||
return ${has_errors}
|
||||
}
|
||||
|
||||
checkkernel() {
|
||||
if [ ! -e ${iptables_proc} ] ; then
|
||||
eerror "Your kernel lacks ${iptables_name} support, please load"
|
||||
eerror "appropriate modules and try again."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
checkconfig() {
|
||||
if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then
|
||||
eerror "Not starting ${iptables_name}. First create some rules then run:"
|
||||
eerror "/etc/init.d/${iptables_name} save"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
start_pre() {
|
||||
checkconfig || return 1
|
||||
}
|
||||
|
||||
start() {
|
||||
ebegin "Loading ${iptables_name} state and starting firewall"
|
||||
${iptables_bin}-restore --wait ${iptables_lock_wait_time} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
stop_pre() {
|
||||
checkkernel || return 1
|
||||
}
|
||||
|
||||
stop() {
|
||||
if [ "${SAVE_ON_STOP}" = "yes" ] ; then
|
||||
save || return 1
|
||||
fi
|
||||
|
||||
ebegin "Stopping firewall"
|
||||
local has_errors=0 a
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
set_table_policy $a ACCEPT
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend ${has_errors}
|
||||
}
|
||||
|
||||
reload() {
|
||||
checkkernel || return 1
|
||||
checkrules || return 1
|
||||
ebegin "Flushing firewall"
|
||||
local has_errors=0 a
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
done
|
||||
eend ${has_errors}
|
||||
|
||||
start
|
||||
}
|
||||
|
||||
checkrules() {
|
||||
ebegin "Checking rules"
|
||||
${iptables_bin}-restore --test ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
check() {
|
||||
# Short name for users of init.d script.
|
||||
checkrules
|
||||
}
|
||||
|
||||
save() {
|
||||
ebegin "Saving ${iptables_name} state"
|
||||
checkpath -q -d "$(dirname "${iptables_save}")"
|
||||
checkpath -q -m 0600 -f "${iptables_save}"
|
||||
${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
|
||||
eend $?
|
||||
}
|
||||
|
||||
panic() {
|
||||
# use iptables autoload capability to load at least all required
|
||||
# modules and filter table
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -S >/dev/null
|
||||
if [ $? -ne 0 ] ; then
|
||||
eerror "${iptables_bin} failed to load"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if service_started ${iptables_name}; then
|
||||
rc-service ${iptables_name} stop
|
||||
fi
|
||||
|
||||
local has_errors=0 a
|
||||
ebegin "Dropping all packets"
|
||||
for a in $(cat ${iptables_proc}) ; do
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
|
||||
if [ "${a}" != "nat" ]; then
|
||||
# The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.
|
||||
set_table_policy $a DROP
|
||||
[ $? -ne 0 ] && has_errors=1
|
||||
fi
|
||||
done
|
||||
eend ${has_errors}
|
||||
}
|
||||
@ -1,19 +1,23 @@
|
||||
# Copyright 1999-2025 Gentoo Authors
|
||||
# Copyright 1999-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
inherit systemd toolchain-funcs autotools flag-o-matic
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
|
||||
inherit systemd toolchain-funcs autotools flag-o-matic verify-sig
|
||||
|
||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz"
|
||||
SRC_URI="
|
||||
https://www.netfilter.org/projects/iptables/files/${P}.tar.xz
|
||||
verify-sig? ( https://www.netfilter.org/projects/iptables/files/${P}.tar.xz.sig )
|
||||
"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
# Subslot reflects PV when libxtables and/or libip*tc was changed
|
||||
# the last time.
|
||||
SLOT="0/1.8.3"
|
||||
KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
|
||||
IUSE="conntrack netlink nftables pcap static-libs test"
|
||||
RESTRICT="!test? ( test )"
|
||||
# TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
|
||||
@ -39,6 +43,7 @@ BDEPEND="
|
||||
app-alternatives/lex
|
||||
app-alternatives/yacc
|
||||
)
|
||||
verify-sig? ( sec-keys/openpgp-keys-netfilter )
|
||||
"
|
||||
RDEPEND="
|
||||
${COMMON_DEPEND}
|
||||
@ -111,7 +116,7 @@ src_install() {
|
||||
doins include/iptables/internal.h
|
||||
|
||||
keepdir /var/lib/ip{,6}tables
|
||||
newinitd "${FILESDIR}"/${PN}-r3.init iptables
|
||||
newinitd "${FILESDIR}"/${PN}-r4.init iptables
|
||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
||||
dosym iptables /etc/init.d/ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
||||
Loading…
x
Reference in New Issue
Block a user