From b0f5d1627d46fc3cb0bfde0237116c8325b91bb5 Mon Sep 17 00:00:00 2001 From: Flatcar Buildbot Date: Mon, 2 Mar 2026 07:28:20 +0000 Subject: [PATCH] net-firewall/iptables: Sync with Gentoo It's from Gentoo commit 22bfc072bebd72ec9724d73be037287cdfc9563a. Signed-off-by: Flatcar Buildbot --- .../net-firewall/iptables/Manifest | 2 + .../iptables/files/iptables-r3.init | 165 ------------------ ...s-1.8.11.ebuild => iptables-1.8.12.ebuild} | 15 +- 3 files changed, 12 insertions(+), 170 deletions(-) delete mode 100644 sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-r3.init rename sdk_container/src/third_party/portage-stable/net-firewall/iptables/{iptables-1.8.11.ebuild => iptables-1.8.12.ebuild} (88%) diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest index 894ce3c7bc..678c49b2dd 100644 --- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest +++ b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/Manifest @@ -1 +1,3 @@ DIST iptables-1.8.11.tar.xz 649284 BLAKE2B 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1 SHA512 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +DIST iptables-1.8.12.tar.xz 652440 BLAKE2B 5516aadcf413efde272b09d1747e78e19f1d9e5481cdfdfe2360ca5f16926bb17535f58e4014a3616c59da83f41b39fc71e591c916bc309c7ca31701785a9e7e SHA512 b25bd6f6f78a6192699bce44c2b29ca65351ef71198a84fa26d29c47cb24ed695ee0406f6581fa81ece4d30445bb0680def5dc328f7fc708b80cadcd0230fe49 +DIST iptables-1.8.12.tar.xz.sig 566 BLAKE2B aaa2574b6ad3848d8bb6603481a0f0734e2a529c0e0a351ee0178848dd981d507fbebff3a2756f2bd91bce373d7c398f572195c9767457e0ea096a20d2fc32a5 SHA512 c1a22b6c6104a0395823a8695eafca6459d82af3467e70e88dc5625aeb6d3feba485a3f2baaf0e8e6ff1b979dc1c764427a6d6614a070476078d1e2f8cd3fd34 diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-r3.init b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-r3.init deleted file mode 100644 index 53eb4246c5..0000000000 --- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/files/iptables-r3.init +++ /dev/null @@ -1,165 +0,0 @@ -#!/sbin/openrc-run -# Copyright 1999-2022 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -extra_commands="check save panic" -extra_started_commands="reload" - -iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"} -iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"} - -iptables_name=${SVCNAME} -case ${iptables_name} in - iptables|ip6tables) ;; - *) iptables_name="iptables" ;; -esac - -iptables_bin="/sbin/${iptables_name}" -case ${iptables_name} in - iptables) iptables_proc="/proc/net/ip_tables_names" - iptables_save=${IPTABLES_SAVE};; - ip6tables) iptables_proc="/proc/net/ip6_tables_names" - iptables_save=${IP6TABLES_SAVE};; -esac - -depend() { - need localmount #434774 - before net -} - -set_table_policy() { - local has_errors=0 chains table=$1 policy=$2 - case ${table} in - nat) chains="PREROUTING POSTROUTING OUTPUT";; - mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";; - filter) chains="INPUT FORWARD OUTPUT";; - *) chains="";; - esac - - local chain - for chain in ${chains} ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} -t ${table} -P ${chain} ${policy} - [ $? -ne 0 ] && has_errors=1 - done - - return ${has_errors} -} - -checkkernel() { - if [ ! -e ${iptables_proc} ] ; then - eerror "Your kernel lacks ${iptables_name} support, please load" - eerror "appropriate modules and try again." - return 1 - fi - return 0 -} - -checkconfig() { - if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then - eerror "Not starting ${iptables_name}. First create some rules then run:" - eerror "/etc/init.d/${iptables_name} save" - return 1 - fi - return 0 -} - -start_pre() { - checkconfig || return 1 -} - -start() { - ebegin "Loading ${iptables_name} state and starting firewall" - ${iptables_bin}-restore --wait ${iptables_lock_wait_time} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" - eend $? -} - -stop_pre() { - checkkernel || return 1 -} - -stop() { - if [ "${SAVE_ON_STOP}" = "yes" ] ; then - save || return 1 - fi - - ebegin "Stopping firewall" - local has_errors=0 a - for a in $(cat ${iptables_proc}) ; do - set_table_policy $a ACCEPT - [ $? -ne 0 ] && has_errors=1 - - ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a - [ $? -ne 0 ] && has_errors=1 - - ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a - [ $? -ne 0 ] && has_errors=1 - done - eend ${has_errors} -} - -reload() { - checkkernel || return 1 - checkrules || return 1 - ebegin "Flushing firewall" - local has_errors=0 a - for a in $(cat ${iptables_proc}) ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a - [ $? -ne 0 ] && has_errors=1 - - ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a - [ $? -ne 0 ] && has_errors=1 - done - eend ${has_errors} - - start -} - -checkrules() { - ebegin "Checking rules" - ${iptables_bin}-restore --test ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" - eend $? -} - -check() { - # Short name for users of init.d script. - checkrules -} - -save() { - ebegin "Saving ${iptables_name} state" - checkpath -q -d "$(dirname "${iptables_save}")" - checkpath -q -m 0600 -f "${iptables_save}" - ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}" - eend $? -} - -panic() { - # use iptables autoload capability to load at least all required - # modules and filter table - ${iptables_bin} --wait ${iptables_lock_wait_time} -S >/dev/null - if [ $? -ne 0 ] ; then - eerror "${iptables_bin} failed to load" - return 1 - fi - - if service_started ${iptables_name}; then - rc-service ${iptables_name} stop - fi - - local has_errors=0 a - ebegin "Dropping all packets" - for a in $(cat ${iptables_proc}) ; do - ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a - [ $? -ne 0 ] && has_errors=1 - - ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a - [ $? -ne 0 ] && has_errors=1 - - if [ "${a}" != "nat" ]; then - # The "nat" table is not intended for filtering, the use of DROP is therefore inhibited. - set_table_policy $a DROP - [ $? -ne 0 ] && has_errors=1 - fi - done - eend ${has_errors} -} diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.11.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.12.ebuild similarity index 88% rename from sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.11.ebuild rename to sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.12.ebuild index d489707ea9..ce440b899b 100644 --- a/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.11.ebuild +++ b/sdk_container/src/third_party/portage-stable/net-firewall/iptables/iptables-1.8.12.ebuild @@ -1,19 +1,23 @@ -# Copyright 1999-2025 Gentoo Authors +# Copyright 1999-2026 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=8 -inherit systemd toolchain-funcs autotools flag-o-matic +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc +inherit systemd toolchain-funcs autotools flag-o-matic verify-sig DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools" HOMEPAGE="https://www.netfilter.org/projects/iptables/" -SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.xz" +SRC_URI=" + https://www.netfilter.org/projects/iptables/files/${P}.tar.xz + verify-sig? ( https://www.netfilter.org/projects/iptables/files/${P}.tar.xz.sig ) +" LICENSE="GPL-2" # Subslot reflects PV when libxtables and/or libip*tc was changed # the last time. SLOT="0/1.8.3" -KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" IUSE="conntrack netlink nftables pcap static-libs test" RESTRICT="!test? ( test )" # TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628) @@ -39,6 +43,7 @@ BDEPEND=" app-alternatives/lex app-alternatives/yacc ) + verify-sig? ( sec-keys/openpgp-keys-netfilter ) " RDEPEND=" ${COMMON_DEPEND} @@ -111,7 +116,7 @@ src_install() { doins include/iptables/internal.h keepdir /var/lib/ip{,6}tables - newinitd "${FILESDIR}"/${PN}-r3.init iptables + newinitd "${FILESDIR}"/${PN}-r4.init iptables newconfd "${FILESDIR}"/${PN}-r1.confd iptables dosym iptables /etc/init.d/ip6tables newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables