[net-firewall/iptables] sync with tree

This commit is contained in:
Robert Förster 2022-07-15 16:44:57 +02:00
parent c7690e78d0
commit b8d4439b5b
4 changed files with 136 additions and 46 deletions

View File

@ -0,0 +1,24 @@
From ee4fc7c558d9eb9c37035250046d4eac9af3fa28 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Thu, 27 Dec 2018 23:47:33 +0100
Subject: [PATCH] Fix link errors for USE="conntrack static-libs" (bug #586106)
---
iptables/Makefile.am | 1 +
1 file changed, 1 insertion(+)
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index 581dc32..2c3db86 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -26,6 +26,7 @@ xtables_legacy_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a
endif
xtables_legacy_multi_SOURCES += xshared.c
xtables_legacy_multi_LDADD += ../libxtables/libxtables.la -lm
+xtables_legacy_multi_LDADD += ${libnetfilter_conntrack_LIBS}
# iptables using nf_tables api
if ENABLE_NFTABLES
--
2.19.1

View File

@ -0,0 +1,19 @@
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
index 71b1b1d4..30c77f9a 100644
--- a/iptables/Makefile.am
+++ b/iptables/Makefile.am
@@ -71,12 +71,10 @@ CLEANFILES = iptables.8 xtables-monitor.8 \
vx_bin_links = iptables-xml
if ENABLE_IPV4
-v4_sbin_links = iptables-legacy iptables-legacy-restore iptables-legacy-save \
- iptables iptables-restore iptables-save
+v4_sbin_links = iptables-legacy iptables-legacy-restore iptables-legacy-save
endif
if ENABLE_IPV6
-v6_sbin_links = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save \
- ip6tables ip6tables-restore ip6tables-save
+v6_sbin_links = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save
endif
if ENABLE_NFTABLES
x_sbin_links = iptables-nft iptables-nft-restore iptables-nft-save \

View File

@ -1,5 +1,5 @@
#!/sbin/openrc-run #!/sbin/openrc-run
# Copyright 1999-2018 Gentoo Authors # Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2 # Distributed under the terms of the GNU General Public License v2
extra_commands="check save panic" extra_commands="check save panic"
@ -38,7 +38,7 @@ set_table_policy() {
local chain local chain
for chain in ${chains} ; do for chain in ${chains} ; do
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy} ${iptables_bin} --wait ${iptables_lock_wait_time} -t ${table} -P ${chain} ${policy}
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
done done
@ -69,7 +69,7 @@ start_pre() {
start() { start() {
ebegin "Loading ${iptables_name} state and starting firewall" ebegin "Loading ${iptables_name} state and starting firewall"
${iptables_bin}-restore --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" ${iptables_bin}-restore --wait ${iptables_lock_wait_time} ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
eend $? eend $?
} }
@ -88,10 +88,10 @@ stop() {
set_table_policy $a ACCEPT set_table_policy $a ACCEPT
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
done done
eend ${has_errors} eend ${has_errors}
@ -103,10 +103,10 @@ reload() {
ebegin "Flushing firewall" ebegin "Flushing firewall"
local has_errors=0 a local has_errors=0 a
for a in $(cat ${iptables_proc}) ; do for a in $(cat ${iptables_proc}) ; do
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
done done
eend ${has_errors} eend ${has_errors}
@ -136,7 +136,7 @@ save() {
panic() { panic() {
# use iptables autoload capability to load at least all required # use iptables autoload capability to load at least all required
# modules and filter table # modules and filter table
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -S >/dev/null ${iptables_bin} --wait ${iptables_lock_wait_time} -S >/dev/null
if [ $? -ne 0 ] ; then if [ $? -ne 0 ] ; then
eerror "${iptables_bin} failed to load" eerror "${iptables_bin} failed to load"
return 1 return 1
@ -149,10 +149,10 @@ panic() {
local has_errors=0 a local has_errors=0 a
ebegin "Dropping all packets" ebegin "Dropping all packets"
for a in $(cat ${iptables_proc}) ; do for a in $(cat ${iptables_proc}) ; do
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -F -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -F -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
${iptables_bin} --wait ${iptables_lock_wait_time} --wait-interval ${iptables_lock_wait_interval} -X -t $a ${iptables_bin} --wait ${iptables_lock_wait_time} -X -t $a
[ $? -ne 0 ] && has_errors=1 [ $? -ne 0 ] && has_errors=1
if [ "${a}" != "nat" ]; then if [ "${a}" != "nat" ]; then

View File

@ -1,12 +1,9 @@
# Copyright 1999-2019 Gentoo Authors # Copyright 1999-2022 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2 # Distributed under the terms of the GNU General Public License v2
EAPI=7 EAPI=8
# Force users doing their own patches to install their own tools inherit systemd toolchain-funcs autotools flag-o-matic usr-ldscript git-r3
AUTOTOOLS_AUTO_DEPEND=no
inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript git-r3
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools" DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
HOMEPAGE="https://www.netfilter.org/projects/iptables/" HOMEPAGE="https://www.netfilter.org/projects/iptables/"
@ -17,18 +14,19 @@ LICENSE="GPL-2"
# the last time. # the last time.
SLOT="0/1.8.3" SLOT="0/1.8.3"
KEYWORDS="" KEYWORDS=""
IUSE="conntrack ipv6 netlink nftables pcap static-libs" IUSE="conntrack netlink nftables pcap static-libs"
COMMON_DEPEND=" COMMON_DEPEND="
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 ) conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
netlink? ( net-libs/libnfnetlink ) netlink? ( net-libs/libnfnetlink )
nftables? ( nftables? (
>=net-libs/libmnl-1.0:0= >=net-libs/libmnl-1.0:=
>=net-libs/libnftnl-1.1.5:0= >=net-libs/libnftnl-1.1.6:=
) )
pcap? ( net-libs/libpcap ) pcap? ( net-libs/libpcap )
" "
DEPEND="${COMMON_DEPEND} DEPEND="
${COMMON_DEPEND}
virtual/os-headers virtual/os-headers
>=sys-kernel/linux-headers-4.4:0 >=sys-kernel/linux-headers-4.4:0
" "
@ -39,23 +37,33 @@ BDEPEND="
virtual/yacc virtual/yacc
) )
" "
RDEPEND="${COMMON_DEPEND} RDEPEND="
${COMMON_DEPEND}
nftables? ( net-misc/ethertypes ) nftables? ( net-misc/ethertypes )
!<net-firewall/ebtables-2.0.11-r1
!<net-firewall/arptables-0.0.5-r1
" "
IDEPEND=">=app-eselect/eselect-iptables-20220320"
PATCHES=(
"${FILESDIR}/iptables-1.8.4-no-symlinks.patch"
"${FILESDIR}/iptables-1.8.2-link.patch"
)
src_prepare() { src_prepare() {
# use the saner headers from the kernel # Use the saner headers from the kernel
rm include/linux/{kernel,types}.h || die rm include/linux/{kernel,types}.h || die
eapply_user default
eautoreconf eautoreconf
} }
src_configure() { src_configure() {
# Some libs use $(AR) rather than libtool to build #444282 # Some libs use $(AR) rather than libtool to build, bug #444282
tc-export AR tc-export AR
# Hack around struct mismatches between userland & kernel for some ABIs. #472388 # Hack around struct mismatches between userland & kernel for some ABIs
# bug #472388
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
sed -i \ sed -i \
@ -67,13 +75,14 @@ src_configure() {
--sbindir="${EPREFIX}/sbin" --sbindir="${EPREFIX}/sbin"
--libexecdir="${EPREFIX}/$(get_libdir)" --libexecdir="${EPREFIX}/$(get_libdir)"
--enable-devel --enable-devel
--enable-ipv6
--enable-shared --enable-shared
$(use_enable nftables) $(use_enable nftables)
$(use_enable pcap bpf-compiler) $(use_enable pcap bpf-compiler)
$(use_enable pcap nfsynproxy) $(use_enable pcap nfsynproxy)
$(use_enable static-libs static) $(use_enable static-libs static)
$(use_enable ipv6)
) )
econf "${myeconfargs[@]}" econf "${myeconfargs[@]}"
} }
@ -83,9 +92,10 @@ src_compile() {
src_install() { src_install() {
default default
dodoc INCOMPATIBILITIES iptables/iptables.xslt dodoc INCOMPATIBILITIES iptables/iptables.xslt
# all the iptables binaries are in /sbin, so might as well # All the iptables binaries are in /sbin, so might as well
# put these small files in with them # put these small files in with them
into / into /
dosbin iptables/iptables-apply dosbin iptables/iptables-apply
@ -93,37 +103,74 @@ src_install() {
doman iptables/iptables-apply.8 doman iptables/iptables-apply.8
insinto /usr/include insinto /usr/include
doins include/iptables.h $(use ipv6 && echo include/ip6tables.h) doins include/ip{,6}tables.h
insinto /usr/include/iptables insinto /usr/include/iptables
doins include/iptables/internal.h doins include/iptables/internal.h
keepdir /var/lib/iptables keepdir /var/lib/ip{,6}tables
newinitd "${FILESDIR}"/${PN}-r2.init iptables newinitd "${FILESDIR}"/${PN}-r3.init iptables
newconfd "${FILESDIR}"/${PN}-r1.confd iptables newconfd "${FILESDIR}"/${PN}-r1.confd iptables
if use ipv6 ; then dosym iptables /etc/init.d/ip6tables
keepdir /var/lib/ip6tables newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
dosym iptables /etc/init.d/ip6tables
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
fi
if use nftables; then if use nftables; then
# Bug 647458 # Bug #647458
rm "${ED}"/etc/ethertypes || die rm "${ED}"/etc/ethertypes || die
# Bug 660886 # Bugs #660886 and #669894
rm "${ED}"/sbin/{arptables,ebtables} || die rm "${ED}"/sbin/{arptables,ebtables}{,-{save,restore}} || die
# Bug 669894
rm "${ED}"/sbin/ebtables-{save,restore} || die
fi fi
systemd_dounit "${FILESDIR}"/systemd/iptables-{re,}store.service systemd_dounit "${FILESDIR}"/systemd/ip{,6}tables-{re,}store.service
if use ipv6 ; then
systemd_dounit "${FILESDIR}"/systemd/ip6tables-{re,}store.service
fi
# Move important libs to /lib #332175 # Move important libs to /lib, bug #332175
gen_usr_ldscript -a ip{4,6}tc xtables gen_usr_ldscript -a ip{4,6}tc xtables
find "${ED}" -type f -name "*.la" -delete || die find "${ED}" -type f -name "*.la" -delete || die
} }
pkg_postinst() {
local default_iptables="xtables-legacy-multi"
if ! eselect iptables show &>/dev/null; then
elog "Current iptables implementation is unset, setting to ${default_iptables}"
eselect iptables set "${default_iptables}"
fi
if use nftables; then
local tables
for tables in {arp,eb}tables; do
if ! eselect ${tables} show &>/dev/null; then
elog "Current ${tables} implementation is unset, setting to ${default_iptables}"
eselect ${tables} set xtables-nft-multi
fi
done
fi
eselect iptables show
}
pkg_prerm() {
if [[ -z ${REPLACED_BY_VERSION} ]]; then
elog "Unsetting iptables symlinks before removal"
eselect iptables unset
fi
if ! has_version 'net-firewall/ebtables'; then
elog "Unsetting ebtables symlinks before removal"
eselect ebtables unset
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
elog "Resetting ebtables symlinks to ebtables-legacy"
eselect ebtables set ebtables-legacy
fi
if ! has_version 'net-firewall/arptables'; then
elog "Unsetting arptables symlinks before removal"
eselect arptables unset
elif [[ -z ${REPLACED_BY_VERSION} ]]; then
elog "Resetting arptables symlinks to arptables-legacy"
eselect arptables set arptables-legacy
fi
# The eselect module failing should not be fatal
return 0
}