[arch-commits] Commit in nftables/repos (4 files)

[Sébastien Luttringer via arch-commits]

    Date: Monday, January 22, 2018 @ 00:37:30
  Author: seblu
Revision: 315227

archrelease: copy trunk to testing-x86_64

Added:
  nftables/repos/testing-x86_64/
  nftables/repos/testing-x86_64/PKGBUILD
    (from rev 315226, nftables/trunk/PKGBUILD)
  nftables/repos/testing-x86_64/nftables.conf
    (from rev 315226, nftables/trunk/nftables.conf)
  nftables/repos/testing-x86_64/nftables.service
    (from rev 315226, nftables/trunk/nftables.service)

------------------+
 PKGBUILD         |   58 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 nftables.conf    |   38 ++++++++++++++++++++++++++++++++++
 nftables.service |   15 +++++++++++++
 3 files changed, 111 insertions(+)

Copied: nftables/repos/testing-x86_64/PKGBUILD (from rev 315226, 
nftables/trunk/PKGBUILD)
===================================================================
--- testing-x86_64/PKGBUILD                             (rev 0)
+++ testing-x86_64/PKGBUILD     2018-01-22 00:37:30 UTC (rev 315227)
@@ -0,0 +1,58 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <se...@archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.8.1
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+        'nftables.conf'
+        'nftables.service')
+sha1sums=('51fd436845718f1221ee198128656ef9055c2588'
+          'SKIP'
+          '7869aa31ac802922073310ffd4cbbc16450171e5'
+          '59185e947ebfd599954800ad2c774171b3f4cd58')
+
+prepare() {
+  cd $pkgname-$pkgver
+  # apply patch from the source array (should be a pacman feature)
+  local filename
+  for filename in "${source[@]}"; do
+    if [[ "$filename" =~ \.patch$ ]]; then
+      msg2 "Applying patch ${filename##*/}"
+      patch -p1 -N -i "$srcdir/${filename##*/}"
+    fi
+  done
+  :
+}
+
+build() {
+  cd $pkgname-$pkgver
+  ./configure \
+    --prefix=/usr \
+    --sbindir=/usr/bin \
+    --sysconfdir=/usr/share \
+    CONFIG_MAN=y DB2MAN=docbook2man
+  make
+}
+
+package() {
+  pushd $pkgname-$pkgver
+  make DESTDIR="$pkgdir" install
+  popd
+  # basic safe firewall config
+  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+  # systemd
+  install -Dm644 nftables.service 
"$pkgdir/usr/lib/systemd/system/nftables.service"
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/testing-x86_64/nftables.conf (from rev 315226, 
nftables/trunk/nftables.conf)
===================================================================
--- testing-x86_64/nftables.conf                                (rev 0)
+++ testing-x86_64/nftables.conf        2018-01-22 00:37:30 UTC (rev 315227)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0;
+
+    # allow established/related connections
+    ct state {established, related} accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # everything else
+    reject with icmpx type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0;
+    drop
+  }
+  chain output {
+    type filter hook output priority 0;
+  }
+
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/testing-x86_64/nftables.service (from rev 315226, 
nftables/trunk/nftables.service)
===================================================================
--- testing-x86_64/nftables.service                             (rev 0)
+++ testing-x86_64/nftables.service     2018-01-22 00:37:30 UTC (rev 315227)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft flush ruleset ';' include '"/etc/nftables.conf"'
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target