commit: 99fd0daff983a698344750d34a281e629e050f8f Author: Brahmajit Das <listout <AT> listout <DOT> xyz> AuthorDate: Mon Dec 1 11:51:37 2025 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Thu Dec 4 12:00:15 2025 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=99fd0daf
net-firewall/firewalld: add 2.4.0 Signed-off-by: Brahmajit Das <listout <AT> listout.xyz> Part-of: https://github.com/gentoo/gentoo/pull/44849 Signed-off-by: Sam James <sam <AT> gentoo.org> net-firewall/firewalld/Manifest | 1 + .../files/firewalld-2.4.0-systemd-service.patch | 18 ++ net-firewall/firewalld/firewalld-2.4.0.ebuild | 227 +++++++++++++++++++++ 3 files changed, 246 insertions(+) diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest index e4dd282f9e4b..7410e7235c26 100644 --- a/net-firewall/firewalld/Manifest +++ b/net-firewall/firewalld/Manifest @@ -1,2 +1,3 @@ DIST firewalld-2.3.0.tar.bz2 1307839 BLAKE2B f986af940841d7982c44ef5d7df9758f8b8f0e2bd511c61dc358d21e2d272ddc510571bcbdd6c7e47d0bd1ee6250240445094b30945c8de695007c1eb24ed642 SHA512 9a0fe1098c8bbb63bc4af04f56b7810d3d4e94be4247574daba64fb7a344488053f80426b7422c3a4620a54fee69a4264e1b0d66580757aac29aa65d723007c5 DIST firewalld-2.3.1.tar.bz2 1309031 BLAKE2B 08893b400ec8ed5bc5148f8480fdadc6cd5019563fbac778257048a721fe34ef40e911b836a60492b51080da1d9ca5c83cdd0eb2a617e376008c6af46fe09156 SHA512 cf9e41c5a04705a70159e91f301a14526c2a9915dccd053e439ef10c7cbcec8b56f5adc250361041b9fd7d94fe5d314f32be0d1d816ebf520242c09513dc3e42 +DIST firewalld-2.4.0.tar.bz2 1342244 BLAKE2B 8e878eefe9b458e2c9b742b55268839e746cfa5c8f4460df17fff74c4f6b03bad64981ec530565d6746fca05a797dcd82f3af99a3cb64dfbe98be6f7d6c38f41 SHA512 24071b2f0a2d5acf41430e41238480d78b1f758bceb493b44dba89dbc02a73f6adfc47359d108d502c41ac2b1ac8302bbda426d7f89095b44240c98739f58ae8 diff --git a/net-firewall/firewalld/files/firewalld-2.4.0-systemd-service.patch b/net-firewall/firewalld/files/firewalld-2.4.0-systemd-service.patch new file mode 100644 index 000000000000..3390b78d1d5c --- /dev/null +++ b/net-firewall/firewalld/files/firewalld-2.4.0-systemd-service.patch @@ -0,0 +1,18 @@ +Drops the/an obsolete 'conflicts' line with old iptables services bug #833506 +Removes EnvironmentFile and FIREWALLD_ARGS variable +--- a/config/firewalld.service.in ++++ b/config/firewalld.service.in +@@ -5,12 +5,10 @@ Wants=network-pre.target + Requires=dbus.service + After=dbus.service + After=polkit.service +-Conflicts=iptables.service ip6tables.service ebtables.service ipset.service + Documentation=man:firewalld(1) + + [Service] +-EnvironmentFile=-/etc/sysconfig/firewalld +-ExecStart=@sbindir@/firewalld --nofork --nopid $FIREWALLD_ARGS ++ExecStart=@sbindir@/firewalld --nofork --nopid + ExecReload=/bin/kill -HUP $MAINPID + StandardOutput=null + StandardError=null diff --git a/net-firewall/firewalld/firewalld-2.4.0.ebuild b/net-firewall/firewalld/firewalld-2.4.0.ebuild new file mode 100644 index 000000000000..250bc69391c1 --- /dev/null +++ b/net-firewall/firewalld/firewalld-2.4.0.ebuild @@ -0,0 +1,227 @@ +# Copyright 1999-2025 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{11..13} ) +inherit bash-completion-r1 gnome2-utils linux-info optfeature +inherit plocale python-single-r1 systemd xdg-utils + +DESCRIPTION="Firewall daemon with D-Bus interface providing a dynamic firewall" +HOMEPAGE="https://firewalld.org/"; +SRC_URI="https://github.com/firewalld/firewalld/releases/download/v${PV}/${P}.tar.bz2"; + +LICENSE="GPL-2+" +SLOT="0" +KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86" +IUSE="gui selinux test" +# Tests are too unreliable in sandbox environment +RESTRICT="!test? ( test ) test" +REQUIRED_USE="${PYTHON_REQUIRED_USE}" + +RDEPEND=" + ${PYTHON_DEPS} + || ( >=sys-apps/openrc-0.11.5 sys-apps/systemd ) + $(python_gen_cond_dep ' + dev-python/dbus-python[${PYTHON_USEDEP}] + dev-python/pygobject:3[${PYTHON_USEDEP}] + >=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}] + gui? ( + dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}] + x11-libs/gtk+:3 + x11-libs/libnotify[introspection] + ) + ') + net-firewall/ipset + net-firewall/nftables[xtables(+)] + selinux? ( sec-policy/selinux-firewalld ) +" +DEPEND=" + ${RDEPEND} + dev-libs/glib:2 +" +BDEPEND=" + app-text/docbook-xml-dtd + >=dev-util/intltool-0.35 + sys-devel/gettext +" + +# Testsuite's Makefile.am calls missing(!) +# ... but this seems to be consistent with the autoconf docs? +# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html +QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*" + +PLOCALES="ar as ast bg bn_IN ca cs da de el en_GB en_US es et eu fa fi fr gl gu hi hr hu ia id it ja ka kn ko lt ml mr nl or pa pl pt pt_BR ro ru si sk sl sq sr sr@latin sv ta te tr uk zh_CN zh_TW" + +PATCHES=( + "${FILESDIR}"/${PN}-2.4.0-systemd-service.patch +) + +pkg_setup() { + # See bug #830132 for the huge list + # We can probably narrow it down a bit but it's rather fragile + local CONFIG_CHECK=" + ~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK + ~NETFILTER + ~NETFILTER_ADVANCED + ~NETFILTER_INGRESS + ~NF_NAT_MASQUERADE + ~NF_NAT_REDIRECT + ~NF_TABLES_INET + ~NF_TABLES_IPV4 + ~NF_TABLES_IPV6 + ~NF_CONNTRACK + ~NF_CONNTRACK_BROADCAST + ~NF_CONNTRACK_NETBIOS_NS + ~NF_CONNTRACK_TFTP + ~NF_CT_NETLINK + ~NF_CT_NETLINK_HELPER + ~NF_DEFRAG_IPV4 + ~NF_DEFRAG_IPV6 + ~NF_NAT + ~NF_NAT_TFTP + ~NF_REJECT_IPV4 + ~NF_REJECT_IPV6 + ~NF_SOCKET_IPV4 + ~NF_SOCKET_IPV6 + ~NF_TABLES + ~NF_TPROXY_IPV4 + ~NF_TPROXY_IPV6 + ~IP_NF_FILTER + ~IP_NF_IPTABLES + ~IP_NF_MANGLE + ~IP_NF_NAT + ~IP_NF_RAW + ~IP_NF_SECURITY + ~IP_NF_TARGET_MASQUERADE + ~IP_NF_TARGET_REJECT + ~IP6_NF_FILTER + ~IP6_NF_IPTABLES + ~IP6_NF_MANGLE + ~IP6_NF_NAT + ~IP6_NF_RAW + ~IP6_NF_SECURITY + ~IP6_NF_TARGET_MASQUERADE + ~IP6_NF_TARGET_REJECT + ~IP_SET + ~NETFILTER_CONNCOUNT + ~NETFILTER_NETLINK + ~NETFILTER_NETLINK_OSF + ~NETFILTER_NETLINK_QUEUE + ~NETFILTER_SYNPROXY + ~NETFILTER_XTABLES + ~NETFILTER_XT_CONNMARK + ~NETFILTER_XT_MATCH_CONNTRACK + ~NETFILTER_XT_MATCH_MULTIPORT + ~NETFILTER_XT_MATCH_STATE + ~NETFILTER_XT_NAT + ~NETFILTER_XT_TARGET_MASQUERADE + ~NFT_COMPAT + ~NFT_CT + ~NFT_FIB + ~NFT_FIB_INET + ~NFT_FIB_IPV4 + ~NFT_FIB_IPV6 + ~NFT_HASH + ~NFT_LIMIT + ~NFT_LOG + ~NFT_MASQ + ~NFT_NAT + ~NFT_QUEUE + ~NFT_QUOTA + ~NFT_REDIR + ~NFT_REJECT + ~NFT_REJECT_INET + ~NFT_REJECT_IPV4 + ~NFT_REJECT_IPV6 + ~NFT_SOCKET + ~NFT_SYNPROXY + ~NFT_TPROXY + ~NFT_TUNNEL + ~NFT_XFRM + " + + # kernel >= 4.19 has a unified NF_CONNTRACK module, bug #692944 + if kernel_is -lt 4 19; then + CONFIG_CHECK+=" ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6" + fi + + # bug #831259 + if kernel_is -le 5 4 ; then + CONFIG_CHECK+=" ~NF_TABLES_SET" + fi + + # bug #853055 + if kernel_is -lt 5 18 ; then + CONFIG_CHECK+=" ~NFT_COUNTER" + fi + + # bug #926685 + if kernel_is -le 6 1 ; then + CONFIG_CHECK+=" ~NFT_OBJREF" + fi + + linux-info_pkg_setup +} + +src_prepare() { + default + + # Skip XML schema verification for tests + cat <<-EOF > config/xmlschema/check.sh || die + #!/bin/sh + exit 0 + EOF + chmod +x config/xmlschema/check.sh || die + + plocale_find_changes "po" "" ".po" || die + plocale_get_locales | sed -e 's/ /\n/g' > po/LINGUAS +} + +src_configure() { + python_setup + + local myeconfargs=( + --enable-systemd + --with-systemd-unitdir="$(systemd_get_systemunitdir)" + --with-bashcompletiondir="$(get_bashcompdir)" + ) + + econf "${myeconfargs[@]}" +} + +src_install() { + default + python_optimize + + # Get rid of junk + rm -rf "${ED}"/etc/sysconfig/ || die + + # For non-gui installs we need to remove GUI bits + if ! use gui; then + rm -rf "${ED}"/etc/xdg/autostart || die + rm -f "${ED}"/usr/bin/firewall-applet || die + rm -f "${ED}"/usr/bin/firewall-config || die + rm -rf "${ED}"/usr/share/applications || die + rm -rf "${ED}"/usr/share/icons || die + fi + + newinitd "${FILESDIR}"/firewalld.init firewalld +} + +pkg_preinst() { + gnome2_schemas_savelist +} + +pkg_postinst() { + xdg_icon_cache_update + gnome2_schemas_update + + # bug #833569 + optfeature "changing zones with NetworkManager" gnome-extra/nm-applet +} + +pkg_postrm() { + xdg_icon_cache_update + gnome2_schemas_update +}
