commit: cdc003118830087bbb409761fe4e0e2c19ea103a
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 20 15:36:22 2018 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Nov 20 15:36:38 2018 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cdc00311
net-firewall/iptables: multiple fixes for runscript
- We are now passing iptables "--wait" option to every iptables
command which needs to aquire a lock. [Bug 501710]
- In addition, "--wait" (IPTABLES_LOCK_WAIT_TIME) and "--wait-interval"
(IPTABLES_LOCK_WAIT_INTERVAL) is now configurable via
/etc/conf.d/{iptables,ip6tables}.
- We are now only installing one runscript and now using a symlink
for the ip6tables runscript.
- Error detection improved/added.
Closes: https://bugs.gentoo.org/501710
Package-Manager: Portage-2.3.52, Repoman-2.3.12
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
net-firewall/iptables/files/ip6tables-r1.confd | 27 +++++
net-firewall/iptables/files/iptables-r1.confd | 27 +++++
net-firewall/iptables/files/iptables-r1.init | 159 +++++++++++++++++++++++++
net-firewall/iptables/iptables-1.8.2-r1.ebuild | 129 ++++++++++++++++++++
4 files changed, 342 insertions(+)
diff --git a/net-firewall/iptables/files/ip6tables-r1.confd
b/net-firewall/iptables/files/ip6tables-r1.confd
new file mode 100644
index 00000000000..e608f41d1ea
--- /dev/null
+++ b/net-firewall/iptables/files/ip6tables-r1.confd
@@ -0,0 +1,27 @@
+# /etc/conf.d/ip6tables
+
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which ip6tables initscript will save set rules on
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to ip6tables-save and ip6tables-restore
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping ip6tables
+SAVE_ON_STOP="yes"
+
+# If you need to log ip6tables messages as soon as ip6tables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"
diff --git a/net-firewall/iptables/files/iptables-r1.confd
b/net-firewall/iptables/files/iptables-r1.confd
new file mode 100644
index 00000000000..d5055e0a5d2
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-r1.confd
@@ -0,0 +1,27 @@
+# /etc/conf.d/iptables
+
+# Set wait option for xtables lock in seconds
+# DEFAULT: 60
+#IPTABLES_LOCK_WAIT_TIME="60"
+
+# Set wait interval option for xtables lock in microseconds
+# DEFAULT: 1000
+#IPTABLES_LOCK_WAIT_INTERVAL="1000"
+
+# Location in which iptables initscript will save set rules on
+# service shutdown
+IPTABLES_SAVE="/var/lib/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# If you need to log iptables messages as soon as iptables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"
diff --git a/net-firewall/iptables/files/iptables-r1.init
b/net-firewall/iptables/files/iptables-r1.init
new file mode 100755
index 00000000000..708dcce6d3c
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-r1.init
@@ -0,0 +1,159 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="check save panic"
+extra_started_commands="reload"
+
+iptables_lock_wait_time=${IPTABLES_LOCK_WAIT_TIME:-"60"}
+iptables_lock_wait_interval=${IPTABLES_LOCK_WAIT_INTERVAL:-"1000"}
+
+iptables_name=${SVCNAME}
+case ${iptables_name} in
+ iptables|ip6tables) ;;
+ *) iptables_name="iptables" ;;
+esac
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+ iptables) iptables_proc="/proc/net/ip_tables_names"
+ iptables_save=${IPTABLES_SAVE};;
+ ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+ iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+ need localmount #434774
+ before net
+}
+
+set_table_policy() {
+ local has_errors=0 chains table=$1 policy=$2
+ case ${table} in
+ nat) chains="PREROUTING POSTROUTING OUTPUT";;
+ mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+ filter) chains="INPUT FORWARD OUTPUT";;
+ *) chains="";;
+ esac
+
+ local chain
+ for chain in ${chains} ; do
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -t ${table} -P ${chain} ${policy}
+ [ $? -ne 0 ] && has_errors=1
+ done
+
+ return ${has_errors}
+}
+
+checkkernel() {
+ if [ ! -e ${iptables_proc} ] ; then
+ eerror "Your kernel lacks ${iptables_name} support, please load"
+ eerror "appropriate modules and try again."
+ return 1
+ fi
+ return 0
+}
+
+checkconfig() {
+ if [ -z "${iptables_save}" -o ! -f "${iptables_save}" ] ; then
+ eerror "Not starting ${iptables_name}. First create some rules
then run:"
+ eerror "/etc/init.d/${iptables_name} save"
+ return 1
+ fi
+ return 0
+}
+
+start_pre() {
+ checkkernel || return 1
+ checkconfig || return 1
+}
+
+start() {
+ ebegin "Loading ${iptables_name} state and starting firewall"
+ ${iptables_bin}-restore --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} ${SAVE_RESTORE_OPTIONS} <
"${iptables_save}"
+ eend $?
+}
+
+stop_pre() {
+ checkkernel || return 1
+}
+
+stop() {
+ if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+ save || return 1
+ fi
+
+ ebegin "Stopping firewall"
+ local has_errors=0 a
+ for a in $(cat ${iptables_proc}) ; do
+ set_table_policy $a ACCEPT
+ [ $? -ne 0 ] && has_errors=1
+
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -F -t $a
+ [ $? -ne 0 ] && has_errors=1
+
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -X -t $a
+ [ $? -ne 0 ] && has_errors=1
+ done
+ eend ${has_errors}
+}
+
+reload() {
+ checkkernel || return 1
+ checkrules || return 1
+ ebegin "Flushing firewall"
+ local has_errors=0 a
+ for a in $(cat ${iptables_proc}) ; do
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -F -t $a
+ [ $? -ne 0 ] && has_errors=1
+
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -X -t $a
+ [ $? -ne 0 ] && has_errors=1
+ done
+ eend ${has_errors}
+
+ start
+}
+
+checkrules() {
+ ebegin "Checking rules"
+ ${iptables_bin}-restore --test ${SAVE_RESTORE_OPTIONS} <
"${iptables_save}"
+ eend $?
+}
+
+check() {
+ # Short name for users of init.d script.
+ checkrules
+}
+
+save() {
+ ebegin "Saving ${iptables_name} state"
+ checkpath -q -d "$(dirname "${iptables_save}")"
+ checkpath -q -m 0600 -f "${iptables_save}"
+ ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+ eend $?
+}
+
+panic() {
+ checkkernel || return 1
+ if service_started ${iptables_name}; then
+ rc-service ${iptables_name} stop
+ fi
+
+ local has_errors=0 a
+ ebegin "Dropping all packets"
+ for a in $(cat ${iptables_proc}) ; do
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -F -t $a
+ [ $? -ne 0 ] && has_errors=1
+
+ ${iptables_bin} --wait ${iptables_lock_wait_time}
--wait-interval ${iptables_lock_wait_interval} -X -t $a
+ [ $? -ne 0 ] && has_errors=1
+
+ if [ "${a}" != "nat" ]; then
+ # The "nat" table is not intended for filtering, the
use of DROP is therefore inhibited.
+ set_table_policy $a DROP
+ [ $? -ne 0 ] && has_errors=1
+ fi
+ done
+ eend ${has_errors}
+}
diff --git a/net-firewall/iptables/iptables-1.8.2-r1.ebuild
b/net-firewall/iptables/iptables-1.8.2-r1.ebuild
new file mode 100644
index 00000000000..9279db2ecc5
--- /dev/null
+++ b/net-firewall/iptables/iptables-1.8.2-r1.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+# Force users doing their own patches to install their own tools
+AUTOTOOLS_AUTO_DEPEND=no
+
+inherit multilib systemd toolchain-funcs autotools flag-o-matic
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://www.netfilter.org/projects/iptables/";
+SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2";
+
+LICENSE="GPL-2"
+# Subslot tracks libxtables as that's the one other packages generally link
+# against and iptables changes. Will have to revisit if other sonames change.
+SLOT="0/12"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390
~sh ~sparc ~x86"
+IUSE="conntrack ipv6 netlink nftables pcap static-libs"
+
+COMMON_DEPEND="
+ conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
+ netlink? ( net-libs/libnfnetlink )
+ nftables? (
+ >=net-libs/libmnl-1.0:0=
+ >=net-libs/libnftnl-1.1.1:0=
+ )
+ pcap? ( net-libs/libpcap )
+"
+DEPEND="${COMMON_DEPEND}
+ virtual/os-headers
+ >=sys-kernel/linux-headers-4.4:0
+ virtual/pkgconfig
+ nftables? (
+ sys-devel/flex
+ virtual/yacc
+ )
+"
+RDEPEND="${COMMON_DEPEND}
+ nftables? ( net-misc/ethertypes )
+"
+
+src_prepare() {
+ # use the saner headers from the kernel
+ rm -f include/linux/{kernel,types}.h
+
+ # Only run autotools if user patched something
+ eapply_user && eautoreconf || elibtoolize
+}
+
+src_configure() {
+ # Some libs use $(AR) rather than libtool to build #444282
+ tc-export AR
+
+ # Hack around struct mismatches between userland & kernel for some
ABIs. #472388
+ use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
+
+ sed -i \
+ -e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
+ -e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
+ configure || die
+
+ local myeconfargs=(
+ --sbindir="${EPREFIX}/sbin"
+ --libexecdir="${EPREFIX}/$(get_libdir)"
+ --enable-devel
+ --enable-shared
+ $(use_enable nftables)
+ $(use_enable pcap bpf-compiler)
+ $(use_enable pcap nfsynproxy)
+ $(use_enable static-libs static)
+ $(use_enable ipv6)
+ )
+ econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+ # Deal with parallel build errors.
+ use nftables && emake -C iptables xtables-config-parser.h
+ emake V=1
+}
+
+src_install() {
+ default
+ dodoc INCOMPATIBILITIES iptables/iptables.xslt
+
+ # all the iptables binaries are in /sbin, so might as well
+ # put these small files in with them
+ into /
+ dosbin iptables/iptables-apply
+ dosym iptables-apply /sbin/ip6tables-apply
+ doman iptables/iptables-apply.8
+
+ insinto /usr/include
+ doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
+ insinto /usr/include/iptables
+ doins include/iptables/internal.h
+
+ keepdir /var/lib/iptables
+ newinitd "${FILESDIR}"/${PN}-r1.init iptables
+ newconfd "${FILESDIR}"/${PN}-r1.confd iptables
+ if use ipv6 ; then
+ keepdir /var/lib/ip6tables
+ dosym iptables /etc/init.d/ip6tables
+ newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
+ fi
+
+ if use nftables; then
+ # Bug 647458
+ rm "${ED%/}"/etc/ethertypes || die
+
+ # Bug 660886
+ rm "${ED%/}"/sbin/{arptables,ebtables} || die
+
+ # Bug 669894
+ rm "${ED%/}"/sbin/ebtables-{save,restore} || die
+ fi
+
+ systemd_dounit "${FILESDIR}"/systemd/iptables-{re,}store.service
+ if use ipv6 ; then
+ systemd_dounit
"${FILESDIR}"/systemd/ip6tables-{re,}store.service
+ fi
+
+ # Move important libs to /lib #332175
+ gen_usr_ldscript -a ip{4,6}tc iptc xtables
+
+ find "${ED}" -name "*.la" -delete || die
+}
