net-firewall/iptables: fix from upstream for static builds #558234

Silence constant connlabel.conf warnings when using static libs.

diff --git a/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch b/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch
new file mode 100644 (file)
index 0000000..a4183d6
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch
@@ -0,0 +1,77 @@
+https://bugs.gentoo.org/558234
+http://git.netfilter.org/iptables/commit/?id=825fbda5482a7d5ec5a6619c81fe07ff865c7d6e
+
+From 825fbda5482a7d5ec5a6619c81fe07ff865c7d6e Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 5 Sep 2014 20:45:56 +0200
+Subject: [PATCH] extensions: libxt_connlabel: do not open config file from
+ _init hook
+
+else, static builds will print this for every iptables invocation,
+even 'iptables -L'.  Delay open until we need to translate a mapping.
+
+Reported-by: Thomas De Schampheleire <patrickdepinguin@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+---
+ extensions/libxt_connlabel.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
+index c84a167..1f83095 100644
+--- a/extensions/libxt_connlabel.c
++++ b/extensions/libxt_connlabel.c
+@@ -29,11 +29,26 @@ static const struct xt_option_entry connlabel_mt_opts[] = {
+       XTOPT_TABLEEND,
+ };
+ 
++/* cannot do this via _init, else static builds might spew error message
++ * for every iptables invocation.
++ */
++static void connlabel_open(void)
++{
++      if (map)
++              return;
++
++      map = nfct_labelmap_new(NULL);
++      if (!map && errno)
++              xtables_error(RESOURCE_PROBLEM, "cannot open connlabel.conf: %s\n",
++                      strerror(errno));
++}
++
+ static void connlabel_mt_parse(struct xt_option_call *cb)
+ {
+       struct xt_connlabel_mtinfo *info = cb->data;
+       int tmp;
+ 
++      connlabel_open();
+       xtables_option_parse(cb);
+ 
+       switch (cb->entry->id) {
+@@ -54,7 +69,11 @@ static void connlabel_mt_parse(struct xt_option_call *cb)
+ 
+ static const char *connlabel_get_name(int b)
+ {
+-      const char *name = nfct_labelmap_get_name(map, b);
++      const char *name;
++
++      connlabel_open();
++
++      name = nfct_labelmap_get_name(map, b);
+       if (name && strcmp(name, ""))
+               return name;
+       return NULL;
+@@ -114,11 +133,5 @@ static struct xtables_match connlabel_mt_reg = {
+ 
+ void _init(void)
+ {
+-      map = nfct_labelmap_new(NULL);
+-      if (!map) {
+-              fprintf(stderr, "cannot open connlabel.conf, not registering '%s' match: %s\n",
+-                      connlabel_mt_reg.name, strerror(errno));
+-              return;
+-      }
+       xtables_register_match(&connlabel_mt_reg);
+ }
+-- 
+2.4.4
+

diff --git a/net-firewall/iptables/iptables-1.4.21-r3.ebuild b/net-firewall/iptables/iptables-1.4.21-r3.ebuild
new file mode 100644 (file)
index 0000000..ef4eb78
--- /dev/null
+++ b/net-firewall/iptables/iptables-1.4.21-r3.ebuild
@@ -0,0 +1,104 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="5"
+
+# Force users doing their own patches to install their own tools
+AUTOTOOLS_AUTO_DEPEND=no
+
+inherit eutils multilib systemd toolchain-funcs autotools flag-o-matic
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="http://www.netfilter.org/projects/iptables/"
+SRC_URI="http://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+# Subslot tracks libxtables as that's the one other packages generally link
+# against and iptables changes.  Will have to revisit if other sonames change.
+SLOT="0/10"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="conntrack ipv6 netlink pcap static-libs"
+
+RDEPEND="
+       conntrack? ( net-libs/libnetfilter_conntrack )
+       netlink? ( net-libs/libnfnetlink )
+       pcap? ( net-libs/libpcap )
+"
+DEPEND="${RDEPEND}
+       virtual/os-headers
+       virtual/pkgconfig
+"
+
+src_prepare() {
+       # use the saner headers from the kernel
+       rm -f include/linux/{kernel,types}.h
+
+       epatch "${FILESDIR}"/${P}-configure.patch #557586
+       epatch "${FILESDIR}"/${P}-static-connlabel-config.patch #558234
+
+       # Only run autotools if user patched something
+       epatch_user && eautoreconf || elibtoolize
+}
+
+src_configure() {
+       # Some libs use $(AR) rather than libtool to build #444282
+       tc-export AR
+
+       # Hack around struct mismatches between userland & kernel for some ABIs. #472388
+       use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
+
+       sed -i \
+               -e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
+               -e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
+               configure || die
+
+       econf \
+               --sbindir="${EPREFIX}/sbin" \
+               --libexecdir="${EPREFIX}/$(get_libdir)" \
+               --enable-devel \
+               --enable-shared \
+               $(use_enable pcap bpf-compiler) \
+               $(use_enable static-libs static) \
+               $(use_enable ipv6)
+}
+
+src_compile() {
+       emake V=1
+}
+
+src_install() {
+       default
+       dodoc INCOMPATIBILITIES iptables/iptables.xslt
+
+       # all the iptables binaries are in /sbin, so might as well
+       # put these small files in with them
+       into /
+       dosbin iptables/iptables-apply
+       dosym iptables-apply /sbin/ip6tables-apply
+       doman iptables/iptables-apply.8
+
+       insinto /usr/include
+       doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
+       insinto /usr/include/iptables
+       doins include/iptables/internal.h
+
+       keepdir /var/lib/iptables
+       newinitd "${FILESDIR}"/${PN}.init iptables
+       newconfd "${FILESDIR}"/${PN}-1.4.13.confd iptables
+       if use ipv6 ; then
+               keepdir /var/lib/ip6tables
+               newinitd "${FILESDIR}"/iptables.init ip6tables
+               newconfd "${FILESDIR}"/ip6tables-1.4.13.confd ip6tables
+       fi
+
+       systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
+       if use ipv6 ; then
+               systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
+       fi
+
+       # Move important libs to /lib #332175
+       gen_usr_ldscript -a ip{4,6}tc iptc xtables
+
+       prune_libtool_files
+}