-DIST nftables-0.5.tar.gz 216740 SHA256 b48991f4e9e73b689bc254fa06b3ff3c1f937241d333291cb2ae72c0cd2398b6 SHA512 5d804ac9bb340446e52e5b0e86b726216ecc0d1eb42738cf133ba1acc5b442f720f5644005e02b9e3e8fae4e2bdc64d32560d6c6b1b26fe15bde24d62db51679 WHIRLPOOL 348d511c7ee530e6fb04b9828babad45407e4b60c443aaa8902aa9535705ff54cb78cd5e5c8ba970b57b97406b00718e94ab8a346fceaa82803bdaad84d30285
DIST nftables-0.6.tar.gz 252523 SHA256 85dd7fa4e741c0be02efddbc57b5d300e1147f09ec6f81d0399110f96dc958f0 SHA512 17f3b94687865e077dc082cf61b29ab2854fd1ffe18212a8d424f2876aef8db9780dd4d06dca8e6d093498151d47bab73e40e1f54062a83a23a3cbe75f27e921 WHIRLPOOL d15eaf81426d73bea28752f96727d291120120fb2aaa994d421d900974eb45062957435e077664fb916780f636ed9b61889dbec8b627d5d309512bae96f02874
+++ /dev/null
-#!/sbin/openrc-run
-# Copyright 2014 Nicholas Vinson
-# Copyright 1999-2014 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-extra_commands="clear list panic save"
-extra_started_commands="reload"
-
-depend() {
- need localmount #434774
- before net
-}
-
-checkkernel() {
- if ! nft list tables >/dev/null 2>&1; then
- eerror "Your kernel lacks nftables support, please load"
- eerror "appropriate modules and try again."
- return 1
- fi
- return 0
-}
-
-checkconfig() {
- if [ ! -f ${NFTABLES_SAVE} ]; then
- eerror "Not starting nftables. First create some rules then run:"
- eerror "rc-service nftables save"
- return 1
- fi
- return 0
-}
-
-getfamilies() {
- local families
- for l3f in ip arp ip6 bridge inet; do
- if nft list tables ${l3f} > /dev/null 2>&1; then
- families="${families}${l3f} "
- fi
- done
- echo ${families}
-}
-
-clearNFT() {
- local l3f line table chain
-
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- table=$(echo ${line} | sed "s/table[ \t]*//")
- nft flush table ${l3f} ${table}
- nft list table ${l3f} ${table} | while read l; do
- chain=$(echo $l | grep -o 'chain [^[:space:]]\+' |\
- cut -d ' ' -f2)
- if [ -n "${chain}" ]; then
- nft flush chain ${l3f} ${table} ${chain}
- nft delete chain ${l3f} ${table} ${chain}
- fi
- done
- nft delete table ${l3f} ${table}
- done
- done
-}
-
-addpanictable() {
- local l3f=$1
- nft add table ${l3f} panic
- nft add chain ${l3f} panic input \{ type filter hook input priority 0\; \}
- nft add chain ${l3f} panic output \{ type filter hook output priority 0\; \}
- nft add chain ${l3f} panic forward \{ type filter hook forward priority 0\; \}
- nft add rule ${l3f} panic input drop
- nft add rule ${l3f} panic output drop
- nft add rule ${l3f} panic forward drop
-}
-
-start_pre() {
- checkkernel || return 1
- checkconfig || return 1
- return 0
-}
-
-start() {
- ebegin "Loading nftables state and starting firewall"
- clearNFT
- nft -f ${NFTABLES_SAVE}
- eend $?
-}
-
-stop() {
- if yesno ${SAVE_ON_STOP:-yes}; then
- save || return 1
- fi
-
- ebegin "Stopping firewall"
- clearNFT
- eend $?
-}
-
-reload() {
- checkkernel || return 1
- # checkrules || return 1
- ebegin "Flushing firewall"
- clearNFT
-
- start
-}
-
-clear() {
- clearNFT
-}
-
-list() {
- local l3f
-
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- line=$(echo ${line} | sed "s/table/table ${l3f}/")
- echo "$(nft list ${line})"
- done
- done
-}
-
-save() {
- ebegin "Saving nftables state"
- checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
- checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
-
- local l3f line tmp_save="${NFTABLES_SAVE}.tmp"
-
- touch "${tmp_save}"
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- line=$(echo ${line} | sed "s/table/table ${l3f}/")
- # The below substitution fixes an issue where nft -n output may not
- # always be parsable by nft -f. For example, nft -n might print
- #
- # ip6 saddr ::1 ip6 daddr ::1 counter packets 0 bytes 0 accept
- #
- # but nft -f refuses to parse that string with error:
- #
- # In file included from internal:0:0-0:
- # /var/lib/nftables/rules-save:1:1-2: Error: Could not process rule:
- # Invalid argument
- # table ip6 filter {
- # ^^
- echo "$(nft ${SAVE_OPTIONS} list ${line} |\
- sed 's/\(::[0-9a-fA-F]\+\)\([^/]\)/\1\/128\2/g')" >> "${tmp_save}"
- done
- done
- mv "${tmp_save}" "${NFTABLES_SAVE}"
-}
-
-panic() {
- checkkernel || return 1
- if service_started ${RC_SVCNAME}; then
- rc-service ${RC_SVCNAME} stop
- fi
-
- ebegin "Dropping all packets"
- clearNFT
-
- local l3f
- for l3f in $(getfamilies); do
- case ${l3f} in
- ip) addpanictable ${l3f} ;;
- ip6) addpanictable ${l3f} ;;
- esac
- done
-}
+++ /dev/null
-#!/sbin/openrc-run
-# Copyright 2014 Nicholas Vinson
-# Copyright 1999-2014 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-extra_commands="clear list panic save"
-extra_started_commands="reload"
-depend() {
- need localmount #434774
- before net
-}
-
-start_pre() {
- checkkernel || return 1
- checkconfig || return 1
- return 0
-}
-
-clear() {
- if use_legacy; then
- clear_legacy
- return 0
- fi
-
- nft flush ruleset
-}
-
-list() {
- if use_legacy; then
- list_legacy
- return 0
- fi
-
- nft list ruleset
-}
-
-panic() {
- checkkernel || return 1
- if service_started ${RC_SVCNAME}; then
- rc-service ${RC_SVCNAME} stop
- fi
-
- ebegin "Dropping all packets"
- clear
- if nft create table ip filter >/dev/null 2>&1; then
- #nft -f /var/lib/nftables/rules-panic.ip
- nft -f /dev/stdin <<-EOF
- table ip filter {
- chain input {
- type filter hook input priority 0;
- drop
- }
- chain forward {
- type filter hook forward priority 0;
- drop
- }
- chain output {
- type filter hook output priority 0;
- drop
- }
- }
- EOF
- fi
- if nft create table ip6 filter >/dev/null 2>&1; then
- #nft -f /var/lib/nftables/rules-panic.ip6
- nft -f /dev/stdin <<-EOF
- table ip6 filter {
- chain input {
- type filter hook input priority 0;
- drop
- }
- chain forward {
- type filter hook forward priority 0;
- drop
- }
- chain output {
- type filter hook output priority 0;
- drop
- }
- }
- EOF
- fi
-}
-
-reload() {
- checkkernel || return 1
- ebegin "Flushing firewall"
- clear
- start
-}
-
-save() {
- ebegin "Saving nftables state"
- checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
- checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
-
- local tmp_save="${NFTABLES_SAVE}.tmp"
-
- if use_legacy; then
- save_legacy ${tmp_save}
- else
- nft list ruleset > ${tmp_save}
- fi
- mv ${tmp_save} ${NFTABLES_SAVE}
-}
-
-start() {
- ebegin "Loading nftables state and starting firewall"
- clear
- nft -f ${NFTABLES_SAVE}
- eend $?
-}
-
-stop() {
- if yesno ${SAVE_ON_STOP:-yes}; then
- save || return 1
- fi
-
- ebegin "Stopping firewall"
- clear
- eend $?
-}
-
-################################################################################
-#
-# SUPPORT FUNCTIONS
-#
-################################################################################
-checkconfig() {
- if [ ! -f ${NFTABLES_SAVE} ]; then
- eerror "Not starting nftables. First create some rules then run:"
- eerror "rc-service nftables save"
- return 1
- fi
- return 0
-}
-
-checkkernel() {
- if ! nft list tables >/dev/null 2>&1; then
- eerror "Your kernel lacks nftables support, please load"
- eerror "appropriate modules and try again."
- return 1
- fi
- return 0
-}
-
-use_legacy() {
- local major_ver minor_ver
-
- major_ver=`uname -r | cut -d '.' -f1`
- minor_ver=`uname -r | cut -d '.' -f2`
-
- [[ $major_ver -ge 4 || $major_ver -eq 3 && $minor_ver -ge 18 ]] && return 1
- return 0
-}
-
-################################################################################
-#
-# LEGACY COMMAND FUNCTIONS
-#
-################################################################################
-
-clear_legacy() {
- local l3f line table chain first_line
-
- first_line=1
- if manualwalk; then
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- table=$(echo ${line} | sed "s/table[ \t]*//")
- deletetable ${l3f} ${table}
- done
- done
- else
- nft list tables | while read line; do
- l3f=$(echo ${line} | cut -d ' ' -f2)
- table=$(echo ${line} | cut -d ' ' -f3)
- deletetable ${l3f} ${table}
- done
- fi
-}
-
-list_legacy() {
- local l3f
-
- if manualwalk; then
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- line=$(echo ${line} | sed "s/table/table ${l3f}/")
- echo "$(nft list ${line})"
- done
- done
- else
- nft list tables | while read line; do
- echo "$(nft list ${line})"
- done
- fi
-}
-
-save_legacy() {
- tmp_save=$1
- touch "${tmp_save}"
- if manualwalk; then
- for l3f in $(getfamilies); do
- nft list tables ${l3f} | while read line; do
- line=$(echo ${line} | sed "s/table/table ${l3f}/")
- nft ${SAVE_OPTIONS} list ${line} >> ${tmp_save}
- done
- done
- else
- nft list tables | while read line; do
- nft ${SAVE_OPTIONS} list ${line} >> "${tmp_save}"
- done
- fi
-}
-
-################################################################################
-#
-# LEGACY SUPPORT FUNCTIONS
-#
-################################################################################
-CHECK_TABLE_NAME="GENTOO_CHECK_TABLE"
-
-getfamilies() {
- local l3f families
-
- for l3f in ip arp ip6 bridge inet; do
- if nft create table ${l3f} ${CHECK_TABLE_NAME} > /dev/null 2>&1; then
- families="${families}${l3f} "
- nft delete table ${l3f} ${CHECK_TABLE_NAME}
- fi
- done
- echo ${families}
-}
-
-manualwalk() {
- local result l3f=`getfamilies | cut -d ' ' -f1`
-
- nft create table ${l3f} ${CHECK_TABLE_NAME}
- nft list tables | read line
- if [ $(echo $line | wc -w) -lt 3 ]; then
- result=0
- fi
- result=1
- nft delete table ${l3f} ${CHECK_TABLE_NAME}
-
- return $result
-}
-
-deletetable() {
- # family is $1
- # table name is $2
- nft flush table $1 $2
- nft list table $1 $2 | while read l; do
- chain=$(echo $l | grep -o 'chain [^[:space:]]\+' | cut -d ' ' -f2)
- if [ -n "${chain}" ]; then
- nft flush chain $1 $2 ${chain}
- nft delete chain $1 $2 ${chain}
- fi
- done
- nft delete table $1 $2
-}
-
+++ /dev/null
-[Unit]
-Description=Restore nftables firewall rules
-# if both are queued for some reason, don't store before restoring :)
-Before=nftables-store.service
-# sounds reasonable to have firewall up before any of the services go up
-Before=network.target
-Conflicts=shutdown.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/nftables/nftables.sh load /var/lib/nftables/rules-save
-
-[Install]
-WantedBy=basic.target
+++ /dev/null
-[Unit]
-Description=Store nftables firewall rules
-Before=shutdown.target
-DefaultDependencies=No
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/nftables/nftables.sh store /var/lib/nftables/rules-save
-
-[Install]
-WantedBy=shutdown.target
+++ /dev/null
-[Unit]
-Description=Store and restore nftables firewall rules
-
-[Install]
-Also=nftables-store.service
-Also=nftables-restore.service
+++ /dev/null
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Id$
-
-EAPI=5
-
-inherit autotools linux-info eutils systemd
-
-DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
-HOMEPAGE="http://netfilter.org/projects/nftables/"
-SRC_URI="http://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~x86"
-IUSE="debug doc gmp +readline"
-
-RDEPEND=">=net-libs/libmnl-1.0.3
- >=net-libs/libnftnl-1.0.5
- gmp? ( dev-libs/gmp:0= )
- readline? ( sys-libs/readline:0= )"
-DEPEND="${RDEPEND}
- >=app-text/docbook2X-0.8.8-r4
- doc? ( >=app-text/dblatex-0.3.7 )
- sys-devel/bison
- sys-devel/flex
- virtual/pkgconfig"
-
-S="${WORKDIR}"/v${PV}
-
-pkg_setup() {
- if kernel_is ge 3 13; then
- CONFIG_CHECK="~NF_TABLES"
- linux-info_pkg_setup
- else
- eerror "This package requires kernel version 3.13 or newer to work properly."
- fi
-}
-
-src_prepare() {
- epatch -p1 "${FILESDIR}/${P}-pdf-doc.patch"
- epatch_user
- eautoreconf
-}
-
-src_configure() {
- econf \
- --sbindir="${EPREFIX}"/sbin \
- $(use_enable debug) \
- $(use_enable doc pdf-doc) \
- $(use_with readline cli) \
- $(use_with !gmp mini_gmp)
-}
-
-src_install() {
- default
-
- dodir /usr/libexec/${PN}
- exeinto /usr/libexec/${PN}
- doexe "${FILESDIR}"/libexec/${PN}.sh
-
- newconfd "${FILESDIR}"/${PN}.confd ${PN}
- newinitd "${FILESDIR}"/${PN}.init-r2 ${PN}
- keepdir /var/lib/nftables
-
- systemd_dounit "${FILESDIR}"/systemd/${PN}{,-{re,}store}.service
-}
projects / gentoo.git / commitdiff