Version bump #98641 by Lars (Polynomial-C). Unified the iptables/ip6tables

  init.d scripts.  Added a new panic option to init.d #72033 by Colin
  Kingsley.
(Portage version: 2.0.51.22-r1)

6 files changed, 302 insertions, 10 deletions

diff --git a/net-firewall/iptables/ChangeLog b/net-firewall/iptables/ChangeLog
index 77b98f46976f..5fd73178f6ed 100644
--- a/net-firewall/iptables/ChangeLog
+++ b/net-firewall/iptables/ChangeLog
@@ -1,17 +1,15 @@
 # ChangeLog for net-firewall/iptables
 # Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.73 2005/05/30 17:21:42 ferdy Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.74 2005/07/12 02:38:29 vapier Exp $
 
-  30 May 2005; Fernando J. Pereda <ferdy@gentoo.org>
-  iptables-1.3.1-r4.ebuild:
-  marked ~alpha wrt bug #91285
+*iptables-1.3.2 (12 Jul 2005)
 
-  15 May 2005; Rene Nussbaumer <killerfox@gentoo.org>
-  iptables-1.3.1-r4.ebuild:
-  added ~hppa
-
-  09 May 2005; Aron Griffis <agriffis@gentoo.org> iptables-1.3.1-r4.ebuild:
-  add ~ia64 #91285
+  12 Jul 2005; Mike Frysinger <vapier@gentoo.org>
+  +files/ip6tables-1.3.2.confd, +files/iptables-1.3.2.confd,
+  +files/iptables-1.3.2.init, +iptables-1.3.2.ebuild:
+  Version bump #98641 by Lars (Polynomial-C).  Unified the iptables/ip6tables
+  init.d scripts.  Added a new 'panic' option to init.d #72033 by Colin 
+  Kingsley.
 
 *iptables-1.3.1-r4 (05 May 2005)
 
diff --git a/net-firewall/iptables/files/digest-iptables-1.3.2 b/net-firewall/iptables/files/digest-iptables-1.3.2
new file mode 100644
index 000000000000..eb3d054b2ad9
--- /dev/null
+++ b/net-firewall/iptables/files/digest-iptables-1.3.2
@@ -0,0 +1,3 @@
+MD5 9a951971de3f6c7f60dece4023a48687 iptables-1.3.2.tar.bz2 186255
+MD5 9adae8be9562775a176fc1b275b3cb29 iptables-1.3.0-imq1.diff 5369
+MD5 24963993a6f0727206a3a2d1a9c5e83b netfilter-layer7-v1.2.tar.gz 71697
diff --git a/net-firewall/iptables/files/ip6tables-1.3.2.confd b/net-firewall/iptables/files/ip6tables-1.3.2.confd
new file mode 100644
index 000000000000..93c0bc89b38a
--- /dev/null
+++ b/net-firewall/iptables/files/ip6tables-1.3.2.confd
@@ -0,0 +1,11 @@
+# /etc/conf.d/ip6tables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
diff --git a/net-firewall/iptables/files/iptables-1.3.2.confd b/net-firewall/iptables/files/iptables-1.3.2.confd
new file mode 100644
index 000000000000..91287debdbcf
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.3.2.confd
@@ -0,0 +1,11 @@
+# /etc/conf.d/iptables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IPTABLES_SAVE="/var/lib/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
diff --git a/net-firewall/iptables/files/iptables-1.3.2.init b/net-firewall/iptables/files/iptables-1.3.2.init
new file mode 100755
index 000000000000..e58d2b770145
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.3.2.init
@@ -0,0 +1,111 @@
+#!/sbin/runscript
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.3.2.init,v 1.1 2005/07/12 02:38:29 vapier Exp $
+
+opts="save reload panic"
+
+iptables_name=${SVCNAME}
+if [[ ${iptables_name} != "iptables" && ${iptables_name} != "ip6tables" ]] ; then
+	iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+	iptables)  iptables_proc="/proc/net/ip_tables_names"
+	           iptables_save=${IPTABLES_SAVE};;
+	ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+	           iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+	before net
+	use logger
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${iptables_bin} -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkkernel() {
+	if [[ ! -e ${iptables_proc} ]] ; then
+		eerror "Your kernel lacks ${iptables_name} support, please load"
+		eerror "appropriate modules and try again."
+		return 1
+	fi
+	return 0
+}
+checkconfig() {
+	if [[ ! -f ${iptables_save} ]] ; then
+		eerror "Not starting ${iptables_name}.  First create some rules then run:"
+		eerror "/etc/init.d/${iptables_name} save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ${iptables_name} state and starting firewall"
+	${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	eend $?
+}
+
+stop() {
+	if [[ ${SAVE_ON_STOP} == "yes" ]] ; then
+		save || return 1
+	fi
+	checkkernel || return 1
+	ebegin "Stopping firewall"
+	for a in $(<${iptables_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+
+		set_table_policy $a ACCEPT
+	done
+	eend $?
+}
+
+reload() {
+	checkkernel || return 1
+	ebegin "Flushing firewall"
+	for a in $(<${iptabes_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ${iptables_name} state"
+	touch "${iptables_save}"
+	chmod 0600 "${iptables_save}"
+	${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+	eend $?
+}
+
+panic() {
+	checkkernel || return 1
+	[[ -e ${svcdir}/started/${iptables_name} ]] && svc_stop
+
+	ebegin "Dropping all packets"
+	for a in $(<${iptables_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}
diff --git a/net-firewall/iptables/iptables-1.3.2.ebuild b/net-firewall/iptables/iptables-1.3.2.ebuild
new file mode 100644
index 000000000000..1866136df23d
--- /dev/null
+++ b/net-firewall/iptables/iptables-1.3.2.ebuild
@@ -0,0 +1,158 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/iptables-1.3.2.ebuild,v 1.1 2005/07/12 02:38:29 vapier Exp $
+
+inherit eutils flag-o-matic toolchain-funcs linux-info
+
+L7_PN="netfilter-layer7"
+L7_PV="1.2"
+L7_P="${L7_PN}-v${L7_PV}"
+L7_PATCH="iptables-layer7-${L7_PV}.patch"
+IMQ_PATCH="iptables-1.3.0-imq1.diff"
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="http://www.iptables.org/"
+SRC_URI="http://www.iptables.org/files/${P}.tar.bz2
+	extensions? (
+		http://www.linuximq.net/patchs/${IMQ_PATCH}
+		mirror://sourceforge/l7-filter/${L7_P}.tar.gz
+	)"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="-*" #~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="ipv6 static extensions"
+
+DEPEND="virtual/os-headers
+	extensions? ( virtual/linux-sources )"
+RDEPEND=""
+
+pkg_setup() {
+	if use extensions ; then
+		ewarn "WARNING: 3rd party extensions has been enabled."
+		ewarn "This means that iptables will use your currently installed"
+		ewarn "kernel in ${KERNEL_DIR} as headers for iptables."
+		ewarn
+		ewarn "You may have to patch your kernel to allow iptables to build."
+		ewarn "Please check http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ for patches"
+		ewarn "for your kernel."
+		ewarn
+		ewarn "For layer 7 support emerge net-misc/l7-filter-${L7_PV} before this"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use extensions && unpack ${L7_P}.tar.gz
+	cd "${S}"
+
+	EPATCH_OPTS="-p0" \
+	epatch "${FILESDIR}"/1.3.1-files/install_ipv6_apps.patch.bz2
+	EPATCH_OPTS="-p1" \
+	epatch "${FILESDIR}"/1.3.1-files/install_all_dev_files.patch-1.3.1.bz2
+
+	# this provide's grsec's stealth match
+	EPATCH_OPTS="-p0" \
+	epatch "${FILESDIR}"/1.3.1-files/grsecurity-1.2.8-iptables.patch-1.3.1.bz2
+
+	sed -i \
+		-e "s/PF_EXT_SLIB:=/PF_EXT_SLIB:=stealth /g" \
+		extensions/Makefile \
+		|| die "failed to enable stealth extension"
+
+	EPATCH_OPTS="-p1" \
+	epatch "${FILESDIR}"/1.3.1-files/${PN}-1.3.1-compilefix.patch
+
+	if use extensions ; then
+		EPATCH_OPTS="-p1" epatch ${DISTDIR}/${IMQ_PATCH}
+		EPATCH_OPTS="-p1" epatch ${WORKDIR}/${L7_P}/${L7_PATCH}
+		chmod +x extensions/{.IMQ-test*,.childlevel-test*,.layer7-test*}
+	fi
+}
+
+
+src_defs() {
+	# these are used in both of src_compile and src_install
+	myconf="${myconf} PREFIX="
+	myconf="${myconf} LIBDIR=/$(get_libdir)"
+	myconf="${myconf} BINDIR=/sbin"
+	myconf="${myconf} MANDIR=/usr/share/man"
+	myconf="${myconf} INCDIR=/usr/include"
+	# iptables and libraries are now installed to /sbin and /lib, so that
+	# systems with remote network-mounted /usr filesystems can get their
+	# network interfaces up and running correctly without /usr.
+	use ipv6 || myconf="${myconf} DO_IPV6=0"
+	use static && myconf="${myconf} NO_SHARED_LIBS=0"
+	export myconf
+	if ! use extensions ; then
+		export KERNEL_DIR="/usr"
+		diemsg=""
+	else
+		diemsg="Please check http://cvs.iptables.org/patch-o-matic-ng/updates/ if your kernel needs to be patched for iptables"
+	fi
+	export diemsg
+}
+
+
+src_compile() {
+	src_defs
+
+	# iptables will NOT work correctly unless -O[123] are present!
+	replace-flags -O0 -O2
+	get-flag -O || append-flags -O2
+
+	# prevent it from causing ICMP errors.
+	# http://bugs.gentoo.org/show_bug.cgi?id=23645
+	filter-flags -fstack-protector
+
+	emake -j1 \
+		COPT_FLAGS="${CFLAGS}" ${myconf} \
+		KERNEL_DIR="${KERNEL_DIR}" \
+		CC="$(tc-getCC)" \
+		|| die "${diemsg}"
+}
+
+src_install() {
+	src_defs
+	make ${myconf} \
+		DESTDIR="${D}" \
+		KERNEL_DIR="${KERNEL_DIR}" \
+		install install-devel || die "${diemsg}"
+
+	dodir /usr/$(get_libdir)
+	mv -f "${D}"/$(get_libdir)/*.a "${D}"/usr/$(get_libdir)
+
+	keepdir /var/lib/iptables
+	newinitd "${FILESDIR}"/${PN}-1.3.2.init iptables
+	newconfd "${FILESDIR}"/${PN}-1.3.2.confd iptables
+
+	if use ipv6 ; then
+		keepdir /var/lib/ip6tables
+		newinitd "${FILESDIR}"/iptables-1.3.2.init ip6tables
+		newconfd "${FILESDIR}"/ip6tables-1.3.2.confd ip6tables
+	fi
+}
+
+pkg_postinst() {
+	einfo "This package now includes an initscript which loads and saves"
+	einfo "rules stored in /var/lib/iptables/rules-save"
+	use ipv6 && einfo "and /var/lib/ip6tables/rules-save"
+	einfo "This location can be changed in /etc/conf.d/iptables"
+	einfo
+	einfo "If you are using the iptables initsscript you should save your"
+	einfo "rules using the new iptables version before rebooting."
+	einfo
+	einfo "If you are upgrading to a >=2.4.21 kernel you may need to rebuild"
+	einfo "iptables."
+	einfo
+	ewarn "!!! ipforwarding is now not a part of the iptables initscripts."
+	einfo "Until a more permanent solution is implemented adding the following"
+	einfo "to /etc/conf.d/local.start will enable ipforwarding at bootup:"
+	einfo "  echo \"1\" > /proc/sys/net/ipv4/conf/all/forwarding"
+	if use ipv6 ; then
+		einfo "and/or"
+		einfo "  echo \"1\" > /proc/sys/net/ipv6/conf/all/forwarding"
+		einfo "for ipv6."
+	fi
+}