[arch-commits] Commit in nftables/repos (10 files)
Sébastien Luttringer
seblu at archlinux.org
Wed Dec 28 21:24:56 UTC 2016
Date: Wednesday, December 28, 2016 @ 21:24:55
Author: seblu
Revision: 284951
archrelease: copy trunk to testing-i686, testing-x86_64
Added:
nftables/repos/testing-i686/
nftables/repos/testing-i686/PKGBUILD
(from rev 284950, nftables/trunk/PKGBUILD)
nftables/repos/testing-i686/nftables-reload
(from rev 284950, nftables/trunk/nftables-reload)
nftables/repos/testing-i686/nftables.conf
(from rev 284950, nftables/trunk/nftables.conf)
nftables/repos/testing-i686/nftables.service
(from rev 284950, nftables/trunk/nftables.service)
nftables/repos/testing-x86_64/
nftables/repos/testing-x86_64/PKGBUILD
(from rev 284950, nftables/trunk/PKGBUILD)
nftables/repos/testing-x86_64/nftables-reload
(from rev 284950, nftables/trunk/nftables-reload)
nftables/repos/testing-x86_64/nftables.conf
(from rev 284950, nftables/trunk/nftables.conf)
nftables/repos/testing-x86_64/nftables.service
(from rev 284950, nftables/trunk/nftables.service)
---------------------------------+
testing-i686/PKGBUILD | 61 ++++++++++++++++++++++++++++++++++++++
testing-i686/nftables-reload | 3 +
testing-i686/nftables.conf | 38 +++++++++++++++++++++++
testing-i686/nftables.service | 15 +++++++++
testing-x86_64/PKGBUILD | 61 ++++++++++++++++++++++++++++++++++++++
testing-x86_64/nftables-reload | 3 +
testing-x86_64/nftables.conf | 38 +++++++++++++++++++++++
testing-x86_64/nftables.service | 15 +++++++++
8 files changed, 234 insertions(+)
Copied: nftables/repos/testing-i686/PKGBUILD (from rev 284950, nftables/trunk/PKGBUILD)
===================================================================
--- testing-i686/PKGBUILD (rev 0)
+++ testing-i686/PKGBUILD 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,61 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.7
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+ 'nftables.conf'
+ 'nftables.service'
+ 'nftables-reload')
+sha1sums=('c003fa8b63b1b44c52de345a4d84487d81865a98'
+ 'SKIP'
+ 'a7146fad414f9e827e2e83b630308890c876b80d'
+ '65833b9c5b777cfb3a0776060c569a727ce6f460'
+ 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+ cd $pkgname-$pkgver
+ # apply patch from the source array (should be a pacman feature)
+ local filename
+ for filename in "${source[@]}"; do
+ if [[ "$filename" =~ \.patch$ ]]; then
+ msg2 "Applying patch ${filename##*/}"
+ patch -p1 -N -i "$srcdir/${filename##*/}"
+ fi
+ done
+ :
+}
+
+build() {
+ cd $pkgname-$pkgver
+ ./configure \
+ --prefix=/usr \
+ --sbindir=/usr/bin \
+ --sysconfdir=/usr/share \
+ CONFIG_MAN=y DB2MAN=docbook2man
+ make
+}
+
+package() {
+ pushd $pkgname-$pkgver
+ make DESTDIR="$pkgdir" install
+ popd
+ # basic safe firewall config
+ install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+ # systemd
+ install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+ install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:
Copied: nftables/repos/testing-i686/nftables-reload (from rev 284950, nftables/trunk/nftables-reload)
===================================================================
--- testing-i686/nftables-reload (rev 0)
+++ testing-i686/nftables-reload 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"
Copied: nftables/repos/testing-i686/nftables.conf (from rev 284950, nftables/trunk/nftables.conf)
===================================================================
--- testing-i686/nftables.conf (rev 0)
+++ testing-i686/nftables.conf 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0;
+
+ # allow established/related connections
+ ct state {established, related} accept
+
+ # early drop of invalid connections
+ ct state invalid drop
+
+ # allow from loopback
+ iifname lo accept
+
+ # allow icmp
+ ip protocol icmp accept
+ ip6 nexthdr icmpv6 accept
+
+ # allow ssh
+ tcp dport ssh accept
+
+ # everything else
+ reject with icmp type port-unreachable
+ }
+ chain forward {
+ type filter hook forward priority 0;
+ drop
+ }
+ chain output {
+ type filter hook output priority 0;
+ }
+
+}
+
+# vim:set ts=2 sw=2 et:
Copied: nftables/repos/testing-i686/nftables.service (from rev 284950, nftables/trunk/nftables.service)
===================================================================
--- testing-i686/nftables.service (rev 0)
+++ testing-i686/nftables.service 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
Copied: nftables/repos/testing-x86_64/PKGBUILD (from rev 284950, nftables/trunk/PKGBUILD)
===================================================================
--- testing-x86_64/PKGBUILD (rev 0)
+++ testing-x86_64/PKGBUILD 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,61 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.7
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+ 'nftables.conf'
+ 'nftables.service'
+ 'nftables-reload')
+sha1sums=('c003fa8b63b1b44c52de345a4d84487d81865a98'
+ 'SKIP'
+ 'a7146fad414f9e827e2e83b630308890c876b80d'
+ '65833b9c5b777cfb3a0776060c569a727ce6f460'
+ 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+ cd $pkgname-$pkgver
+ # apply patch from the source array (should be a pacman feature)
+ local filename
+ for filename in "${source[@]}"; do
+ if [[ "$filename" =~ \.patch$ ]]; then
+ msg2 "Applying patch ${filename##*/}"
+ patch -p1 -N -i "$srcdir/${filename##*/}"
+ fi
+ done
+ :
+}
+
+build() {
+ cd $pkgname-$pkgver
+ ./configure \
+ --prefix=/usr \
+ --sbindir=/usr/bin \
+ --sysconfdir=/usr/share \
+ CONFIG_MAN=y DB2MAN=docbook2man
+ make
+}
+
+package() {
+ pushd $pkgname-$pkgver
+ make DESTDIR="$pkgdir" install
+ popd
+ # basic safe firewall config
+ install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+ # systemd
+ install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+ install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:
Copied: nftables/repos/testing-x86_64/nftables-reload (from rev 284950, nftables/trunk/nftables-reload)
===================================================================
--- testing-x86_64/nftables-reload (rev 0)
+++ testing-x86_64/nftables-reload 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"
Copied: nftables/repos/testing-x86_64/nftables.conf (from rev 284950, nftables/trunk/nftables.conf)
===================================================================
--- testing-x86_64/nftables.conf (rev 0)
+++ testing-x86_64/nftables.conf 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0;
+
+ # allow established/related connections
+ ct state {established, related} accept
+
+ # early drop of invalid connections
+ ct state invalid drop
+
+ # allow from loopback
+ iifname lo accept
+
+ # allow icmp
+ ip protocol icmp accept
+ ip6 nexthdr icmpv6 accept
+
+ # allow ssh
+ tcp dport ssh accept
+
+ # everything else
+ reject with icmp type port-unreachable
+ }
+ chain forward {
+ type filter hook forward priority 0;
+ drop
+ }
+ chain output {
+ type filter hook output priority 0;
+ }
+
+}
+
+# vim:set ts=2 sw=2 et:
Copied: nftables/repos/testing-x86_64/nftables.service (from rev 284950, nftables/trunk/nftables.service)
===================================================================
--- testing-x86_64/nftables.service (rev 0)
+++ testing-x86_64/nftables.service 2016-12-28 21:24:55 UTC (rev 284951)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
More information about the arch-commits
mailing list