[arch-commits] Commit in nftables/repos (20 files)
Sébastien Luttringer
seblu at archlinux.org
Fri Dec 30 13:53:59 UTC 2016
Date: Friday, December 30, 2016 @ 13:53:59
Author: seblu
Revision: 284980
db-move: moved nftables from [testing] to [extra] (i686, x86_64)
Added:
nftables/repos/extra-i686/PKGBUILD
(from rev 284979, nftables/repos/testing-i686/PKGBUILD)
nftables/repos/extra-i686/nftables-reload
(from rev 284979, nftables/repos/testing-i686/nftables-reload)
nftables/repos/extra-i686/nftables.conf
(from rev 284979, nftables/repos/testing-i686/nftables.conf)
nftables/repos/extra-i686/nftables.service
(from rev 284979, nftables/repos/testing-i686/nftables.service)
nftables/repos/extra-x86_64/PKGBUILD
(from rev 284979, nftables/repos/testing-x86_64/PKGBUILD)
nftables/repos/extra-x86_64/nftables-reload
(from rev 284979, nftables/repos/testing-x86_64/nftables-reload)
nftables/repos/extra-x86_64/nftables.conf
(from rev 284979, nftables/repos/testing-x86_64/nftables.conf)
nftables/repos/extra-x86_64/nftables.service
(from rev 284979, nftables/repos/testing-x86_64/nftables.service)
Deleted:
nftables/repos/extra-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
nftables/repos/extra-i686/PKGBUILD
nftables/repos/extra-i686/nftables-reload
nftables/repos/extra-i686/nftables.conf
nftables/repos/extra-i686/nftables.service
nftables/repos/extra-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
nftables/repos/extra-x86_64/PKGBUILD
nftables/repos/extra-x86_64/nftables-reload
nftables/repos/extra-x86_64/nftables.conf
nftables/repos/extra-x86_64/nftables.service
nftables/repos/testing-i686/
nftables/repos/testing-x86_64/
----------------------------------------------------------------------------+
/PKGBUILD | 122 ++++++++++
/nftables-reload | 6
/nftables.conf | 76 ++++++
/nftables.service | 30 ++
extra-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch | 108 --------
extra-i686/PKGBUILD | 63 -----
extra-i686/nftables-reload | 3
extra-i686/nftables.conf | 38 ---
extra-i686/nftables.service | 15 -
extra-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch | 108 --------
extra-x86_64/PKGBUILD | 63 -----
extra-x86_64/nftables-reload | 3
extra-x86_64/nftables.conf | 38 ---
extra-x86_64/nftables.service | 15 -
14 files changed, 234 insertions(+), 454 deletions(-)
Deleted: extra-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
===================================================================
--- extra-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,108 +0,0 @@
-From 3503738f77cdbe521da1054a37f59ac2e442b4cf Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw at strlen.de>
-Date: Mon, 6 Jun 2016 21:52:28 +0200
-Subject: [PATCH 2/7] payload: don't update protocol context if we can't find a
- description
-
-Since commit
-20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
-we deref null pointer if we can't find a description for the desired
-protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
-(tcp, udp) works.
-
-Also add a test case for this.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
-Signed-off-by: Florian Westphal <fw at strlen.de>
-Acked-by: Pablo Neira Ayuso <pablo at netfilter.org>
----
- src/payload.c | 3 +++
- tests/py/ip/ip.t | 3 +++
- tests/py/ip/ip.t.payload | 5 +++++
- tests/py/ip/ip.t.payload.inet | 7 +++++++
- tests/py/ip/ip.t.payload.netdev | 7 +++++++
- 5 files changed, 25 insertions(+)
-
-diff --git a/src/payload.c b/src/payload.c
-index ac0e917..9ba980a 100644
---- a/src/payload.c
-+++ b/src/payload.c
-@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
- base = ctx->protocol[left->payload.base].desc;
- desc = proto_find_upper(base, proto);
-
-+ if (!desc)
-+ return;
-+
- assert(desc->base <= PROTO_BASE_MAX);
- if (desc->base == base->base) {
- assert(base->length > 0);
-diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
-index 594136c..a265b75 100644
---- a/tests/py/ip/ip.t
-+++ b/tests/py/ip/ip.t
-@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
- ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
- - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
-
-+ip protocol 255;ok
-+ip protocol 256;fail
-+
- ip checksum 13172 drop;ok
- ip checksum 22;ok
- ip checksum != 233;ok
-diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
-index 3bd3358..15cc590 100644
---- a/tests/py/ip/ip.t.payload
-+++ b/tests/py/ip/ip.t.payload
-@@ -204,6 +204,11 @@ ip test-ip4 input
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- ip test-ip4 input
- [ payload load 2b @ network header + 10 => reg 1 ]
-diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
-index ef4692e..e495246 100644
---- a/tests/py/ip/ip.t.payload.inet
-+++ b/tests/py/ip/ip.t.payload.inet
-@@ -268,6 +268,13 @@ inet test-inet input
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ meta load nfproto => reg 1 ]
-+ [ cmp eq reg 1 0x00000002 ]
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- inet test-inet input
- [ meta load nfproto => reg 1 ]
-diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
-index 4feaa27..8eaee4c 100644
---- a/tests/py/ip/ip.t.payload.netdev
-+++ b/tests/py/ip/ip.t.payload.netdev
-@@ -204,6 +204,13 @@ netdev test-netdev ingress
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ meta load protocol => reg 1 ]
-+ [ cmp eq reg 1 0x00000008 ]
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- netdev test-netdev ingress
- [ meta load protocol => reg 1 ]
---
-2.8.3
-
Deleted: extra-i686/PKGBUILD
===================================================================
--- extra-i686/PKGBUILD 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-i686/PKGBUILD 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,63 +0,0 @@
-# $Id$
-# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
-
-pkgname=nftables
-epoch=1
-pkgver=0.6
-pkgrel=3
-pkgdesc='Netfilter tables userspace tools'
-arch=('i686' 'x86_64')
-url='https://netfilter.org/projects/nftables/'
-license=('GPL2')
-depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
-makedepends=('docbook2x')
-backup=('etc/nftables.conf')
-validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
-# 2016-11-03: https sources download is broken with curl
-source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
- '01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch'
- 'nftables.conf'
- 'nftables.service'
- 'nftables-reload')
-sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
- 'SKIP'
- 'c2f79f151a57ba6888d325f2573a6a0269830e9b'
- 'a7146fad414f9e827e2e83b630308890c876b80d'
- '65833b9c5b777cfb3a0776060c569a727ce6f460'
- 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
-
-prepare() {
- cd $pkgname-$pkgver
- # apply patch from the source array (should be a pacman feature)
- local filename
- for filename in "${source[@]}"; do
- if [[ "$filename" =~ \.patch$ ]]; then
- msg2 "Applying patch ${filename##*/}"
- patch -p1 -N -i "$srcdir/${filename##*/}"
- fi
- done
- :
-}
-
-build() {
- cd $pkgname-$pkgver
- ./configure \
- --prefix=/usr \
- --sbindir=/usr/bin \
- --sysconfdir=/usr/share \
- CONFIG_MAN=y DB2MAN=docbook2man
- make
-}
-
-package() {
- pushd $pkgname-$pkgver
- make DESTDIR="$pkgdir" install
- popd
- # basic safe firewall config
- install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
- # systemd
- install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
- install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
-}
-
-# vim:set ts=2 sw=2 et:
Copied: nftables/repos/extra-i686/PKGBUILD (from rev 284979, nftables/repos/testing-i686/PKGBUILD)
===================================================================
--- extra-i686/PKGBUILD (rev 0)
+++ extra-i686/PKGBUILD 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,61 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.7
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+ 'nftables.conf'
+ 'nftables.service'
+ 'nftables-reload')
+sha1sums=('c003fa8b63b1b44c52de345a4d84487d81865a98'
+ 'SKIP'
+ 'a7146fad414f9e827e2e83b630308890c876b80d'
+ '65833b9c5b777cfb3a0776060c569a727ce6f460'
+ 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+ cd $pkgname-$pkgver
+ # apply patch from the source array (should be a pacman feature)
+ local filename
+ for filename in "${source[@]}"; do
+ if [[ "$filename" =~ \.patch$ ]]; then
+ msg2 "Applying patch ${filename##*/}"
+ patch -p1 -N -i "$srcdir/${filename##*/}"
+ fi
+ done
+ :
+}
+
+build() {
+ cd $pkgname-$pkgver
+ ./configure \
+ --prefix=/usr \
+ --sbindir=/usr/bin \
+ --sysconfdir=/usr/share \
+ CONFIG_MAN=y DB2MAN=docbook2man
+ make
+}
+
+package() {
+ pushd $pkgname-$pkgver
+ make DESTDIR="$pkgdir" install
+ popd
+ # basic safe firewall config
+ install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+ # systemd
+ install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+ install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:
Deleted: extra-i686/nftables-reload
===================================================================
--- extra-i686/nftables-reload 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-i686/nftables-reload 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,3 +0,0 @@
-#!/usr/bin/nft -f
-flush ruleset
-include "/etc/nftables.conf"
Copied: nftables/repos/extra-i686/nftables-reload (from rev 284979, nftables/repos/testing-i686/nftables-reload)
===================================================================
--- extra-i686/nftables-reload (rev 0)
+++ extra-i686/nftables-reload 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"
Deleted: extra-i686/nftables.conf
===================================================================
--- extra-i686/nftables.conf 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-i686/nftables.conf 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,38 +0,0 @@
-#!/usr/bin/nft -f
-# ipv4/ipv6 Simple & Safe Firewall
-# you can find examples in /usr/share/nftables/
-
-table inet filter {
- chain input {
- type filter hook input priority 0;
-
- # allow established/related connections
- ct state {established, related} accept
-
- # early drop of invalid connections
- ct state invalid drop
-
- # allow from loopback
- iifname lo accept
-
- # allow icmp
- ip protocol icmp accept
- ip6 nexthdr icmpv6 accept
-
- # allow ssh
- tcp dport ssh accept
-
- # everything else
- reject with icmp type port-unreachable
- }
- chain forward {
- type filter hook forward priority 0;
- drop
- }
- chain output {
- type filter hook output priority 0;
- }
-
-}
-
-# vim:set ts=2 sw=2 et:
Copied: nftables/repos/extra-i686/nftables.conf (from rev 284979, nftables/repos/testing-i686/nftables.conf)
===================================================================
--- extra-i686/nftables.conf (rev 0)
+++ extra-i686/nftables.conf 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0;
+
+ # allow established/related connections
+ ct state {established, related} accept
+
+ # early drop of invalid connections
+ ct state invalid drop
+
+ # allow from loopback
+ iifname lo accept
+
+ # allow icmp
+ ip protocol icmp accept
+ ip6 nexthdr icmpv6 accept
+
+ # allow ssh
+ tcp dport ssh accept
+
+ # everything else
+ reject with icmp type port-unreachable
+ }
+ chain forward {
+ type filter hook forward priority 0;
+ drop
+ }
+ chain output {
+ type filter hook output priority 0;
+ }
+
+}
+
+# vim:set ts=2 sw=2 et:
Deleted: extra-i686/nftables.service
===================================================================
--- extra-i686/nftables.service 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-i686/nftables.service 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,15 +0,0 @@
-[Unit]
-Description=Netfilter Tables
-Documentation=man:nft(8)
-Wants=network-pre.target
-Before=network-pre.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/nft -f /etc/nftables.conf
-ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
-ExecStop=/usr/bin/nft flush ruleset
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
Copied: nftables/repos/extra-i686/nftables.service (from rev 284979, nftables/repos/testing-i686/nftables.service)
===================================================================
--- extra-i686/nftables.service (rev 0)
+++ extra-i686/nftables.service 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
Deleted: extra-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
===================================================================
--- extra-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,108 +0,0 @@
-From 3503738f77cdbe521da1054a37f59ac2e442b4cf Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw at strlen.de>
-Date: Mon, 6 Jun 2016 21:52:28 +0200
-Subject: [PATCH 2/7] payload: don't update protocol context if we can't find a
- description
-
-Since commit
-20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
-we deref null pointer if we can't find a description for the desired
-protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
-(tcp, udp) works.
-
-Also add a test case for this.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
-Signed-off-by: Florian Westphal <fw at strlen.de>
-Acked-by: Pablo Neira Ayuso <pablo at netfilter.org>
----
- src/payload.c | 3 +++
- tests/py/ip/ip.t | 3 +++
- tests/py/ip/ip.t.payload | 5 +++++
- tests/py/ip/ip.t.payload.inet | 7 +++++++
- tests/py/ip/ip.t.payload.netdev | 7 +++++++
- 5 files changed, 25 insertions(+)
-
-diff --git a/src/payload.c b/src/payload.c
-index ac0e917..9ba980a 100644
---- a/src/payload.c
-+++ b/src/payload.c
-@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
- base = ctx->protocol[left->payload.base].desc;
- desc = proto_find_upper(base, proto);
-
-+ if (!desc)
-+ return;
-+
- assert(desc->base <= PROTO_BASE_MAX);
- if (desc->base == base->base) {
- assert(base->length > 0);
-diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
-index 594136c..a265b75 100644
---- a/tests/py/ip/ip.t
-+++ b/tests/py/ip/ip.t
-@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
- ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
- - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
-
-+ip protocol 255;ok
-+ip protocol 256;fail
-+
- ip checksum 13172 drop;ok
- ip checksum 22;ok
- ip checksum != 233;ok
-diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
-index 3bd3358..15cc590 100644
---- a/tests/py/ip/ip.t.payload
-+++ b/tests/py/ip/ip.t.payload
-@@ -204,6 +204,11 @@ ip test-ip4 input
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- ip test-ip4 input
- [ payload load 2b @ network header + 10 => reg 1 ]
-diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
-index ef4692e..e495246 100644
---- a/tests/py/ip/ip.t.payload.inet
-+++ b/tests/py/ip/ip.t.payload.inet
-@@ -268,6 +268,13 @@ inet test-inet input
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ meta load nfproto => reg 1 ]
-+ [ cmp eq reg 1 0x00000002 ]
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- inet test-inet input
- [ meta load nfproto => reg 1 ]
-diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
-index 4feaa27..8eaee4c 100644
---- a/tests/py/ip/ip.t.payload.netdev
-+++ b/tests/py/ip/ip.t.payload.netdev
-@@ -204,6 +204,13 @@ netdev test-netdev ingress
- [ lookup reg 1 set __set%d ]
- [ immediate reg 0 accept ]
-
-+# ip protocol 255
-+ip test-ip4 input
-+ [ meta load protocol => reg 1 ]
-+ [ cmp eq reg 1 0x00000008 ]
-+ [ payload load 1b @ network header + 9 => reg 1 ]
-+ [ cmp eq reg 1 0x000000ff ]
-+
- # ip checksum 13172 drop
- netdev test-netdev ingress
- [ meta load protocol => reg 1 ]
---
-2.8.3
-
Deleted: extra-x86_64/PKGBUILD
===================================================================
--- extra-x86_64/PKGBUILD 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-x86_64/PKGBUILD 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,63 +0,0 @@
-# $Id$
-# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
-
-pkgname=nftables
-epoch=1
-pkgver=0.6
-pkgrel=3
-pkgdesc='Netfilter tables userspace tools'
-arch=('i686' 'x86_64')
-url='https://netfilter.org/projects/nftables/'
-license=('GPL2')
-depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
-makedepends=('docbook2x')
-backup=('etc/nftables.conf')
-validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
-# 2016-11-03: https sources download is broken with curl
-source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
- '01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch'
- 'nftables.conf'
- 'nftables.service'
- 'nftables-reload')
-sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
- 'SKIP'
- 'c2f79f151a57ba6888d325f2573a6a0269830e9b'
- 'a7146fad414f9e827e2e83b630308890c876b80d'
- '65833b9c5b777cfb3a0776060c569a727ce6f460'
- 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
-
-prepare() {
- cd $pkgname-$pkgver
- # apply patch from the source array (should be a pacman feature)
- local filename
- for filename in "${source[@]}"; do
- if [[ "$filename" =~ \.patch$ ]]; then
- msg2 "Applying patch ${filename##*/}"
- patch -p1 -N -i "$srcdir/${filename##*/}"
- fi
- done
- :
-}
-
-build() {
- cd $pkgname-$pkgver
- ./configure \
- --prefix=/usr \
- --sbindir=/usr/bin \
- --sysconfdir=/usr/share \
- CONFIG_MAN=y DB2MAN=docbook2man
- make
-}
-
-package() {
- pushd $pkgname-$pkgver
- make DESTDIR="$pkgdir" install
- popd
- # basic safe firewall config
- install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
- # systemd
- install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
- install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
-}
-
-# vim:set ts=2 sw=2 et:
Copied: nftables/repos/extra-x86_64/PKGBUILD (from rev 284979, nftables/repos/testing-x86_64/PKGBUILD)
===================================================================
--- extra-x86_64/PKGBUILD (rev 0)
+++ extra-x86_64/PKGBUILD 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,61 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.7
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+ 'nftables.conf'
+ 'nftables.service'
+ 'nftables-reload')
+sha1sums=('c003fa8b63b1b44c52de345a4d84487d81865a98'
+ 'SKIP'
+ 'a7146fad414f9e827e2e83b630308890c876b80d'
+ '65833b9c5b777cfb3a0776060c569a727ce6f460'
+ 'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+ cd $pkgname-$pkgver
+ # apply patch from the source array (should be a pacman feature)
+ local filename
+ for filename in "${source[@]}"; do
+ if [[ "$filename" =~ \.patch$ ]]; then
+ msg2 "Applying patch ${filename##*/}"
+ patch -p1 -N -i "$srcdir/${filename##*/}"
+ fi
+ done
+ :
+}
+
+build() {
+ cd $pkgname-$pkgver
+ ./configure \
+ --prefix=/usr \
+ --sbindir=/usr/bin \
+ --sysconfdir=/usr/share \
+ CONFIG_MAN=y DB2MAN=docbook2man
+ make
+}
+
+package() {
+ pushd $pkgname-$pkgver
+ make DESTDIR="$pkgdir" install
+ popd
+ # basic safe firewall config
+ install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+ # systemd
+ install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+ install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:
Deleted: extra-x86_64/nftables-reload
===================================================================
--- extra-x86_64/nftables-reload 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-x86_64/nftables-reload 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,3 +0,0 @@
-#!/usr/bin/nft -f
-flush ruleset
-include "/etc/nftables.conf"
Copied: nftables/repos/extra-x86_64/nftables-reload (from rev 284979, nftables/repos/testing-x86_64/nftables-reload)
===================================================================
--- extra-x86_64/nftables-reload (rev 0)
+++ extra-x86_64/nftables-reload 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"
Deleted: extra-x86_64/nftables.conf
===================================================================
--- extra-x86_64/nftables.conf 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-x86_64/nftables.conf 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,38 +0,0 @@
-#!/usr/bin/nft -f
-# ipv4/ipv6 Simple & Safe Firewall
-# you can find examples in /usr/share/nftables/
-
-table inet filter {
- chain input {
- type filter hook input priority 0;
-
- # allow established/related connections
- ct state {established, related} accept
-
- # early drop of invalid connections
- ct state invalid drop
-
- # allow from loopback
- iifname lo accept
-
- # allow icmp
- ip protocol icmp accept
- ip6 nexthdr icmpv6 accept
-
- # allow ssh
- tcp dport ssh accept
-
- # everything else
- reject with icmp type port-unreachable
- }
- chain forward {
- type filter hook forward priority 0;
- drop
- }
- chain output {
- type filter hook output priority 0;
- }
-
-}
-
-# vim:set ts=2 sw=2 et:
Copied: nftables/repos/extra-x86_64/nftables.conf (from rev 284979, nftables/repos/testing-x86_64/nftables.conf)
===================================================================
--- extra-x86_64/nftables.conf (rev 0)
+++ extra-x86_64/nftables.conf 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0;
+
+ # allow established/related connections
+ ct state {established, related} accept
+
+ # early drop of invalid connections
+ ct state invalid drop
+
+ # allow from loopback
+ iifname lo accept
+
+ # allow icmp
+ ip protocol icmp accept
+ ip6 nexthdr icmpv6 accept
+
+ # allow ssh
+ tcp dport ssh accept
+
+ # everything else
+ reject with icmp type port-unreachable
+ }
+ chain forward {
+ type filter hook forward priority 0;
+ drop
+ }
+ chain output {
+ type filter hook output priority 0;
+ }
+
+}
+
+# vim:set ts=2 sw=2 et:
Deleted: extra-x86_64/nftables.service
===================================================================
--- extra-x86_64/nftables.service 2016-12-30 13:53:54 UTC (rev 284979)
+++ extra-x86_64/nftables.service 2016-12-30 13:53:59 UTC (rev 284980)
@@ -1,15 +0,0 @@
-[Unit]
-Description=Netfilter Tables
-Documentation=man:nft(8)
-Wants=network-pre.target
-Before=network-pre.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/nft -f /etc/nftables.conf
-ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
-ExecStop=/usr/bin/nft flush ruleset
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
Copied: nftables/repos/extra-x86_64/nftables.service (from rev 284979, nftables/repos/testing-x86_64/nftables.service)
===================================================================
--- extra-x86_64/nftables.service (rev 0)
+++ extra-x86_64/nftables.service 2016-12-30 13:53:59 UTC (rev 284980)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
More information about the arch-commits
mailing list