[arch-commits] Commit in nftables/repos (18 files)

Sébastien Luttringer seblu at archlinux.org
Sun Jun 5 21:11:58 UTC 2016


    Date: Sunday, June 5, 2016 @ 23:11:58
  Author: seblu
Revision: 269064

archrelease: copy trunk to extra-i686, extra-x86_64

Added:
  nftables/repos/extra-i686/PKGBUILD
    (from rev 269063, nftables/trunk/PKGBUILD)
  nftables/repos/extra-i686/nftables-reload
    (from rev 269063, nftables/trunk/nftables-reload)
  nftables/repos/extra-i686/nftables.conf
    (from rev 269063, nftables/trunk/nftables.conf)
  nftables/repos/extra-i686/nftables.service
    (from rev 269063, nftables/trunk/nftables.service)
  nftables/repos/extra-x86_64/PKGBUILD
    (from rev 269063, nftables/trunk/PKGBUILD)
  nftables/repos/extra-x86_64/nftables-reload
    (from rev 269063, nftables/trunk/nftables-reload)
  nftables/repos/extra-x86_64/nftables.conf
    (from rev 269063, nftables/trunk/nftables.conf)
  nftables/repos/extra-x86_64/nftables.service
    (from rev 269063, nftables/trunk/nftables.service)
Deleted:
  nftables/repos/extra-i686/001-fix-FS#47289.patch
  nftables/repos/extra-i686/PKGBUILD
  nftables/repos/extra-i686/nftables-reload
  nftables/repos/extra-i686/nftables.conf
  nftables/repos/extra-i686/nftables.service
  nftables/repos/extra-x86_64/001-fix-FS#47289.patch
  nftables/repos/extra-x86_64/PKGBUILD
  nftables/repos/extra-x86_64/nftables-reload
  nftables/repos/extra-x86_64/nftables.conf
  nftables/repos/extra-x86_64/nftables.service

-------------------------------------+
 /PKGBUILD                           |  120 ++++++++++++++++++++++++++++++++++
 /nftables-reload                    |    6 +
 /nftables.conf                      |   76 +++++++++++++++++++++
 /nftables.service                   |   30 ++++++++
 extra-i686/001-fix-FS#47289.patch   |   49 -------------
 extra-i686/PKGBUILD                 |   56 ---------------
 extra-i686/nftables-reload          |    3 
 extra-i686/nftables.conf            |   38 ----------
 extra-i686/nftables.service         |   15 ----
 extra-x86_64/001-fix-FS#47289.patch |   49 -------------
 extra-x86_64/PKGBUILD               |   56 ---------------
 extra-x86_64/nftables-reload        |    3 
 extra-x86_64/nftables.conf          |   38 ----------
 extra-x86_64/nftables.service       |   15 ----
 14 files changed, 232 insertions(+), 322 deletions(-)

Deleted: extra-i686/001-fix-FS#47289.patch
===================================================================
--- extra-i686/001-fix-FS#47289.patch	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-i686/001-fix-FS#47289.patch	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,49 +0,0 @@
-From e6c83f45f522283c7afff4de7a71113116352dbf Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw at strlen.de>
-Date: Thu, 1 Oct 2015 00:13:02 +0200
-Subject: expression: provide clone operation for set element ops
-
-define addrs={ 1.2.3.4 }
-table ip filter {
-	chain input {
-		type filter hook input priority 0;
-		ip saddr $addrs accept
-	}
-}
-
-segfaults. Using saddr { 1.2.3.4 } instead of $addrs works.
-
-Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801087
-Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez at gmail.com>
-Signed-off-by: Florian Westphal <fw at strlen.de>
----
- src/expression.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/src/expression.c b/src/expression.c
-index 3edc550..ab195e5 100644
---- a/src/expression.c
-+++ b/src/expression.c
-@@ -907,9 +907,19 @@ static void set_elem_expr_destroy(struct expr *expr)
- 	expr_free(expr->key);
- }
- 
-+static void set_elem_expr_clone(struct expr *new, const struct expr *expr)
-+{
-+	new->key = expr_clone(expr->key);
-+	new->expiration = expr->expiration;
-+	new->timeout = expr->timeout;
-+	if (expr->comment)
-+		new->comment = xstrdup(expr->comment);
-+}
-+
- static const struct expr_ops set_elem_expr_ops = {
- 	.type		= EXPR_SET_ELEM,
- 	.name		= "set element",
-+	.clone		= set_elem_expr_clone,
- 	.print		= set_elem_expr_print,
- 	.destroy	= set_elem_expr_destroy,
- };
--- 
-cgit v0.11.2
-

Deleted: extra-i686/PKGBUILD
===================================================================
--- extra-i686/PKGBUILD	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-i686/PKGBUILD	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,56 +0,0 @@
-# $Id$
-# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
-
-pkgname=nftables
-epoch=1
-pkgver=0.5
-pkgrel=2
-pkgdesc='Netfilter tables userspace tools'
-arch=('i686' 'x86_64')
-url='http://netfilter.org/projects/nftables/'
-license=('GPL2')
-depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
-makedepends=('docbook2x')
-backup=('etc/nftables.conf')
-validpgpkeys=('57FF5E9C9AA67A860B557AF7A4111F89BB5F58CC') # Netfilter Core Team
-source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
-        '001-fix-FS#47289.patch'
-        'nftables.conf'
-        'nftables.service'
-        'nftables-reload')
-sha1sums=('34cfe1daa33d7fd7087dd63199f64854dfb54064'
-          'SKIP'
-          '0e6df120039d71c4dbd6af36f38ab981926839e8'
-          'a7146fad414f9e827e2e83b630308890c876b80d'
-          '65833b9c5b777cfb3a0776060c569a727ce6f460'
-          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
-
-prepare() {
-  for _f in "${source[@]}"; do
-    [[ "$_f" =~ \.patch$ ]] && { msg2 "$_f"; patch -p1 -d $pkgname-$pkgver < "$_f"; }
-  done
-  :
-}
-
-build() {
-  cd $pkgname-$pkgver
-  ./configure \
-    --prefix=/usr \
-    --sbindir=/usr/bin \
-    --sysconfdir=/usr/share \
-    CONFIG_MAN=y DB2MAN=docbook2man
-  make
-}
-
-package() {
-  pushd $pkgname-$pkgver
-  make DESTDIR="$pkgdir" install
-  popd
-  # basic safe firewall config
-  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
-  # systemd
-  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
-  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
-}
-
-# vim:set ts=2 sw=2 et:

Copied: nftables/repos/extra-i686/PKGBUILD (from rev 269063, nftables/trunk/PKGBUILD)
===================================================================
--- extra-i686/PKGBUILD	                        (rev 0)
+++ extra-i686/PKGBUILD	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,60 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.6
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='http://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+        'nftables.conf'
+        'nftables.service'
+        'nftables-reload')
+sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
+          'SKIP'
+          'a7146fad414f9e827e2e83b630308890c876b80d'
+          '65833b9c5b777cfb3a0776060c569a727ce6f460'
+          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+  cd $pkgname-$pkgver
+  # apply patch from the source array (should be a pacman feature)
+  local filename
+  for filename in "${source[@]}"; do
+    if [[ "$filename" =~ \.patch$ ]]; then
+      msg2 "Applying patch $filename"
+      patch -p1 -N -i "$srcdir/$filename"
+    fi
+  done
+  :
+}
+
+build() {
+  cd $pkgname-$pkgver
+  ./configure \
+    --prefix=/usr \
+    --sbindir=/usr/bin \
+    --sysconfdir=/usr/share \
+    CONFIG_MAN=y DB2MAN=docbook2man
+  make
+}
+
+package() {
+  pushd $pkgname-$pkgver
+  make DESTDIR="$pkgdir" install
+  popd
+  # basic safe firewall config
+  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+  # systemd
+  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:

Deleted: extra-i686/nftables-reload
===================================================================
--- extra-i686/nftables-reload	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-i686/nftables-reload	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,3 +0,0 @@
-#!/usr/bin/nft -f
-flush ruleset
-include "/etc/nftables.conf"

Copied: nftables/repos/extra-i686/nftables-reload (from rev 269063, nftables/trunk/nftables-reload)
===================================================================
--- extra-i686/nftables-reload	                        (rev 0)
+++ extra-i686/nftables-reload	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"

Deleted: extra-i686/nftables.conf
===================================================================
--- extra-i686/nftables.conf	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-i686/nftables.conf	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,38 +0,0 @@
-#!/usr/bin/nft -f
-# ipv4/ipv6 Simple & Safe Firewall
-# you can find examples in /usr/share/nftables/
-
-table inet filter {
-  chain input {
-    type filter hook input priority 0;
-
-    # allow established/related connections
-    ct state {established, related} accept
-
-    # early drop of invalid connections
-    ct state invalid drop
-
-    # allow from loopback
-    iifname lo accept
-
-    # allow icmp
-    ip protocol icmp accept
-    ip6 nexthdr icmpv6 accept
-
-    # allow ssh
-    tcp dport ssh accept
-
-    # everything else
-    reject with icmp type port-unreachable
-  }
-  chain forward {
-    type filter hook forward priority 0;
-    drop
-  }
-  chain output {
-    type filter hook output priority 0;
-  }
-
-}
-
-# vim:set ts=2 sw=2 et:

Copied: nftables/repos/extra-i686/nftables.conf (from rev 269063, nftables/trunk/nftables.conf)
===================================================================
--- extra-i686/nftables.conf	                        (rev 0)
+++ extra-i686/nftables.conf	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0;
+
+    # allow established/related connections
+    ct state {established, related} accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # everything else
+    reject with icmp type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0;
+    drop
+  }
+  chain output {
+    type filter hook output priority 0;
+  }
+
+}
+
+# vim:set ts=2 sw=2 et:

Deleted: extra-i686/nftables.service
===================================================================
--- extra-i686/nftables.service	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-i686/nftables.service	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,15 +0,0 @@
-[Unit]
-Description=Netfilter Tables
-Documentation=man:nft(8)
-Wants=network-pre.target
-Before=network-pre.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/nft -f /etc/nftables.conf
-ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
-ExecStop=/usr/bin/nft flush ruleset
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target

Copied: nftables/repos/extra-i686/nftables.service (from rev 269063, nftables/trunk/nftables.service)
===================================================================
--- extra-i686/nftables.service	                        (rev 0)
+++ extra-i686/nftables.service	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

Deleted: extra-x86_64/001-fix-FS#47289.patch
===================================================================
--- extra-x86_64/001-fix-FS#47289.patch	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-x86_64/001-fix-FS#47289.patch	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,49 +0,0 @@
-From e6c83f45f522283c7afff4de7a71113116352dbf Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw at strlen.de>
-Date: Thu, 1 Oct 2015 00:13:02 +0200
-Subject: expression: provide clone operation for set element ops
-
-define addrs={ 1.2.3.4 }
-table ip filter {
-	chain input {
-		type filter hook input priority 0;
-		ip saddr $addrs accept
-	}
-}
-
-segfaults. Using saddr { 1.2.3.4 } instead of $addrs works.
-
-Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801087
-Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez at gmail.com>
-Signed-off-by: Florian Westphal <fw at strlen.de>
----
- src/expression.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/src/expression.c b/src/expression.c
-index 3edc550..ab195e5 100644
---- a/src/expression.c
-+++ b/src/expression.c
-@@ -907,9 +907,19 @@ static void set_elem_expr_destroy(struct expr *expr)
- 	expr_free(expr->key);
- }
- 
-+static void set_elem_expr_clone(struct expr *new, const struct expr *expr)
-+{
-+	new->key = expr_clone(expr->key);
-+	new->expiration = expr->expiration;
-+	new->timeout = expr->timeout;
-+	if (expr->comment)
-+		new->comment = xstrdup(expr->comment);
-+}
-+
- static const struct expr_ops set_elem_expr_ops = {
- 	.type		= EXPR_SET_ELEM,
- 	.name		= "set element",
-+	.clone		= set_elem_expr_clone,
- 	.print		= set_elem_expr_print,
- 	.destroy	= set_elem_expr_destroy,
- };
--- 
-cgit v0.11.2
-

Deleted: extra-x86_64/PKGBUILD
===================================================================
--- extra-x86_64/PKGBUILD	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-x86_64/PKGBUILD	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,56 +0,0 @@
-# $Id$
-# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
-
-pkgname=nftables
-epoch=1
-pkgver=0.5
-pkgrel=2
-pkgdesc='Netfilter tables userspace tools'
-arch=('i686' 'x86_64')
-url='http://netfilter.org/projects/nftables/'
-license=('GPL2')
-depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
-makedepends=('docbook2x')
-backup=('etc/nftables.conf')
-validpgpkeys=('57FF5E9C9AA67A860B557AF7A4111F89BB5F58CC') # Netfilter Core Team
-source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
-        '001-fix-FS#47289.patch'
-        'nftables.conf'
-        'nftables.service'
-        'nftables-reload')
-sha1sums=('34cfe1daa33d7fd7087dd63199f64854dfb54064'
-          'SKIP'
-          '0e6df120039d71c4dbd6af36f38ab981926839e8'
-          'a7146fad414f9e827e2e83b630308890c876b80d'
-          '65833b9c5b777cfb3a0776060c569a727ce6f460'
-          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
-
-prepare() {
-  for _f in "${source[@]}"; do
-    [[ "$_f" =~ \.patch$ ]] && { msg2 "$_f"; patch -p1 -d $pkgname-$pkgver < "$_f"; }
-  done
-  :
-}
-
-build() {
-  cd $pkgname-$pkgver
-  ./configure \
-    --prefix=/usr \
-    --sbindir=/usr/bin \
-    --sysconfdir=/usr/share \
-    CONFIG_MAN=y DB2MAN=docbook2man
-  make
-}
-
-package() {
-  pushd $pkgname-$pkgver
-  make DESTDIR="$pkgdir" install
-  popd
-  # basic safe firewall config
-  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
-  # systemd
-  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
-  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
-}
-
-# vim:set ts=2 sw=2 et:

Copied: nftables/repos/extra-x86_64/PKGBUILD (from rev 269063, nftables/trunk/PKGBUILD)
===================================================================
--- extra-x86_64/PKGBUILD	                        (rev 0)
+++ extra-x86_64/PKGBUILD	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,60 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.6
+pkgrel=1
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='http://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+        'nftables.conf'
+        'nftables.service'
+        'nftables-reload')
+sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
+          'SKIP'
+          'a7146fad414f9e827e2e83b630308890c876b80d'
+          '65833b9c5b777cfb3a0776060c569a727ce6f460'
+          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+  cd $pkgname-$pkgver
+  # apply patch from the source array (should be a pacman feature)
+  local filename
+  for filename in "${source[@]}"; do
+    if [[ "$filename" =~ \.patch$ ]]; then
+      msg2 "Applying patch $filename"
+      patch -p1 -N -i "$srcdir/$filename"
+    fi
+  done
+  :
+}
+
+build() {
+  cd $pkgname-$pkgver
+  ./configure \
+    --prefix=/usr \
+    --sbindir=/usr/bin \
+    --sysconfdir=/usr/share \
+    CONFIG_MAN=y DB2MAN=docbook2man
+  make
+}
+
+package() {
+  pushd $pkgname-$pkgver
+  make DESTDIR="$pkgdir" install
+  popd
+  # basic safe firewall config
+  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+  # systemd
+  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:

Deleted: extra-x86_64/nftables-reload
===================================================================
--- extra-x86_64/nftables-reload	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-x86_64/nftables-reload	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,3 +0,0 @@
-#!/usr/bin/nft -f
-flush ruleset
-include "/etc/nftables.conf"

Copied: nftables/repos/extra-x86_64/nftables-reload (from rev 269063, nftables/trunk/nftables-reload)
===================================================================
--- extra-x86_64/nftables-reload	                        (rev 0)
+++ extra-x86_64/nftables-reload	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"

Deleted: extra-x86_64/nftables.conf
===================================================================
--- extra-x86_64/nftables.conf	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-x86_64/nftables.conf	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,38 +0,0 @@
-#!/usr/bin/nft -f
-# ipv4/ipv6 Simple & Safe Firewall
-# you can find examples in /usr/share/nftables/
-
-table inet filter {
-  chain input {
-    type filter hook input priority 0;
-
-    # allow established/related connections
-    ct state {established, related} accept
-
-    # early drop of invalid connections
-    ct state invalid drop
-
-    # allow from loopback
-    iifname lo accept
-
-    # allow icmp
-    ip protocol icmp accept
-    ip6 nexthdr icmpv6 accept
-
-    # allow ssh
-    tcp dport ssh accept
-
-    # everything else
-    reject with icmp type port-unreachable
-  }
-  chain forward {
-    type filter hook forward priority 0;
-    drop
-  }
-  chain output {
-    type filter hook output priority 0;
-  }
-
-}
-
-# vim:set ts=2 sw=2 et:

Copied: nftables/repos/extra-x86_64/nftables.conf (from rev 269063, nftables/trunk/nftables.conf)
===================================================================
--- extra-x86_64/nftables.conf	                        (rev 0)
+++ extra-x86_64/nftables.conf	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0;
+
+    # allow established/related connections
+    ct state {established, related} accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # everything else
+    reject with icmp type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0;
+    drop
+  }
+  chain output {
+    type filter hook output priority 0;
+  }
+
+}
+
+# vim:set ts=2 sw=2 et:

Deleted: extra-x86_64/nftables.service
===================================================================
--- extra-x86_64/nftables.service	2016-06-05 21:07:42 UTC (rev 269063)
+++ extra-x86_64/nftables.service	2016-06-05 21:11:58 UTC (rev 269064)
@@ -1,15 +0,0 @@
-[Unit]
-Description=Netfilter Tables
-Documentation=man:nft(8)
-Wants=network-pre.target
-Before=network-pre.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/nft -f /etc/nftables.conf
-ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
-ExecStop=/usr/bin/nft flush ruleset
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target

Copied: nftables/repos/extra-x86_64/nftables.service (from rev 269063, nftables/trunk/nftables.service)
===================================================================
--- extra-x86_64/nftables.service	                        (rev 0)
+++ extra-x86_64/nftables.service	2016-06-05 21:11:58 UTC (rev 269064)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target



More information about the arch-commits mailing list