[arch-commits] Commit in iptables/trunk (7 files)
Jan Steffens
heftig at archlinux.org
Tue Nov 6 20:04:24 UTC 2018
Date: Tuesday, November 6, 2018 @ 20:04:23
Author: heftig
Revision: 337996
1.8.1-4: overhaul, add iptables-nft
Added:
iptables/trunk/arptables.service
iptables/trunk/ebtables.service
iptables/trunk/iptables-legacy-flush
(from rev 337995, iptables/trunk/iptables-flush)
iptables/trunk/iptables-nft-flush
(from rev 337917, iptables/trunk/iptables-flush)
Modified:
iptables/trunk/PKGBUILD (contents, properties)
iptables/trunk/iptables.service
Deleted:
iptables/trunk/iptables-flush
-----------------------+
PKGBUILD | 98 ++++++++++++++++++++++++++----------------------
arptables.service | 14 ++++++
ebtables.service | 14 ++++++
iptables-flush | 18 --------
iptables-legacy-flush | 18 ++++++++
iptables-nft-flush | 18 ++++++++
iptables.service | 2
7 files changed, 120 insertions(+), 62 deletions(-)
Modified: PKGBUILD
===================================================================
--- PKGBUILD 2018-11-06 19:24:58 UTC (rev 337995)
+++ PKGBUILD 2018-11-06 20:04:23 UTC (rev 337996)
@@ -1,27 +1,21 @@
# Maintainer: Ronald van Haren <ronald.archlinux.org>
# Contributor: Thomas Baechler <thomas at archlinux.org>
-pkgname=iptables
+pkgbase=iptables
+pkgname=(iptables iptables-nft)
pkgver=1.8.1
-pkgrel=3
+pkgrel=4
epoch=1
pkgdesc='Linux kernel packet control tool'
arch=(x86_64)
license=(GPL2)
-url='http://www.netfilter.org/projects/iptables/index.html'
-depends=(glibc bash libnftnl libpcap)
+url='https://www.netfilter.org/projects/iptables/index.html'
+depends=(libnftnl libpcap libnfnetlink libnetfilter_conntrack bash)
makedepends=(linux-api-headers)
-source=(http://www.netfilter.org/projects/iptables/files/${pkgname}-${pkgver}.tar.bz2{,.sig}
- empty.rules
- simple_firewall.rules
- empty-filter.rules
- empty-mangle.rules
- empty-nat.rules
- empty-raw.rules
- empty-security.rules
- iptables.service
- ip6tables.service
- iptables-flush)
+backup=(etc/ethertypes etc/iptables/{ip,ip6}tables.rules)
+source=(https://www.netfilter.org/projects/iptables/files/$pkgbase-$pkgver.tar.bz2{,.sig}
+ empty.rules simple_firewall.rules empty-{filter,mangle,nat,raw,security}.rules
+ {arp,eb,ip,ip6}tables.service iptables-{legacy,nft}-flush)
sha1sums=('3ce489b6945c52ef35fe8c0da38144dd38694e36'
'SKIP'
'83b3363878e3660ce23b2ad325b53cbd6c796ecf'
@@ -31,13 +25,17 @@
'1694d79b3e6e9d9d543f6a6e75fed06066c9a6c6'
'7db53bb882f62f6c677cc8559cff83d8bae2ef73'
'ebbd1424a1564fd45f455a81c61ce348f0a14c2e'
- '49be9443fc302dd0fda78b63d64e884cadb61603'
+ '95b0ee26f03132a948fea9f2136b2e2e6a4b40fe'
+ 'b668ba50d55030c68431a95756bc1f291d74b2b2'
+ '8d66d21fa4cbfe2a80478301af94ba54f65e4ea0'
'9cec592787e32451f58fa608ea057870e07aa704'
- 'e7abda09c61142121b6695928d3b71ccd8fdf73a')
+ 'd10af7780d1634778d898c709e2d950aa1561856'
+ '15c1684f3e671f4d0ede639a7c9c08e1a841511c')
validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
prepare() {
- cd $pkgname-$pkgver
+ mkdir build
+ cd $pkgbase-$pkgver
# use system one
rm include/linux/types.h
@@ -44,42 +42,56 @@
}
build() {
- cd $pkgname-$pkgver
-
- ./configure --prefix=/usr \
+ cd build
+ ../$pkgbase-$pkgver/configure \
+ --prefix=/usr \
--sysconfdir=/etc \
--sbindir=/usr/bin \
- --libexecdir=/usr/lib/iptables \
- --with-xtlibdir=/usr/lib/iptables \
+ --libexecdir=/usr/lib \
--enable-bpf-compiler \
--enable-devel \
+ --enable-libipq \
--enable-shared
-
+ sed -e 's/ -shared / -Wl,-O1,--as-needed\0/g' -i libtool
make
}
-package() {
- cd $pkgname-$pkgver
- make DESTDIR="$pkgdir" install
+package_iptables() {
+ pkgdesc+=' (using legacy interface)'
+ _package legacy
+}
- cd "$srcdir"
- install -Dm644 empty.rules "${pkgdir}"/etc/iptables/empty.rules
- install -Dm644 simple_firewall.rules "${pkgdir}"/etc/iptables/simple_firewall.rules
+package_iptables-nft() {
+ pkgdesc+=' (using nft interface)'
+ depends+=(nftables)
+ provides=(iptables arptables ebtables)
+ conflicts=(iptables arptables ebtables)
+ backup+=(etc/{arp,eb}tables.conf)
- install -d "$pkgdir"/var/lib/{iptables,ip6tables}
- install -m644 empty-{filter,mangle,nat,raw,security}.rules "${pkgdir}"/var/lib/iptables
- install -m644 empty-{filter,mangle,nat,raw,security}.rules "${pkgdir}"/var/lib/ip6tables
+ _package nft
- # iptables 1.8.0 claims compatibility with ebtables and arptables but it's not
- # really true according to users: https://bugs.archlinux.org/task/60062
- rm "$pkgdir"/usr/bin/{arp,eb}tables{,-restore,-save}
+ install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {arp,eb}tables.service
+ touch "$pkgdir"/etc/{arp,eb}tables.conf
+}
- # install systemd files
- install -Dm644 iptables.service \
- "$pkgdir/usr/lib/systemd/system/iptables.service"
- install -Dm644 ip6tables.service \
- "$pkgdir/usr/lib/systemd/system/ip6tables.service"
- install -Dm755 iptables-flush \
- "$pkgdir/usr/lib/systemd/scripts/iptables-flush"
+_package() {
+ DESTDIR="$pkgdir" make -C build install
+
+ for _x in {arp,eb,ip,ip6}tables{,-restore,-save} iptables-xml; do
+ if [[ $1 = nft || $_x = ip* ]]; then
+ ln -sf xtables-$1-multi "$pkgdir/usr/bin/$_x"
+ else
+ rm "$pkgdir/usr/bin/$_x"
+ fi
+ done
+
+ install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {ip,ip6}tables.service
+ install -D iptables-$1-flush "$pkgdir/usr/lib/systemd/scripts/iptables-flush"
+
+ install -Dm644 empty.rules "$pkgdir/etc/iptables/iptables.rules"
+ install -Dm644 empty.rules "$pkgdir/etc/iptables/ip6tables.rules"
+ install -Dt "$pkgdir/usr/share/iptables" -m644 *.rules
+ ln -srt "$pkgdir/etc/iptables" "$pkgdir"/usr/share/iptables/{empty,simple_firewall}.rules
}
+# vim:set sw=2 et:
Property changes on: iptables/trunk/PKGBUILD
___________________________________________________________________
Deleted: svn:keywords
## -1 +0,0 ##
-Id
\ No newline at end of property
Added: arptables.service
===================================================================
--- arptables.service (rev 0)
+++ arptables.service 2018-11-06 20:04:23 UTC (rev 337996)
@@ -0,0 +1,14 @@
+[Unit]
+Description=ARP table
+Before=network-pre.target
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'arptables-restore < /etc/arptables.conf'
+ExecReload=/bin/sh -c 'arptables-restore < /etc/arptables.conf'
+ExecStop=/bin/sh -c 'arptables-restore < /dev/null'
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
Added: ebtables.service
===================================================================
--- ebtables.service (rev 0)
+++ ebtables.service 2018-11-06 20:04:23 UTC (rev 337996)
@@ -0,0 +1,14 @@
+[Unit]
+Description=Ethernet bridge table
+Before=network-pre.target
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c 'ebtables-restore < /etc/ebtables.conf'
+ExecReload=/bin/sh -c 'ebtables-restore < /etc/ebtables.conf'
+ExecStop=/bin/sh -c 'ebtables-restore < /dev/null'
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
Deleted: iptables-flush
===================================================================
--- iptables-flush 2018-11-06 19:24:58 UTC (rev 337995)
+++ iptables-flush 2018-11-06 20:04:23 UTC (rev 337996)
@@ -1,18 +0,0 @@
-#!/bin/bash
-#
-# Usage: iptables-flush [6]
-#
-
-iptables=ip$1tables
-if ! type -p "$iptables"; then
- echo "error: invalid argument"
- exit 1
-fi
-
-while read -r table; do
- tables+=("/var/lib/$iptables/empty-$table.rules")
-done <"/proc/net/ip$1_tables_names"
-
-if (( ${#tables[*]} )); then
- cat "${tables[@]}" | "$iptables-restore"
-fi
Copied: iptables/trunk/iptables-legacy-flush (from rev 337995, iptables/trunk/iptables-flush)
===================================================================
--- iptables-legacy-flush (rev 0)
+++ iptables-legacy-flush 2018-11-06 20:04:23 UTC (rev 337996)
@@ -0,0 +1,18 @@
+#!/bin/bash
+#
+# Usage: iptables-flush [6]
+#
+
+iptables=ip$1tables
+if ! type -p "$iptables" &>/dev/null; then
+ echo "error: invalid argument"
+ exit 1
+fi
+
+while read -r table; do
+ tables+=("/usr/share/iptables/empty-$table.rules")
+done <"/proc/net/ip$1_tables_names"
+
+if (( ${#tables[*]} )); then
+ cat "${tables[@]}" | "$iptables-restore"
+fi
Copied: iptables/trunk/iptables-nft-flush (from rev 337917, iptables/trunk/iptables-flush)
===================================================================
--- iptables-nft-flush (rev 0)
+++ iptables-nft-flush 2018-11-06 20:04:23 UTC (rev 337996)
@@ -0,0 +1,18 @@
+#!/bin/bash
+#
+# Usage: iptables-flush [6]
+#
+
+iptables=ip$1tables
+if ! type -p "$iptables" &>/dev/null; then
+ echo "error: invalid argument"
+ exit 1
+fi
+
+while read -r table; do
+ tables+=("/usr/share/iptables/empty-$table.rules")
+done < <(nft list tables | sed -n "s/table ip$1 //p")
+
+if (( ${#tables[*]} )); then
+ cat "${tables[@]}" | "$iptables-restore"
+fi
Modified: iptables.service
===================================================================
--- iptables.service 2018-11-06 19:24:58 UTC (rev 337995)
+++ iptables.service 2018-11-06 20:04:23 UTC (rev 337996)
@@ -1,5 +1,5 @@
[Unit]
-Description=Packet Filtering Framework
+Description=IPv4 Packet Filtering Framework
Before=network-pre.target
Wants=network-pre.target
More information about the arch-commits
mailing list