summaryrefslogtreecommitdiff
path: root/user
diff options
context:
space:
mode:
authorMolly Miller <adelie@m-squa.red>2019-07-06 01:36:16 +0000
committerMolly Miller <adelie@m-squa.red>2019-07-06 01:36:16 +0000
commit57b7d813c73fdc7f3c3254e7107ffa045db12702 (patch)
tree5cb5cb16da7761bfc95923413290bc462c5afc18 /user
parent1428865cd0d40ead37696cd26ed9e2cf46845f32 (diff)
downloadpackages-57b7d813c73fdc7f3c3254e7107ffa045db12702.tar.gz
packages-57b7d813c73fdc7f3c3254e7107ffa045db12702.tar.bz2
packages-57b7d813c73fdc7f3c3254e7107ffa045db12702.tar.xz
packages-57b7d813c73fdc7f3c3254e7107ffa045db12702.zip
user/iptables: new package
There is some optional functionality available which requires further libraries (libmnl for the ability to work over nf_tables as opposed to the legacy ip{,6}_tables kernel module, libnetfilter_conntrack for connlabel matching), but these libraries aren't yet packaged.
Diffstat (limited to 'user')
-rw-r--r--user/iptables/APKBUILD66
-rw-r--r--user/iptables/ip6tables.confd14
-rw-r--r--user/iptables/iptables.confd14
-rw-r--r--user/iptables/iptables.initd136
4 files changed, 230 insertions, 0 deletions
diff --git a/user/iptables/APKBUILD b/user/iptables/APKBUILD
new file mode 100644
index 000000000..c9b8f4715
--- /dev/null
+++ b/user/iptables/APKBUILD
@@ -0,0 +1,66 @@
+# Contributor: Natanael Copa <ncopa@alpinelinux.org>
+# Maintainer: Molly Miller <adelie@m-squa.red>
+
+pkgname=iptables
+pkgver=1.8.3
+pkgrel=0
+pkgdesc="Linux kernel firewall, NAT and packet mangling tools"
+url="https://www.netfilter.org/projects/iptables/index.html"
+arch="all"
+options="!check" # no test suite
+license="GPL-2.0+"
+depends_dev="linux-headers"
+# extra functionality may be enabled in the future if libmnl and
+# libnetfilter_conntrack are packaged.
+makedepends="$depends_dev libnftnl-dev bison flex autoconf automake"
+subpackages="$pkgname-doc $pkgname-dev $pkgname-openrc"
+source="https://www.netfilter.org/projects/iptables/files/iptables-$pkgver.tar.bz2
+ iptables.initd
+ iptables.confd
+ ip6tables.confd
+ "
+
+build() {
+ export CFLAGS="$CFLAGS -D_GNU_SOURCE"
+ ./configure \
+ --build="$CBUILD" \
+ --host="$CHOST" \
+ --prefix=/usr \
+ --mandir=/usr/share/man \
+ --sbindir=/sbin \
+ --without-kernel \
+ --disable-nftables \
+ --enable-devel \
+ --enable-libipq \
+ --enable-shared
+
+ # do not use rpath - iptables seems to use old libtool which requires
+ # these hacks
+ sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
+ make
+}
+
+package() {
+ make -j1 install DESTDIR="$pkgdir"
+
+ mkdir -p "$pkgdir"/usr/include/libiptc \
+ "$pkgdir"/usr/lib \
+ "$pkgdir"/var/lib/iptables \
+ "$pkgdir"/etc/iptables
+
+ install -m644 include/iptables.h include/ip6tables.h \
+ "$pkgdir"/usr/include/
+ install include/libiptc/*.h "$pkgdir"/usr/include/libiptc/
+
+ install -D -m755 "$srcdir"/iptables.initd "$pkgdir"/etc/init.d/iptables
+ install -D -m755 "$srcdir"/iptables.initd "$pkgdir"/etc/init.d/ip6tables
+ install -D -m644 "$srcdir"/iptables.confd "$pkgdir"/etc/conf.d/iptables
+ install -D -m644 "$srcdir"/ip6tables.confd "$pkgdir"/etc/conf.d/ip6tables
+}
+
+sha512sums="84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d iptables-1.8.3.tar.bz2
+059b3bd8dd7dec60060ec5eb1e639fe8203207629f3a7dd4fdbe5ebca3f7e9b80df5592ebb27542e31830fd15a53cffac5772567053c104dfccf9b78613a31a1 iptables.initd
+cb7fecd5cab2c78bd3f215a41f39ec11c37eb360efbe83982378a0e647e0aa9dc0b7ec915a5b5081aa2f7747464787e69404aa15ba15a063c32cb8fb7dd13d1e iptables.confd
+0897a7a22f8b700f7f1f5c355ad6cbf39740e44d6c962af99e479978d8a2d556ca7fe4e31f238829046b4a871ce0b5fd52e2544f1361d15dd1ea3e33992646c4 ip6tables.confd"
diff --git a/user/iptables/ip6tables.confd b/user/iptables/ip6tables.confd
new file mode 100644
index 000000000..1fa63f33a
--- /dev/null
+++ b/user/iptables/ip6tables.confd
@@ -0,0 +1,14 @@
+# /etc/conf.d/ip6tables
+
+# Location in which ip6tables initscript will save set rules on
+# service shutdown
+IP6TABLES_SAVE="/etc/iptables/rules6-save"
+
+# Options to pass to ip6tables-save and ip6tables-restore
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# Enable/disable IPv6 forwarding with the rules
+IPFORWARD="no"
diff --git a/user/iptables/iptables.confd b/user/iptables/iptables.confd
new file mode 100644
index 000000000..c9e5a685c
--- /dev/null
+++ b/user/iptables/iptables.confd
@@ -0,0 +1,14 @@
+# /etc/conf.d/iptables
+
+# Location in which iptables initscript will save set rules on
+# service shutdown
+IPTABLES_SAVE="/etc/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# Enable/disable IPv4 forwarding with the rules
+IPFORWARD="no"
diff --git a/user/iptables/iptables.initd b/user/iptables/iptables.initd
new file mode 100644
index 000000000..98b52d0cd
--- /dev/null
+++ b/user/iptables/iptables.initd
@@ -0,0 +1,136 @@
+#!/sbin/openrc-run
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $
+
+description="IPv4/IPv6 packet filtering and NAT"
+description_save="Save firewall state"
+description_panic="Drop all packets"
+description_reload="Reload configuration"
+
+extra_commands="save panic"
+extra_started_commands="reload"
+
+iptables_name=${SVCNAME}
+if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then
+ iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+ iptables) iptables_proc="/proc/net/ip_tables_names"
+ iptables_save=${IPTABLES_SAVE}
+ sysctl_ipfwd=net.ipv4.ip_forward;;
+ ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+ iptables_save=${IP6TABLES_SAVE}
+ sysctl_ipfwd=net.ipv6.conf.all.forwarding;;
+esac
+
+depend() {
+ before net
+ after sysctl
+ use logger
+ provide firewall
+}
+
+set_table_policy() {
+ local chains table=$1 policy=$2
+ case ${table} in
+ nat) chains="PREROUTING POSTROUTING OUTPUT";;
+ mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+ filter) chains="INPUT FORWARD OUTPUT";;
+ *) chains="";;
+ esac
+ local chain
+ for chain in ${chains} ; do
+ ${iptables_bin} -t ${table} -P ${chain} ${policy}
+ done
+}
+
+checkkernel() {
+ if [ ! -e ${iptables_proc} ] ; then
+ eerror "Your kernel lacks ${iptables_name} support, please load"
+ eerror "appropriate modules and try again."
+ return 1
+ fi
+ return 0
+}
+checkconfig() {
+ if [ ! -f ${iptables_save} ] ; then
+ eerror "Not starting ${iptables_name}. First create some rules then run:"
+ eerror "/etc/init.d/${iptables_name} save"
+ return 1
+ fi
+ return 0
+}
+
+start() {
+ checkconfig || return 1
+ ebegin "Loading ${iptables_name} state and starting firewall"
+ ${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+ eend $?
+ if yesno "${IPFORWARD}"; then
+ ebegin "Enabling forwarding"
+ /sbin/sysctl -w ${sysctl_ipfwd}=1 > /dev/null
+ eend $?
+ fi
+}
+
+stop() {
+ if yesno "${IPFORWARD}"; then
+ ebegin "Disabling forwarding"
+ /sbin/sysctl -w ${sysctl_ipfwd}=0 > /dev/null
+ eend $?
+ fi
+ if yesno "${SAVE_ON_STOP}"; then
+ save || return 1
+ fi
+ checkkernel || return 1
+ ebegin "Stopping firewall"
+ local a
+ for a in $(cat ${iptables_proc}) ; do
+ set_table_policy $a ACCEPT
+
+ ${iptables_bin} -F -t $a
+ ${iptables_bin} -X -t $a
+ done
+ eend $?
+}
+
+reload() {
+ checkkernel || return 1
+ ebegin "Flushing firewall"
+ local a
+ for a in $(cat ${iptables_proc}) ; do
+ ${iptables_bin} -F -t $a
+ ${iptables_bin} -X -t $a
+ done
+ eend $?
+
+ start
+}
+
+save() {
+ ebegin "Saving ${iptables_name} state"
+ touch "${iptables_save}"
+ chmod 0600 "${iptables_save}"
+ ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+ eend $?
+}
+
+panic() {
+ checkkernel || return 1
+ if service_started ${iptables_name}; then
+ rc-service ${iptables_name} stop
+ fi
+
+ local a
+ ebegin "Dropping all packets"
+ for a in $(cat ${iptables_proc}) ; do
+ ${iptables_bin} -F -t $a
+ ${iptables_bin} -X -t $a
+
+ set_table_policy $a DROP
+ done
+ eend $?
+}