From 57b7d813c73fdc7f3c3254e7107ffa045db12702 Mon Sep 17 00:00:00 2001 From: Molly Miller Date: Sat, 6 Jul 2019 01:36:16 +0000 Subject: user/iptables: new package There is some optional functionality available which requires further libraries (libmnl for the ability to work over nf_tables as opposed to the legacy ip{,6}_tables kernel module, libnetfilter_conntrack for connlabel matching), but these libraries aren't yet packaged. --- user/iptables/APKBUILD | 66 ++++++++++++++++++++ user/iptables/ip6tables.confd | 14 +++++ user/iptables/iptables.confd | 14 +++++ user/iptables/iptables.initd | 136 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 230 insertions(+) create mode 100644 user/iptables/APKBUILD create mode 100644 user/iptables/ip6tables.confd create mode 100644 user/iptables/iptables.confd create mode 100644 user/iptables/iptables.initd diff --git a/user/iptables/APKBUILD b/user/iptables/APKBUILD new file mode 100644 index 000000000..c9b8f4715 --- /dev/null +++ b/user/iptables/APKBUILD @@ -0,0 +1,66 @@ +# Contributor: Natanael Copa +# Maintainer: Molly Miller + +pkgname=iptables +pkgver=1.8.3 +pkgrel=0 +pkgdesc="Linux kernel firewall, NAT and packet mangling tools" +url="https://www.netfilter.org/projects/iptables/index.html" +arch="all" +options="!check" # no test suite +license="GPL-2.0+" +depends_dev="linux-headers" +# extra functionality may be enabled in the future if libmnl and +# libnetfilter_conntrack are packaged. +makedepends="$depends_dev libnftnl-dev bison flex autoconf automake" +subpackages="$pkgname-doc $pkgname-dev $pkgname-openrc" +source="https://www.netfilter.org/projects/iptables/files/iptables-$pkgver.tar.bz2 + iptables.initd + iptables.confd + ip6tables.confd + " + +build() { + export CFLAGS="$CFLAGS -D_GNU_SOURCE" + ./configure \ + --build="$CBUILD" \ + --host="$CHOST" \ + --prefix=/usr \ + --mandir=/usr/share/man \ + --sbindir=/sbin \ + --without-kernel \ + --disable-nftables \ + --enable-devel \ + --enable-libipq \ + --enable-shared + + # do not use rpath - iptables seems to use old libtool which requires + # these hacks + sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool + sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + + make +} + +package() { + make -j1 install DESTDIR="$pkgdir" + + mkdir -p "$pkgdir"/usr/include/libiptc \ + "$pkgdir"/usr/lib \ + "$pkgdir"/var/lib/iptables \ + "$pkgdir"/etc/iptables + + install -m644 include/iptables.h include/ip6tables.h \ + "$pkgdir"/usr/include/ + install include/libiptc/*.h "$pkgdir"/usr/include/libiptc/ + + install -D -m755 "$srcdir"/iptables.initd "$pkgdir"/etc/init.d/iptables + install -D -m755 "$srcdir"/iptables.initd "$pkgdir"/etc/init.d/ip6tables + install -D -m644 "$srcdir"/iptables.confd "$pkgdir"/etc/conf.d/iptables + install -D -m644 "$srcdir"/ip6tables.confd "$pkgdir"/etc/conf.d/ip6tables +} + +sha512sums="84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d iptables-1.8.3.tar.bz2 +059b3bd8dd7dec60060ec5eb1e639fe8203207629f3a7dd4fdbe5ebca3f7e9b80df5592ebb27542e31830fd15a53cffac5772567053c104dfccf9b78613a31a1 iptables.initd +cb7fecd5cab2c78bd3f215a41f39ec11c37eb360efbe83982378a0e647e0aa9dc0b7ec915a5b5081aa2f7747464787e69404aa15ba15a063c32cb8fb7dd13d1e iptables.confd +0897a7a22f8b700f7f1f5c355ad6cbf39740e44d6c962af99e479978d8a2d556ca7fe4e31f238829046b4a871ce0b5fd52e2544f1361d15dd1ea3e33992646c4 ip6tables.confd" diff --git a/user/iptables/ip6tables.confd b/user/iptables/ip6tables.confd new file mode 100644 index 000000000..1fa63f33a --- /dev/null +++ b/user/iptables/ip6tables.confd @@ -0,0 +1,14 @@ +# /etc/conf.d/ip6tables + +# Location in which ip6tables initscript will save set rules on +# service shutdown +IP6TABLES_SAVE="/etc/iptables/rules6-save" + +# Options to pass to ip6tables-save and ip6tables-restore +SAVE_RESTORE_OPTIONS="-c" + +# Save state on stopping iptables +SAVE_ON_STOP="yes" + +# Enable/disable IPv6 forwarding with the rules +IPFORWARD="no" diff --git a/user/iptables/iptables.confd b/user/iptables/iptables.confd new file mode 100644 index 000000000..c9e5a685c --- /dev/null +++ b/user/iptables/iptables.confd @@ -0,0 +1,14 @@ +# /etc/conf.d/iptables + +# Location in which iptables initscript will save set rules on +# service shutdown +IPTABLES_SAVE="/etc/iptables/rules-save" + +# Options to pass to iptables-save and iptables-restore +SAVE_RESTORE_OPTIONS="-c" + +# Save state on stopping iptables +SAVE_ON_STOP="yes" + +# Enable/disable IPv4 forwarding with the rules +IPFORWARD="no" diff --git a/user/iptables/iptables.initd b/user/iptables/iptables.initd new file mode 100644 index 000000000..98b52d0cd --- /dev/null +++ b/user/iptables/iptables.initd @@ -0,0 +1,136 @@ +#!/sbin/openrc-run +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $ + +description="IPv4/IPv6 packet filtering and NAT" +description_save="Save firewall state" +description_panic="Drop all packets" +description_reload="Reload configuration" + +extra_commands="save panic" +extra_started_commands="reload" + +iptables_name=${SVCNAME} +if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then + iptables_name="iptables" +fi + +iptables_bin="/sbin/${iptables_name}" +case ${iptables_name} in + iptables) iptables_proc="/proc/net/ip_tables_names" + iptables_save=${IPTABLES_SAVE} + sysctl_ipfwd=net.ipv4.ip_forward;; + ip6tables) iptables_proc="/proc/net/ip6_tables_names" + iptables_save=${IP6TABLES_SAVE} + sysctl_ipfwd=net.ipv6.conf.all.forwarding;; +esac + +depend() { + before net + after sysctl + use logger + provide firewall +} + +set_table_policy() { + local chains table=$1 policy=$2 + case ${table} in + nat) chains="PREROUTING POSTROUTING OUTPUT";; + mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";; + filter) chains="INPUT FORWARD OUTPUT";; + *) chains="";; + esac + local chain + for chain in ${chains} ; do + ${iptables_bin} -t ${table} -P ${chain} ${policy} + done +} + +checkkernel() { + if [ ! -e ${iptables_proc} ] ; then + eerror "Your kernel lacks ${iptables_name} support, please load" + eerror "appropriate modules and try again." + return 1 + fi + return 0 +} +checkconfig() { + if [ ! -f ${iptables_save} ] ; then + eerror "Not starting ${iptables_name}. First create some rules then run:" + eerror "/etc/init.d/${iptables_name} save" + return 1 + fi + return 0 +} + +start() { + checkconfig || return 1 + ebegin "Loading ${iptables_name} state and starting firewall" + ${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}" + eend $? + if yesno "${IPFORWARD}"; then + ebegin "Enabling forwarding" + /sbin/sysctl -w ${sysctl_ipfwd}=1 > /dev/null + eend $? + fi +} + +stop() { + if yesno "${IPFORWARD}"; then + ebegin "Disabling forwarding" + /sbin/sysctl -w ${sysctl_ipfwd}=0 > /dev/null + eend $? + fi + if yesno "${SAVE_ON_STOP}"; then + save || return 1 + fi + checkkernel || return 1 + ebegin "Stopping firewall" + local a + for a in $(cat ${iptables_proc}) ; do + set_table_policy $a ACCEPT + + ${iptables_bin} -F -t $a + ${iptables_bin} -X -t $a + done + eend $? +} + +reload() { + checkkernel || return 1 + ebegin "Flushing firewall" + local a + for a in $(cat ${iptables_proc}) ; do + ${iptables_bin} -F -t $a + ${iptables_bin} -X -t $a + done + eend $? + + start +} + +save() { + ebegin "Saving ${iptables_name} state" + touch "${iptables_save}" + chmod 0600 "${iptables_save}" + ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}" + eend $? +} + +panic() { + checkkernel || return 1 + if service_started ${iptables_name}; then + rc-service ${iptables_name} stop + fi + + local a + ebegin "Dropping all packets" + for a in $(cat ${iptables_proc}) ; do + ${iptables_bin} -F -t $a + ${iptables_bin} -X -t $a + + set_table_policy $a DROP + done + eend $? +} -- cgit v1.2.3-70-g09d2