Gentoo Archives: gentoo-commits

From: Lars Wendler <polynomial-c@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: net-firewall/iptables/files/, net-firewall/iptables/
Date: Tue, 20 Nov 2018 14:23:10
Message-Id: 1542723775.7ed84d5b5c472c3251c4acb752d9fed6880bf973.polynomial-c@gentoo
1 commit: 7ed84d5b5c472c3251c4acb752d9fed6880bf973
2 Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
3 AuthorDate: Tue Nov 20 14:21:32 2018 +0000
4 Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
5 CommitDate: Tue Nov 20 14:22:55 2018 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7ed84d5b
7
8 Revert "net-firewall/iptables: Removed old."
9
10 This reverts commit 070fae35cc6d85cdb9c35b92b476394e17c8c144.
11
12 Signed-off-by: Lars Wendler <polynomial-c <AT> gentoo.org>
13
14 net-firewall/iptables/Manifest | 1 +
15 .../iptables/files/iptables-1.4.21-configure.patch | 34 +++++++
16 .../iptables-1.4.21-static-connlabel-config.patch | 77 +++++++++++++++
17 net-firewall/iptables/iptables-1.4.21-r1.ebuild | 93 ++++++++++++++++++
18 net-firewall/iptables/iptables-1.4.21-r5.ebuild | 104 +++++++++++++++++++++
19 5 files changed, 309 insertions(+)
20
21 diff --git a/net-firewall/iptables/Manifest b/net-firewall/iptables/Manifest
22 index 2d94c7883a8..8808dd33a3a 100644
23 --- a/net-firewall/iptables/Manifest
24 +++ b/net-firewall/iptables/Manifest
25 @@ -1,3 +1,4 @@
26 +DIST iptables-1.4.21.tar.bz2 547439 BLAKE2B e30f25581a118b91781dcc02761d4c8c420fb19876ec9e8ade3aff22b574931065f9a1c1ec31983a444c406dd928c47673d02698553da85c3db4f31484b1597d SHA512 dd4baccdb080284d8620e6ed59beafc2677813f3e099051764b07f8e394f6d94ca11861b181f3cce7c55c66de64c1e2add13dc1a0b64e24050cd9fb7aea0689b
27 DIST iptables-1.6.1.tar.bz2 620890 BLAKE2B b45ac26e1fb7e8b17a6df0afab3b6c0e2f0a5df9191367548136b3ce9aadc1bcb875b8bc0403e6f12fcf487054e96418f4ef34da827af8989fd4dcf83cd3cd8d SHA512 12280db6e6ef8e68da2537e9da59fc601790fd02b1ba38a37c90dbb56272018329dccb8be995f96ecd5d94fafa6043204f3e8f8ee96531685d9e3c55359d2ee8
28 DIST iptables-1.6.2.tar.bz2 639785 BLAKE2B 3d129756fd33c8c73d56d57e3c5595896db86ded14834a45db21b964d82840b62216ce3cea4ae4960e8c5f0671df3cc6bfb222f68d29cf3a8c99e0eee14bf017 SHA512 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
29 DIST iptables-1.8.1.tar.bz2 678706 BLAKE2B 671e7329cc07dae0fbc54c1f6061bc148c4823e1f675369ee36a7cd2346cc1a9a516d5aa2e8a3506d5400027c1ba306cbe426940894117710bc61aacd256fccd SHA512 96a896b6dd26c2d0b4e1672d428ea3c3aab0a3c9e56a896af3a2b8428c4212d7378ba555e0be198b0ccb3fd370bca529466ab8b4edc1777eb7deed600d3f0e11
30
31 diff --git a/net-firewall/iptables/files/iptables-1.4.21-configure.patch b/net-firewall/iptables/files/iptables-1.4.21-configure.patch
32 new file mode 100644
33 index 00000000000..e827885f168
34 --- /dev/null
35 +++ b/net-firewall/iptables/files/iptables-1.4.21-configure.patch
36 @@ -0,0 +1,34 @@
37 +https://bugs.gentoo.org/557586
38 +
39 +From b24e59fba39120bfdb9e521bbd0af8f33a60466e Mon Sep 17 00:00:00 2001
40 +From: Mike Frysinger <vapier@g.o>
41 +Date: Sat, 15 Aug 2015 14:12:39 -0400
42 +Subject: [PATCH] configure: fix 3rd arg w/AC_ARG_ENABLE
43 +
44 +The 3rd arg is used when --{enable,disable}-foo are passed in, not when
45 +the feature is enabled. Use the existing $enableval instead.
46 +
47 +Signed-off-by: Mike Frysinger <vapier@g.o>
48 +---
49 + configure.ac | 4 ++--
50 + 1 file changed, 2 insertions(+), 2 deletions(-)
51 +
52 +--- a/configure
53 ++++ b/configure
54 +@@ -11898,14 +11898,14 @@ fi
55 +
56 + # Check whether --enable-bpf-compiler was given.
57 + if test "${enable_bpf_compiler+set}" = set; then :
58 +- enableval=$enable_bpf_compiler; enable_bpfc="yes"
59 ++ enableval=$enable_bpf_compiler; enable_bpfc="$enableval"
60 + else
61 + enable_bpfc="no"
62 + fi
63 +
64 + # Check whether --enable-nfsynproxy was given.
65 + if test "${enable_nfsynproxy+set}" = set; then :
66 +- enableval=$enable_nfsynproxy; enable_nfsynproxy="yes"
67 ++ enableval=$enable_nfsynproxy; enable_nfsynproxy="$enableval"
68 + else
69 + enable_nfsynproxy="no"
70 + fi
71
72 diff --git a/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch b/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch
73 new file mode 100644
74 index 00000000000..a4183d6d402
75 --- /dev/null
76 +++ b/net-firewall/iptables/files/iptables-1.4.21-static-connlabel-config.patch
77 @@ -0,0 +1,77 @@
78 +https://bugs.gentoo.org/558234
79 +http://git.netfilter.org/iptables/commit/?id=825fbda5482a7d5ec5a6619c81fe07ff865c7d6e
80 +
81 +From 825fbda5482a7d5ec5a6619c81fe07ff865c7d6e Mon Sep 17 00:00:00 2001
82 +From: Florian Westphal <fw@××××××.de>
83 +Date: Fri, 5 Sep 2014 20:45:56 +0200
84 +Subject: [PATCH] extensions: libxt_connlabel: do not open config file from
85 + _init hook
86 +
87 +else, static builds will print this for every iptables invocation,
88 +even 'iptables -L'. Delay open until we need to translate a mapping.
89 +
90 +Reported-by: Thomas De Schampheleire <patrickdepinguin@×××××.com>
91 +Signed-off-by: Florian Westphal <fw@××××××.de>
92 +---
93 + extensions/libxt_connlabel.c | 27 ++++++++++++++++++++-------
94 + 1 file changed, 20 insertions(+), 7 deletions(-)
95 +
96 +diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
97 +index c84a167..1f83095 100644
98 +--- a/extensions/libxt_connlabel.c
99 ++++ b/extensions/libxt_connlabel.c
100 +@@ -29,11 +29,26 @@ static const struct xt_option_entry connlabel_mt_opts[] = {
101 + XTOPT_TABLEEND,
102 + };
103 +
104 ++/* cannot do this via _init, else static builds might spew error message
105 ++ * for every iptables invocation.
106 ++ */
107 ++static void connlabel_open(void)
108 ++{
109 ++ if (map)
110 ++ return;
111 ++
112 ++ map = nfct_labelmap_new(NULL);
113 ++ if (!map && errno)
114 ++ xtables_error(RESOURCE_PROBLEM, "cannot open connlabel.conf: %s\n",
115 ++ strerror(errno));
116 ++}
117 ++
118 + static void connlabel_mt_parse(struct xt_option_call *cb)
119 + {
120 + struct xt_connlabel_mtinfo *info = cb->data;
121 + int tmp;
122 +
123 ++ connlabel_open();
124 + xtables_option_parse(cb);
125 +
126 + switch (cb->entry->id) {
127 +@@ -54,7 +69,11 @@ static void connlabel_mt_parse(struct xt_option_call *cb)
128 +
129 + static const char *connlabel_get_name(int b)
130 + {
131 +- const char *name = nfct_labelmap_get_name(map, b);
132 ++ const char *name;
133 ++
134 ++ connlabel_open();
135 ++
136 ++ name = nfct_labelmap_get_name(map, b);
137 + if (name && strcmp(name, ""))
138 + return name;
139 + return NULL;
140 +@@ -114,11 +133,5 @@ static struct xtables_match connlabel_mt_reg = {
141 +
142 + void _init(void)
143 + {
144 +- map = nfct_labelmap_new(NULL);
145 +- if (!map) {
146 +- fprintf(stderr, "cannot open connlabel.conf, not registering '%s' match: %s\n",
147 +- connlabel_mt_reg.name, strerror(errno));
148 +- return;
149 +- }
150 + xtables_register_match(&connlabel_mt_reg);
151 + }
152 +--
153 +2.4.4
154 +
155
156 diff --git a/net-firewall/iptables/iptables-1.4.21-r1.ebuild b/net-firewall/iptables/iptables-1.4.21-r1.ebuild
157 new file mode 100644
158 index 00000000000..47f4a175748
159 --- /dev/null
160 +++ b/net-firewall/iptables/iptables-1.4.21-r1.ebuild
161 @@ -0,0 +1,93 @@
162 +# Copyright 1999-2018 Gentoo Foundation
163 +# Distributed under the terms of the GNU General Public License v2
164 +
165 +EAPI="5"
166 +
167 +# Force users doing their own patches to install their own tools
168 +AUTOTOOLS_AUTO_DEPEND=no
169 +
170 +inherit eutils multilib systemd toolchain-funcs autotools
171 +
172 +DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
173 +HOMEPAGE="https://www.netfilter.org/projects/iptables/"
174 +SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
175 +
176 +LICENSE="GPL-2"
177 +SLOT="0"
178 +KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
179 +IUSE="conntrack ipv6 netlink static-libs"
180 +
181 +RDEPEND="
182 + conntrack? ( net-libs/libnetfilter_conntrack )
183 + netlink? ( net-libs/libnfnetlink )
184 +"
185 +DEPEND="${RDEPEND}
186 + virtual/os-headers
187 + virtual/pkgconfig
188 +"
189 +
190 +src_prepare() {
191 + # use the saner headers from the kernel
192 + rm -f include/linux/{kernel,types}.h
193 +
194 + # Only run autotools if user patched something
195 + epatch_user && eautoreconf || elibtoolize
196 +}
197 +
198 +src_configure() {
199 + # Some libs use $(AR) rather than libtool to build #444282
200 + tc-export AR
201 +
202 + sed -i \
203 + -e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
204 + -e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
205 + configure || die
206 +
207 + econf \
208 + --sbindir="${EPREFIX}/sbin" \
209 + --libexecdir="${EPREFIX}/$(get_libdir)" \
210 + --enable-devel \
211 + --enable-shared \
212 + $(use_enable static-libs static) \
213 + $(use_enable ipv6)
214 +}
215 +
216 +src_compile() {
217 + emake V=1
218 +}
219 +
220 +src_install() {
221 + default
222 + dodoc INCOMPATIBILITIES iptables/iptables.xslt
223 +
224 + # all the iptables binaries are in /sbin, so might as well
225 + # put these small files in with them
226 + into /
227 + dosbin iptables/iptables-apply
228 + dosym iptables-apply /sbin/ip6tables-apply
229 + doman iptables/iptables-apply.8
230 +
231 + insinto /usr/include
232 + doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
233 + insinto /usr/include/iptables
234 + doins include/iptables/internal.h
235 +
236 + keepdir /var/lib/iptables
237 + newinitd "${FILESDIR}"/${PN}-1.4.13-r1.init iptables
238 + newconfd "${FILESDIR}"/${PN}-1.4.13.confd iptables
239 + if use ipv6 ; then
240 + keepdir /var/lib/ip6tables
241 + newinitd "${FILESDIR}"/iptables-1.4.13-r1.init ip6tables
242 + newconfd "${FILESDIR}"/ip6tables-1.4.13.confd ip6tables
243 + fi
244 +
245 + systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
246 + if use ipv6 ; then
247 + systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
248 + fi
249 +
250 + # Move important libs to /lib #332175
251 + gen_usr_ldscript -a ip{4,6}tc iptc xtables
252 +
253 + prune_libtool_files
254 +}
255
256 diff --git a/net-firewall/iptables/iptables-1.4.21-r5.ebuild b/net-firewall/iptables/iptables-1.4.21-r5.ebuild
257 new file mode 100644
258 index 00000000000..6dbce98c427
259 --- /dev/null
260 +++ b/net-firewall/iptables/iptables-1.4.21-r5.ebuild
261 @@ -0,0 +1,104 @@
262 +# Copyright 1999-2018 Gentoo Foundation
263 +# Distributed under the terms of the GNU General Public License v2
264 +
265 +EAPI="5"
266 +
267 +# Force users doing their own patches to install their own tools
268 +AUTOTOOLS_AUTO_DEPEND=no
269 +
270 +inherit eutils multilib systemd toolchain-funcs autotools flag-o-matic
271 +
272 +DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
273 +HOMEPAGE="https://www.netfilter.org/projects/iptables/"
274 +SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
275 +
276 +LICENSE="GPL-2"
277 +# Subslot tracks libxtables as that's the one other packages generally link
278 +# against and iptables changes. Will have to revisit if other sonames change.
279 +SLOT="0/10"
280 +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
281 +IUSE="conntrack ipv6 netlink pcap static-libs"
282 +
283 +RDEPEND="
284 + conntrack? ( net-libs/libnetfilter_conntrack )
285 + netlink? ( net-libs/libnfnetlink )
286 + pcap? ( net-libs/libpcap )
287 +"
288 +DEPEND="${RDEPEND}
289 + virtual/os-headers
290 + virtual/pkgconfig
291 +"
292 +
293 +src_prepare() {
294 + # use the saner headers from the kernel
295 + rm -f include/linux/{kernel,types}.h
296 +
297 + epatch "${FILESDIR}"/${P}-configure.patch #557586
298 + epatch "${FILESDIR}"/${P}-static-connlabel-config.patch #558234
299 +
300 + # Only run autotools if user patched something
301 + epatch_user && eautoreconf || elibtoolize
302 +}
303 +
304 +src_configure() {
305 + # Some libs use $(AR) rather than libtool to build #444282
306 + tc-export AR
307 +
308 + # Hack around struct mismatches between userland & kernel for some ABIs. #472388
309 + use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
310 +
311 + sed -i \
312 + -e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
313 + -e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
314 + configure || die
315 +
316 + econf \
317 + --sbindir="${EPREFIX}/sbin" \
318 + --libexecdir="${EPREFIX}/$(get_libdir)" \
319 + --enable-devel \
320 + --enable-shared \
321 + $(use_enable pcap bpf-compiler) \
322 + $(use_enable pcap nfsynproxy) \
323 + $(use_enable static-libs static) \
324 + $(use_enable ipv6)
325 +}
326 +
327 +src_compile() {
328 + emake V=1
329 +}
330 +
331 +src_install() {
332 + default
333 + dodoc INCOMPATIBILITIES iptables/iptables.xslt
334 +
335 + # all the iptables binaries are in /sbin, so might as well
336 + # put these small files in with them
337 + into /
338 + dosbin iptables/iptables-apply
339 + dosym iptables-apply /sbin/ip6tables-apply
340 + doman iptables/iptables-apply.8
341 +
342 + insinto /usr/include
343 + doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
344 + insinto /usr/include/iptables
345 + doins include/iptables/internal.h
346 +
347 + keepdir /var/lib/iptables
348 + newinitd "${FILESDIR}"/${PN}.init iptables
349 + newconfd "${FILESDIR}"/${PN}-1.4.13.confd iptables
350 + if use ipv6 ; then
351 + keepdir /var/lib/ip6tables
352 + newinitd "${FILESDIR}"/iptables.init ip6tables
353 + newconfd "${FILESDIR}"/ip6tables-1.4.13.confd ip6tables
354 + fi
355 +
356 + systemd_dounit "${FILESDIR}"/systemd/iptables{,-{re,}store}.service
357 + if use ipv6 ; then
358 + systemd_dounit "${FILESDIR}"/systemd/ip6tables{,-{re,}store}.service
359 + fi
360 +
361 + # Move important libs to /lib #332175
362 + gen_usr_ldscript -a ip{4,6}tc iptc xtables
363 +
364 + prune_libtool_files
365 +}