summaryrefslogtreecommitdiff
path: root/net-firewall/nftables
diff options
context:
space:
mode:
Diffstat (limited to 'net-firewall/nftables')
-rw-r--r--net-firewall/nftables/Manifest6
-rw-r--r--net-firewall/nftables/files/libexec/nftables-mk.sh59
-rw-r--r--net-firewall/nftables/files/nftables-mk.confd26
-rw-r--r--net-firewall/nftables/files/nftables-mk.init104
-rw-r--r--net-firewall/nftables/metadata.xml5
-rw-r--r--net-firewall/nftables/nftables-0.9.0-r2.ebuild94
6 files changed, 293 insertions, 1 deletions
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index 1957586692d9..5e70d7dbeaf3 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -1,4 +1,7 @@
+AUX libexec/nftables-mk.sh 984 BLAKE2B 5a9a8005a814da3a16befcb8e59754f5fe7c6381c22d1992940c1f01cb420ff41418095f22ca9367cf230e71cee53b8a08568c5f160c525d8b9c5a8a6b5e8a7b SHA512 a09ae5b144c2424b8ec7d41fe7e2f84eb246e08a9a4b3bdfa19368a2d005fad6aa3538b64305cf357e704b646ae1b408629221d74e19a3b1d91b6d5ec41630a4
AUX libexec/nftables.sh 3643 BLAKE2B 83818eb88db2d30c58b348e12b5c5baf7599f4e301ac12455a70f1c98e369e4febab3020ddb1c5b83e6d3777b3a98bd30a5baf73d90ac00e1278d88fc1565b8b SHA512 efc9b4f9520c78b6248f16bd5708669872e8abf949f6f4b81182f331f8532dfeaae2df648e8878e9b5cbd66c0259daab71035ea922754807654b2b3bc86b4352
+AUX nftables-mk.confd 899 BLAKE2B f4c3d82fbae87fb0d755af786a98db591b6a667cf33660ba9275ada2e6417fad1899a7f29762f23c112fc5c9e178bc7590c3b2ba26617853c3577917bd7d3edf SHA512 505ed05674a04367f1a3d5cf6447596ad1c3b2e9c920697f12f58a20d94c2a39b0041bb4911678511c4548566a69d964661d4afc3e7e27997943b875f204c602
+AUX nftables-mk.init 2090 BLAKE2B 62f56586ca4ba0acbd3ac41f4904041d625388771bbafc32833055a5f3c00f251e1d9a04bb41dd672f33d13a0825f7e4470a30d7e874df1abd41508148ef42b0 SHA512 819b2d60b42207cb70d95b700557e873fe18c5f6e8437683240beb317f773cf8e18755086e24652a9bcff49c6f96af8cd9e3f3b62c9f433779eff4e3f3935197
AUX nftables.confd 655 BLAKE2B 5512be1edd43e270941de3d9b66fda69e4afd7c7e6e970b232a044c2fd64f8e50b9b55a4fe670174c3eabf3d176ee0158c1043baec4b76b0802e7e97bc862fcf SHA512 8370abcdc89fcd9da5dc7d1620be6afb4633b8bcd0a8a120b464cc1a7e1fab6f34956c293da3f6d3cbe1f7a2e03038fd0c94a614137ae5657d29ffdb5f3fa144
AUX nftables.init 3069 BLAKE2B 68c6b2b81995bd909c00cc3527f891f04d0dd30532cd821c89b59fc7e3ea0dff0e98d767cee2c00a5462023fdf6f59e813dec7063768a34187f2404377e498f7 SHA512 ca761be0440945b21d5b002468baffb3299d0a3ac244aa895734dfdfaf442e7a73b757bcda99d958582064411d1b80b2cbcb4eb532bb219b4df407c9ed892661
AUX systemd/nftables-restore.service 394 BLAKE2B 1c1f358eb2eff789e68c051098c971f11a8df6621c3c919e30a1ec1213f6db822c390609c01827fe9fc75c540effa3e3a7b6f93bd24e16ea19841bbfaab796ed SHA512 18da6a770bb3e94fd6b2c9e6f033450aaff9fe886c8846f780d08a21e2fc884ac078652743b50b3d4ea8c9500f92d272bdd27e2881e438c2b223d40816c100a0
@@ -8,5 +11,6 @@ DIST nftables-0.9.0.tar.gz 417981 BLAKE2B 4dfba4d71928f1694ffeb4871353fc373d88e2
EBUILD nftables-0.8-r3.ebuild 1959 BLAKE2B a029fd4444f5aeddedfbdcb3659f879c4a8f6246c25042449cb5ffa7809401a7ef512275dc1f45c50b51bc2807b3679d1c386bcb2470522ba1a338dc728bdb15 SHA512 6bd510183e9d1cec3fa05970adccf28ac21c7ad839f3a6236ee584d1308c48988ee2b006630ecd558954cb80a7a8faf6e78ab9b06b29df4b2a69161a9e848c71
EBUILD nftables-0.8.5.ebuild 1937 BLAKE2B b24ea2b8978dc0294c2d27a90aa205916ddeb04c2b66f0adc7e870705a6ffac8ac0e3bf5a95e3c79c27965f780c0ca94ba21bcb5abad49ce49b50ff00c2046fd SHA512 f5f461225c68ed17450380d467f79d87302f0d1c1d69ddb15f90b6a938ea79906e165e6564db8135f07eafc35fb89acfab7659a97d62c7c71ac0376953ff6954
EBUILD nftables-0.9.0-r1.ebuild 2079 BLAKE2B 303d82b14d13f49c7ed5222d69025eaf0d73e3ec617655b33224b8a1f14e4a16a9d9e71a60270cb3e015bb009efb43ccb419a722a4780cdba50cc2ea341a3eda SHA512 68386a156baa050c83f6233516f8e37f871a2be203d71c751eeefbfbbfe52f114201c2a6eced8bfa194ca8e87c9ad62d6370096c0ceab6e60927cf236c12dfe6
+EBUILD nftables-0.9.0-r2.ebuild 2343 BLAKE2B d726f8bef9ddd5860fff0d91cf29185a32432fc24ad31b173330dd4f881809f66e62e805dcbb9d1e4bbc9f0c3c8185ceadaa4db7882266a1747f9d5f522e1e9e SHA512 953a2e64cf4ddc2591335b245ca8a0b18056cb55c46f7796fd1e4de2f774ab3bb2b3bb6be70b49c7c7d1b4d4780f1e5e3335b84d1d97e9a4a99443aecadc91e1
EBUILD nftables-0.9.0.ebuild 1989 BLAKE2B 3c1e318030d8287b0db2b2ebda3e528703ac73bdf146c147c5c7f8929e9339f9c4c6df08fc829a0ad55f4634b0910e8acfeeb9a31577ba6e61663839c6978a5f SHA512 627c70f4bb60fdbea3f57e676acfb84ed0a4779b6b98b352be766463ca2c564ebcd1a540719e2085b59b8b87fd8dfe7bb1cc6b6d91ec5fe4aac79f53c3c1c496
-MISC metadata.xml 466 BLAKE2B 535df1fe78a4cc4da0375e8db9b3d641ed19736f1992d361203f2e2088aaad7d86a0d547cc9b9139f36837cf6edf6dadea3c17f54b562e6061db52579659f806 SHA512 59494d7efc5f49a417c623410bbda4f891a47a4e1a8a43c8b7357978618401e80595c52113d7aaf8a6171ccacca50fe101c9b5bdbe070f0e993829b72693c931
+MISC metadata.xml 701 BLAKE2B 14244e9f37e87bc6e4a9cc917b7f2e55bcb61135af3a9ff258334ef9d40ade40312760f30ddab907d75f4c4492cc8d8d2217d022f5e04672988c25d65ec1d85a SHA512 070e4dcaf6f323f93fac80352d2c2ae1512611ffc3261e7b3c85acee9f490f90e238b39aad2a7d4959c75fe7c96545b8c12318b09d4c56d8116df80364bf09a6
diff --git a/net-firewall/nftables/files/libexec/nftables-mk.sh b/net-firewall/nftables/files/libexec/nftables-mk.sh
new file mode 100644
index 000000000000..b6ad37867b6d
--- /dev/null
+++ b/net-firewall/nftables/files/libexec/nftables-mk.sh
@@ -0,0 +1,59 @@
+#!/bin/sh
+
+main() {
+ local NFTABLES_SAVE=${2:-'/var/lib/nftables/rules-save'}
+ case "$1" in
+ "check")
+ nft -c -f "${NFTABLES_SAVE}"
+ ;;
+ "clear")
+ nft flush ruleset
+ ;;
+ "list")
+ nft ${SAVE_OPTIONS} list ruleset
+ ;;
+ "load")
+ ( echo "flush ruleset;"; cat "${NFTABLES_SAVE}" ) | nft -f -
+ ;;
+ "panic")
+ panic hard | nft -f -
+ ;;
+ "soft_panic")
+ panic soft | nft -f -
+ ;;
+ "store")
+ local tmp_save="${NFTABLES_SAVE}.tmp"
+ umask 600;
+ (
+ echo "#!/sbin/nft -f"
+ echo "flush ruleset;"
+ nft ${SAVE_OPTIONS} list ruleset
+ ) > "$tmp_save" && mv ${tmp_save} ${NFTABLES_SAVE}
+ ;;
+ esac
+}
+
+panic() {
+ local erule;
+ [ "$1" = soft ] && erule="ct state established,related accept;" || erule="";
+ cat <<EOF
+table inet filter {
+ chain input {
+ type filter hook input priority 0;
+ $erule
+ drop
+ }
+ chain forward {
+ type filter hook forward priority 0;
+ drop
+ }
+ chain output {
+ type filter hook output priority 0;
+ $erule
+ drop
+ }
+}
+EOF
+}
+
+main "$@"
diff --git a/net-firewall/nftables/files/nftables-mk.confd b/net-firewall/nftables/files/nftables-mk.confd
new file mode 100644
index 000000000000..5cda24030f93
--- /dev/null
+++ b/net-firewall/nftables/files/nftables-mk.confd
@@ -0,0 +1,26 @@
+# /etc/conf.d/nftables
+
+# Location in which nftables initscript will save set rules on
+# service shutdown
+NFTABLES_SAVE="/var/lib/nftables/rules-save"
+
+# Options to pass to nft on save
+SAVE_OPTIONS="-n"
+
+# Save state on stopping nftables
+SAVE_ON_STOP="yes"
+
+# Only for OpenRC systems.
+# Set to "hard" or "soft" to panic when stopping instead of
+# clearing the rules
+# Soft panic loads a ruleset dropping any new or invalid connections
+# Hard panic loads a ruleset dropping all traffic
+PANIC_ON_STOP=""
+
+# If you need to log nftables messages as soon as nftables starts,
+# AND your logger does NOT depend on the network, then you may wish
+# to uncomment the next line.
+# If your logger depends on the network, and you uncomment this line
+# you will create an unresolvable circular dependency during startup.
+# After commenting or uncommenting this line, you must run 'rc-update -u'.
+#rc_use="logger"
diff --git a/net-firewall/nftables/files/nftables-mk.init b/net-firewall/nftables/files/nftables-mk.init
new file mode 100644
index 000000000000..f7e3dce8ada2
--- /dev/null
+++ b/net-firewall/nftables/files/nftables-mk.init
@@ -0,0 +1,104 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="check clear list panic save soft_panic"
+extra_started_commands="reload"
+
+depend() {
+ need localmount #434774
+ before net
+}
+
+checkkernel() {
+ if ! /sbin/nft list ruleset >/dev/null 2>/dev/null ; then
+ eerror "Your kernel lacks nftables support, please load"
+ eerror "appropriate modules and try again."
+ return 1
+ fi
+ return 0
+}
+
+checkconfig() {
+ if [ -z "${NFTABLES_SAVE}" -o ! -f "${NFTABLES_SAVE}" ] ; then
+ eerror "Not starting nftables. First create some rules then run:"
+ eerror "/etc/init.d/${SVCNAME} save"
+ return 1
+ fi
+ return 0
+}
+
+start_pre() {
+ checkconfig || return 1
+ checkkernel || return 1
+ check || return 1
+}
+
+start() {
+ ebegin "Loading ${SVCNAME} state and starting firewall"
+ /usr/libexec/nftables/nftables.sh load "${NFTABLES_SAVE}"
+ eend $?
+}
+
+stop() {
+ if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+ save || return 1
+ fi
+
+ ebegin "Stopping firewall"
+ if [ "${PANIC_ON_STOP}" = "hard" ]; then
+ /usr/libexec/nftables/nftables.sh panic
+ elif [ "${PANIC_ON_STOP}" = "soft" ]; then
+ /usr/libexec/nftables/nftables.sh soft_panic
+ else
+ /usr/libexec/nftables/nftables.sh clear
+ fi
+ eend $?
+}
+
+reload() {
+ start_pre || return 1
+ start
+}
+
+clear() {
+ ebegin "Clearing rules"
+ /usr/libexec/nftables/nftables.sh clear
+ eend $?
+}
+
+list() {
+ /usr/libexec/nftables/nftables.sh list
+}
+
+check() {
+ ebegin "Checking rules"
+ /usr/libexec/nftables/nftables.sh check "${NFTABLES_SAVE}"
+ eend $?
+}
+
+save() {
+ ebegin "Saving ${SVCNAME} state"
+ checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
+ checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
+ /usr/libexec/nftables/nftables.sh store "${NFTABLES_SAVE}"
+ eend $?
+}
+
+panic() {
+ if service_started ${SVCNAME}; then
+ rc-service ${SVCNAME} zap
+ fi
+ ebegin "Dropping all packets"
+ /usr/libexec/nftables/nftables.sh panic
+ eend $?
+}
+
+soft_panic() {
+ if service_started ${SVCNAME}; then
+ rc-service ${SVCNAME} zap
+ fi
+ ebegin "Dropping new connections"
+ /usr/libexec/nftables/nftables.sh soft_panic
+ eend $?
+}
diff --git a/net-firewall/nftables/metadata.xml b/net-firewall/nftables/metadata.xml
index 1a891a6e5330..dcc71d66d6f8 100644
--- a/net-firewall/nftables/metadata.xml
+++ b/net-firewall/nftables/metadata.xml
@@ -9,7 +9,12 @@
<email>prometheanfire@gentoo.org</email>
<name>Matthew Thode</name>
</maintainer>
+ <maintainer type="person">
+ <email>klondike@gentoo.org</email>
+ <name>Francisco Blas Izquierdo Riera</name>
+ </maintainer>
<use>
<flag name="json">Enable JSON support via <pkg>dev-libs/jansson</pkg></flag>
+ <flag name="modern_kernel">Install init scripts for 3.18 or higher kernels with atomic rule updates</flag>
</use>
</pkgmetadata>
diff --git a/net-firewall/nftables/nftables-0.9.0-r2.ebuild b/net-firewall/nftables/nftables-0.9.0-r2.ebuild
new file mode 100644
index 000000000000..346d321bb376
--- /dev/null
+++ b/net-firewall/nftables/nftables-0.9.0-r2.ebuild
@@ -0,0 +1,94 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools linux-info systemd
+
+DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+SRC_URI="https://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ia64 ~x86"
+IUSE="debug doc +gmp json +modern_kernel +readline"
+
+RDEPEND=">=net-libs/libmnl-1.0.3:0=
+ gmp? ( dev-libs/gmp:0= )
+ json? ( dev-libs/jansson )
+ readline? ( sys-libs/readline:0= )
+ >=net-libs/libnftnl-1.1.1:0="
+
+DEPEND="${RDEPEND}
+ >=app-text/docbook2X-0.8.8-r4
+ doc? ( >=app-text/dblatex-0.3.7 )
+ sys-devel/bison
+ sys-devel/flex
+ virtual/pkgconfig"
+
+S="${WORKDIR}/v${PV}"
+
+pkg_setup() {
+ if kernel_is ge 3 13; then
+ if use modern_kernel && kernel_is lt 3 18; then
+ eerror "The modern_kernel USE flag requires kernel version 3.18 or newer to work properly."
+ fi
+ CONFIG_CHECK="~NF_TABLES"
+ linux-info_pkg_setup
+ else
+ eerror "This package requires kernel version 3.13 or newer to work properly."
+ fi
+}
+
+src_prepare() {
+ default
+ eautoreconf
+}
+
+src_configure() {
+ local myeconfargs=(
+ --sbindir="${EPREFIX}"/sbin
+ $(use_enable debug)
+ $(use_enable doc pdf-doc)
+ $(use_with !gmp mini_gmp)
+ $(use_with json)
+ $(use_with readline cli)
+ )
+ econf "${myeconfargs[@]}"
+}
+
+src_install() {
+ default
+
+ local mksuffix=""
+ use modern_kernel && mksuffix="-mk"
+
+ exeinto /usr/libexec/${PN}
+ newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
+ newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
+ newinitd "${FILESDIR}"/${PN}${mksuffix}.init ${PN}
+ keepdir /var/lib/nftables
+
+ systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
+ systemd_enable_service basic.target ${PN}-restore.service
+
+ docinto /usr/share/doc/${PF}/skels
+ dodoc "${D}"/etc/nftables/*
+ rm -R "${D}"/etc/nftables
+}
+
+pkg_postinst() {
+ local save_file
+ save_file="${EROOT%/}/var/lib/nftables/rules-save"
+
+ # In order for the nftables-restore systemd service to start
+ # the save_file must exist.
+ if [[ ! -f ${save_file} ]]; then
+ touch ${save_file}
+ fi
+
+ elog "If you are creating firewall rules before the next system restart "
+ elog "the nftables-restore service must be manually started in order to "
+ elog "save those rules on shutdown."
+}