mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-24 04:59:14 -07:00
net-firewall/iptables: security cleanup
Bug: https://bugs.gentoo.org/711338 Package-Manager: Portage-2.3.90, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
This commit is contained in:
Thomas Deutschmann
@@ -1,5 +1,4 @@
|
||||
DIST iptables-1.6.1.tar.bz2 620890 BLAKE2B b45ac26e1fb7e8b17a6df0afab3b6c0e2f0a5df9191367548136b3ce9aadc1bcb875b8bc0403e6f12fcf487054e96418f4ef34da827af8989fd4dcf83cd3cd8d SHA512 12280db6e6ef8e68da2537e9da59fc601790fd02b1ba38a37c90dbb56272018329dccb8be995f96ecd5d94fafa6043204f3e8f8ee96531685d9e3c55359d2ee8
|
||||
DIST iptables-1.6.2.tar.bz2 639785 BLAKE2B 3d129756fd33c8c73d56d57e3c5595896db86ded14834a45db21b964d82840b62216ce3cea4ae4960e8c5f0671df3cc6bfb222f68d29cf3a8c99e0eee14bf017 SHA512 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
|
||||
DIST iptables-1.8.2.tar.bz2 679858 BLAKE2B 2004d85c89ecbc37ef0d571ac8ece680fd2e11a51b074f6387d6e9c4892da524c785d6bf3f30e26af4e7c2cb1f401d51bf8bcb21a91e380e24945374553139cb SHA512 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76
|
||||
DIST iptables-1.8.3.tar.bz2 716257 BLAKE2B 58c606a5753ae2cb8ada9039e4653d2abe03c7c9b6aeef1e458baa3e10e818893f35e8f2aed5221e692415115e618aa673c8fcd33d172f85e9d1b609ed79c7b8 SHA512 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d
|
||||
DIST iptables-1.8.4.tar.bz2 704312 BLAKE2B f677bb9ed2c86e6a39953c0565766991e9647224effdc7db2b563f3f491f6ace2f9073ecc8e865d489101a9f80cf964d9775ab81536412dbd4ca85937432de94 SHA512 a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
# Copyright 1999-2019 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=6
|
||||
|
||||
# Force users doing their own patches to install their own tools
|
||||
AUTOTOOLS_AUTO_DEPEND=no
|
||||
|
||||
inherit multilib systemd toolchain-funcs autotools flag-o-matic usr-ldscript
|
||||
|
||||
DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
|
||||
HOMEPAGE="https://www.netfilter.org/projects/iptables/"
|
||||
SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
|
||||
|
||||
LICENSE="GPL-2"
|
||||
# Subslot tracks libxtables as that's the one other packages generally link
|
||||
# against and iptables changes. Will have to revisit if other sonames change.
|
||||
SLOT="0/12"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86"
|
||||
IUSE="conntrack ipv6 netlink nftables pcap static-libs"
|
||||
|
||||
COMMON_DEPEND="
|
||||
conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
|
||||
netlink? ( net-libs/libnfnetlink )
|
||||
nftables? (
|
||||
>=net-libs/libmnl-1.0:0=
|
||||
>=net-libs/libnftnl-1.1.1:0=
|
||||
)
|
||||
pcap? ( net-libs/libpcap )
|
||||
"
|
||||
DEPEND="${COMMON_DEPEND}
|
||||
virtual/os-headers
|
||||
>=sys-kernel/linux-headers-4.4:0
|
||||
virtual/pkgconfig
|
||||
nftables? (
|
||||
sys-devel/flex
|
||||
virtual/yacc
|
||||
)
|
||||
"
|
||||
RDEPEND="${COMMON_DEPEND}
|
||||
nftables? ( net-misc/ethertypes )
|
||||
"
|
||||
|
||||
src_prepare() {
|
||||
# use the saner headers from the kernel
|
||||
rm -f include/linux/{kernel,types}.h
|
||||
|
||||
eapply "${FILESDIR}"/${P}-link.patch
|
||||
eapply_user
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Some libs use $(AR) rather than libtool to build #444282
|
||||
tc-export AR
|
||||
|
||||
# Hack around struct mismatches between userland & kernel for some ABIs. #472388
|
||||
use amd64 && [[ ${ABI} == "x32" ]] && append-flags -fpack-struct
|
||||
|
||||
sed -i \
|
||||
-e "/nfnetlink=[01]/s:=[01]:=$(usex netlink 1 0):" \
|
||||
-e "/nfconntrack=[01]/s:=[01]:=$(usex conntrack 1 0):" \
|
||||
configure || die
|
||||
|
||||
local myeconfargs=(
|
||||
--sbindir="${EPREFIX}/sbin"
|
||||
--libexecdir="${EPREFIX}/$(get_libdir)"
|
||||
--enable-devel
|
||||
--enable-shared
|
||||
$(use_enable nftables)
|
||||
$(use_enable pcap bpf-compiler)
|
||||
$(use_enable pcap nfsynproxy)
|
||||
$(use_enable static-libs static)
|
||||
$(use_enable ipv6)
|
||||
)
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
# Deal with parallel build errors.
|
||||
use nftables && emake -C iptables xtables-config-parser.h
|
||||
emake V=1
|
||||
}
|
||||
|
||||
src_install() {
|
||||
default
|
||||
dodoc INCOMPATIBILITIES iptables/iptables.xslt
|
||||
|
||||
# all the iptables binaries are in /sbin, so might as well
|
||||
# put these small files in with them
|
||||
into /
|
||||
dosbin iptables/iptables-apply
|
||||
dosym iptables-apply /sbin/ip6tables-apply
|
||||
doman iptables/iptables-apply.8
|
||||
|
||||
insinto /usr/include
|
||||
doins include/iptables.h $(use ipv6 && echo include/ip6tables.h)
|
||||
insinto /usr/include/iptables
|
||||
doins include/iptables/internal.h
|
||||
|
||||
keepdir /var/lib/iptables
|
||||
newinitd "${FILESDIR}"/${PN}-r2.init iptables
|
||||
newconfd "${FILESDIR}"/${PN}-r1.confd iptables
|
||||
if use ipv6 ; then
|
||||
keepdir /var/lib/ip6tables
|
||||
dosym iptables /etc/init.d/ip6tables
|
||||
newconfd "${FILESDIR}"/ip6tables-r1.confd ip6tables
|
||||
fi
|
||||
|
||||
if use nftables; then
|
||||
# Bug 647458
|
||||
rm "${ED%/}"/etc/ethertypes || die
|
||||
|
||||
# Bug 660886
|
||||
rm "${ED%/}"/sbin/{arptables,ebtables} || die
|
||||
|
||||
# Bug 669894
|
||||
rm "${ED%/}"/sbin/ebtables-{save,restore} || die
|
||||
fi
|
||||
|
||||
systemd_dounit "${FILESDIR}"/systemd/iptables-{re,}store.service
|
||||
if use ipv6 ; then
|
||||
systemd_dounit "${FILESDIR}"/systemd/ip6tables-{re,}store.service
|
||||
fi
|
||||
|
||||
# Move important libs to /lib #332175
|
||||
gen_usr_ldscript -a ip{4,6}tc iptc xtables
|
||||
|
||||
find "${ED}" -name "*.la" -delete || die
|
||||
}
|
||||
Reference in New Issue
Block a user