iptables

net/firewall/iptables/ebtables.confd

@@ -0,0 +1,15 @@
+# /etc/conf.d/ebtables
+
+# Location in which ebtables initscript will save set rules on 
+# service shutdown
+EBTABLES_SAVE="/var/lib/ebtables/rules-save"
+
+# Options to pass to ebtables-save and ebtables-restore 
+SAVE_RESTORE_OPTIONS=""
+
+# Save state on stopping ebtables
+SAVE_ON_STOP="yes"
+
+# Tables to be saved and restored. If you have built ebtables as modules, you
+# may leave it blank. Otherwise, you MUST define which to control.
+TABLE_NAMES="filter nat"

net/firewall/iptables/ebtables.initd

@@ -0,0 +1,104 @@
+#!/sbin/openrc-run
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/ebtables/files/ebtables.initd,v 1.2 2007/09/28 19:22:14 pva Exp $
+
+extra_commands="save reload"
+extra_started_commands="panic"
+
+ebtables_bin="/sbin/ebtables"
+ebtables_save=${EBTABLES_SAVE}
+ebtables_tables=$(grep -E '^ebtable_' /proc/modules | cut -f1 -d' ' | sed s/ebtable_//)
+if [ "$ebtables_tables" == "" ] ; then
+	ebtables_tables=${TABLE_NAMES}
+fi
+
+# Add ip netns if configured to run in a netns namespace
+if [ -n "$netns" ]; then
+	ebtables_bin="ip netns exec $netns $ebtables_bin"
+fi
+
+depend() {
+	before net
+	use logger
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		broute) chains="BROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${ebtables_bin} -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkconfig() {
+	if [ ! -f ${ebtables_save} ] ; then
+		eerror "Not starting ebtables.  First create some rules then run:"
+		eerror "/etc/init.d/ebtables save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ebtables state and starting bridge firewall"
+	${ebtables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${ebtables_save}"
+	eend $?
+}
+
+stop() {
+	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+		save || return 1
+	fi
+	ebegin "Stopping bridge firewall"
+	local a
+	for a in ${ebtables_tables}; do
+		set_table_policy $a ACCEPT
+
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing bridge firewall"
+	local a
+	for a in ${ebtables_tables}; do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ebtables state"
+	checkpath -Fm 0600 "${ebtables_save}"
+	for a in ${ebtables_tables} ; do
+		${ebtables_bin}-save -t ${a} ${SAVE_RESTORE_OPTIONS} >> "${ebtables_save}"
+	done
+	eend $?
+}
+
+panic() {
+	service_started ebtables && svc_stop
+
+	local a
+	ebegin "Dropping all packets forwarded on bridges"
+	for a in ${ebtables_tables}; do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}

net/firewall/iptables/ip6tables.confd

@@ -0,0 +1,14 @@
+# /etc/conf.d/ip6tables
+
+# Location in which ip6tables initscript will save set rules on 
+# service shutdown
+IP6TABLES_SAVE="/etc/iptables/rules6-save"
+
+# Options to pass to ip6tables-save and ip6tables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# Enable/disable IPv6 forwarding with the rules
+IPFORWARD="no"

net/firewall/iptables/iptables.confd

@@ -0,0 +1,14 @@
+# /etc/conf.d/iptables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IPTABLES_SAVE="/etc/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
+
+# Enable/disable IPv4 forwarding with the rules
+IPFORWARD="no"

net/firewall/iptables/iptables.initd

@@ -0,0 +1,151 @@
+#!/sbin/openrc-run
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $
+
+description="IPv4/IPv6 packet filtering and NAT"
+description_save="Save firewall state"
+description_panic="Drop all packets"
+description_reload="Reload configuration"
+
+extra_commands="save panic"
+extra_started_commands="reload"
+
+iptables_name=${SVCNAME}
+if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then
+	iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+	iptables)  iptables_proc="/proc/net/ip_tables_names"
+	           iptables_save=${IPTABLES_SAVE}
+		   sysctl_ipfwd=net.ipv4.ip_forward;;
+	ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+	           iptables_save=${IP6TABLES_SAVE}
+		   sysctl_ipfwd=net.ipv6.conf.all.forwarding;;
+esac
+
+# Add ip netns if configured to run in a netns namespace
+if [ -n "$netns" ]; then
+	iptables_bin="ip netns exec $netns $iptables_bin"
+fi
+
+depend() {
+	before net
+	after sysctl
+	use logger
+	provide firewall
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${iptables_bin} -w 5 -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkkernel() {
+	if [ ! -e ${iptables_proc} ] ; then
+		eerror "Your kernel lacks ${iptables_name} support, please load"
+		eerror "appropriate modules and try again."
+		return 1
+	fi
+	return 0
+}
+checkconfig() {
+	if [ ! -f ${iptables_save} ] ; then
+		eerror "Not starting ${iptables_name}.  First create some rules then run:"
+		eerror "/etc/init.d/${iptables_name} save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ${iptables_name} state and starting firewall"
+	${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	eend $?
+	if yesno "${IPFORWARD}"; then
+		ebegin "Enabling forwarding"
+		/sbin/sysctl -w ${sysctl_ipfwd}=1 > /dev/null
+		eend $?
+	fi
+}
+
+stop() {
+	if yesno "${IPFORWARD}"; then
+		ebegin "Disabling forwarding"
+		/sbin/sysctl -w ${sysctl_ipfwd}=0 > /dev/null
+		eend $?
+	fi
+	if yesno "${SAVE_ON_STOP}"; then
+		save || return 1
+	fi
+	checkkernel || return 1
+	ebegin "Stopping firewall"
+	local a
+	for a in $(cat ${iptables_proc}) ; do
+		set_table_policy $a ACCEPT
+
+		${iptables_bin} -w 5 -F -t $a
+		${iptables_bin} -w 5 -X -t $a
+	done
+	eend $?
+}
+
+reload() {
+	checkkernel || return 1
+	ebegin "Flushing firewall"
+	local a
+	for a in $(cat ${iptables_proc}) ; do
+		${iptables_bin} -w 5 -F -t $a
+		${iptables_bin} -w 5 -X -t $a
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ${iptables_name} state"
+	checkpath -fm 0600 "${iptables_save}"
+	local exitcode tmp
+
+	tmp="$(mktemp)"
+	${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${tmp}"
+	exitcode=$?
+	if [ "$exitcode" -eq 0 ]; then
+		# command succeeded, so overwrite
+		mv "${tmp}" "${iptables_save}"
+	else
+		ewarn "${iptables_bin}-save failed!"
+		rm -f "${tmp}"
+	fi
+	eend $exitcode
+}
+
+panic() {
+	checkkernel || return 1
+	if service_started ${iptables_name}; then
+		rc-service ${iptables_name} stop
+	fi
+
+	local a
+	ebegin "Dropping all packets"
+	for a in $(cat ${iptables_proc}) ; do
+		${iptables_bin} -w 5 -F -t $a
+		${iptables_bin} -w 5 -X -t $a
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}

net/firewall/iptables/iptables.post-upgrade

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+ver_old=$2
+
+if [ "$(apk version -t "$ver_old" '1.8.9-r4')" = '<' ]; then
+	cat >&2 <<-EOF
+	*
+	* the "iptables" commands now point to xtables-nft-multi
+	* instead of xtables-legacy-multi. this means that by default,
+	* the kernel nftables backend is used instead of the iptables one.
+	* 
+	* note that to keep working with your current loaded ruleset (if you want to
+	* make changes before rebooting, or save your rules), you have to install
+	* iptables-legacy. to save the rules, use iptables-legacy-save/ip6tables-legacy-save
+	* from that package (to where the rules are normally saved, IPTABLES_SAVE from
+	* /etc/conf.d/iptables / /etc/conf.d/ip6tables)
+	*
+	* because mixing backends is not supported, you should reboot your system.
+	*
+	EOF
+fi

net/firewall/iptables/use-sh-iptables-apply.patch

@@ -0,0 +1,39 @@
+From: Simon Frankenberger <simon-alpine@fraho.eu>
+
+make iptables-apply use posix sh
+
+--- a/iptables/iptables-apply
++++ b/iptables/iptables-apply
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/bin/sh
+ # iptables-apply -- a safer way to update iptables remotely
+ #
+ # Usage:
+@@ -110,7 +110,7 @@
+ }
+ 
+ function checkcommands() {
+-	for cmd in "${COMMANDS[@]}"; do
++	for cmd in ${COMMANDS}; do
+ 		if ! command -v "$cmd" >/dev/null; then
+ 			echo "Error: needed command not found: $cmd" >&2
+ 			exit 127
+@@ -184,7 +184,7 @@
+ 		fi
+ 
+ 		# Needed commands
+-		COMMANDS=(mktemp "$SAVE" "$RESTORE" "$RUNCMD")
++		COMMANDS="mktemp $SAVE $RESTORE $RUNCMD"
+ 		checkcommands
+ 		;;
+ 	(*)
+@@ -196,7 +196,7 @@
+ 		fi
+ 
+ 		# Needed commands
+-		COMMANDS=(mktemp "$SAVE" "$RESTORE")
++		COMMANDS="mktemp $SAVE $RESTORE"
+ 		checkcommands
+ 		;;
+ esac

net/firewall/iptables/ympbuild

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+name='iptables'
+release='1'
+version='1.8.10'
+url='https://www.netfilter.org/projects/iptables/index.html'
+description='Linux kernel packet control tool (using legacy interface)'
+email='akarsu@protonmail.com'
+maintainer='akarsu'
+license=('GPLv3')
+source=("https://www.netfilter.org/projects/iptables/files/iptables-${version}.tar.xz"
+	"use-sh-iptables-apply.patch"
+	"iptables.initd"
+	"iptables.confd"
+	"ip6tables.confd"
+	"ebtables.initd"
+	"ebtables.confd")
+depends=(libnftnl libmnl)
+makedepends=(bison flex)
+md5sums=('5eaa3bb424dd3a13c98c0cb026314029' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
+group=(net.firewall)
+uses=()
+arch=('x86_64')
+
+cd $name-$version
+
+prepare() {
+  patch -Np1 -i ../use-sh-iptables-apply.patch
+}
+
+setup () {
+    ./configure --prefix=/usr \
+		--libdir=/usr/lib64/ \
+		--mandir=/usr/share/man \
+		--sbindir=/sbin \
+		--sysconfdir=/etc \
+		--without-kernel \
+		--enable-devel \
+		--enable-libipq \
+		--enable-shared
+
+}
+
+build () {
+    make $jobs
+}
+
+package () {
+   make install DESTDIR="$DESTDIR" $jobs
+   
+   rm -f $DESTDIR/usr/bin/iptables-xml
+   ln -s ../../sbin/xtables-legacy-multi $DESTDIR/usr/bin/iptables-xml
+   
+   install -Dm644 include/iptables.h include/ip6tables.h \
+		-t "$DESTDIR"/usr/include/
+	install -Dm644 include/libiptc/*.h -t "$DESTDIR"/usr/include/libiptc/
+
+	install -D -m755 ../iptables.initd "$DESTDIR"/etc/init.d/iptables
+	install -D -m644 ../iptables.confd "$DESTDIR"/etc/conf.d/iptables
+	install -D -m755 ../iptables.initd "$DESTDIR"/etc/init.d/ip6tables
+	install -D -m644 ../ip6tables.confd "$DESTDIR"/etc/conf.d/ip6tables
+	install -D -m755 ../ebtables.initd "$DESTDIR"/etc/init.d/ebtables
+	install -D -m644 ../ebtables.confd "$DESTDIR"/etc/conf.d/ebtables
+
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/iptables
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/iptables-save
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/iptables-restore
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/ip6tables
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/ip6tables-save
+	ln -sfv xtables-nft-multi "$DESTDIR"/sbin/ip6tables-restore
+}
+