Fix ebtables tables detection, bug #314529, thank Veovis for report and suggested fix.

(Portage version: 2.1.8.3/cvs/Linux x86_64)

2 files changed, 112 insertions, 0 deletions

diff --git a/net-firewall/ebtables/files/ebtables.confd-r1 b/net-firewall/ebtables/files/ebtables.confd-r1
new file mode 100644
index 000000000000..645b26edae99
--- /dev/null
+++ b/net-firewall/ebtables/files/ebtables.confd-r1
@@ -0,0 +1,11 @@
+# /etc/conf.d/ebtables
+
+# Location in which ebtables initscript will save set rules on 
+# service shutdown
+EBTABLES_SAVE="/var/lib/ebtables/rules-save"
+
+# Options to pass to ebtables-save and ebtables-restore 
+SAVE_RESTORE_OPTIONS=""
+
+# Save state on stopping ebtables
+SAVE_ON_STOP="yes"
diff --git a/net-firewall/ebtables/files/ebtables.initd-r1 b/net-firewall/ebtables/files/ebtables.initd-r1
new file mode 100644
index 000000000000..1088ad3f5c49
--- /dev/null
+++ b/net-firewall/ebtables/files/ebtables.initd-r1
@@ -0,0 +1,101 @@
+#!/sbin/runscript
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/ebtables/files/ebtables.initd-r1,v 1.1 2010/05/09 17:16:15 pva Exp $
+
+opts="save reload panic"
+
+ebtables_bin="/sbin/ebtables"
+ebtables_save=${EBTABLES_SAVE}
+
+depend() {
+	before net
+	use logger
+}
+
+ebtables_tables() {
+	for table in filter nat broute; do
+		if ${ebtables_bin} -t ${table} -L > /dev/null 2>&1; then
+			echo -n "${table} "
+		fi
+	done
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		broute) chains="BROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${ebtables_bin} -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkconfig() {
+	if [ ! -f ${ebtables_save} ] ; then
+		eerror "Not starting ebtables.  First create some rules then run:"
+		eerror "/etc/init.d/ebtables save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ebtables state and starting bridge firewall"
+	${ebtables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${ebtables_save}"
+	eend $?
+}
+
+stop() {
+	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+		save || return 1
+	fi
+	ebegin "Stopping bridge firewall"
+	local a
+	for a in $(ebtables_tables); do
+		set_table_policy $a ACCEPT
+
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing bridge firewall"
+	local a
+	for a in $(ebtables_tables); do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ebtables state"
+	touch "${ebtables_save}"
+	chmod 0600 "${ebtables_save}"
+	${ebtables_bin}-save $(ebtables_tables) ${SAVE_RESTORE_OPTIONS} > "${ebtables_save}"
+	eend $?
+}
+
+panic() {
+	service_started ebtables && svc_stop
+
+	local a
+	ebegin "Dropping all packets forwarded on bridges"
+	for a in $(ebtables_tables); do
+		${ebtables_bin} -t $a -F
+		${ebtables_bin} -t $a -X
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}