diff options
Diffstat (limited to 'net-firewall')
| -rw-r--r-- | net-firewall/iptables/ChangeLog | 8 | ||||
| -rw-r--r-- | net-firewall/iptables/files/digest-iptables-1.4.0-r1 | 6 | ||||
| -rw-r--r-- | net-firewall/iptables/files/iptables-1.4.0-dev-files.patch | 46 | ||||
| -rw-r--r-- | net-firewall/iptables/iptables-1.4.0-r1.ebuild | 191 |
4 files changed, 250 insertions, 1 deletions
diff --git a/net-firewall/iptables/ChangeLog b/net-firewall/iptables/ChangeLog index 9254f0624bb2..c98541f918a7 100644 --- a/net-firewall/iptables/ChangeLog +++ b/net-firewall/iptables/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for net-firewall/iptables # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.156 2007/12/27 21:48:28 vapier Exp $ +# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.157 2007/12/30 15:00:48 vapier Exp $ + +*iptables-1.4.0-r1 (30 Dec 2007) + + 30 Dec 2007; Mike Frysinger <vapier@gentoo.org> + +files/iptables-1.4.0-dev-files.patch, +iptables-1.4.0-r1.ebuild: + Install dev headers/libs again #203744. 27 Dec 2007; Mike Frysinger <vapier@gentoo.org> iptables-1.4.0.ebuild: Punt USE=imq. Use user-custom patch dir in /etc/. diff --git a/net-firewall/iptables/files/digest-iptables-1.4.0-r1 b/net-firewall/iptables/files/digest-iptables-1.4.0-r1 new file mode 100644 index 000000000000..56c018717665 --- /dev/null +++ b/net-firewall/iptables/files/digest-iptables-1.4.0-r1 @@ -0,0 +1,6 @@ +MD5 90cfa8a554a29b0b859a625e701af2a7 iptables-1.4.0.tar.bz2 181610 +RMD160 6f6a29cbe0e55261607acc1183e04482c444286e iptables-1.4.0.tar.bz2 181610 +SHA256 fd9a978035e6a8f73344f986c84a222dc4ac3706b901e0c1ecae9647db5e5d52 iptables-1.4.0.tar.bz2 181610 +MD5 e153d23a3879f33f4a96ed6b706609e3 netfilter-layer7-v2.17.tar.gz 160408 +RMD160 9823d7b411e18160dc8501a6a5d2129f75e727e1 netfilter-layer7-v2.17.tar.gz 160408 +SHA256 2e2893757a3b22f2786ead2045efae1d6a52942a89d0159c39ba907531b60c01 netfilter-layer7-v2.17.tar.gz 160408 diff --git a/net-firewall/iptables/files/iptables-1.4.0-dev-files.patch b/net-firewall/iptables/files/iptables-1.4.0-dev-files.patch new file mode 100644 index 000000000000..afb091aeb65f --- /dev/null +++ b/net-firewall/iptables/files/iptables-1.4.0-dev-files.patch @@ -0,0 +1,46 @@ +install headers and make a small archive for people to use + +--- iptables/Makefile ++++ iptables/Makefile +@@ -102,6 +102,17 @@ + print-extensions: + @[ -n "$(OPTIONALS)" ] && echo Extensions found: $(OPTIONALS) + ++EXTRAS+=libiptables.a ++DEVEL_HEADERS+=include/iptables.h include/xtables.h include/libipulog/libipulog.h ++DEVEL_LIBS+=libiptables.a ++ifeq ($(DO_IPV6), 1) ++EXTRAS+=libip6tables.a ++DEVEL_HEADERS+=include/ip6tables.h ++DEVEL_LIBS+=libip6tables.a ++endif ++libiptables.a: libiptables.a(iptables.o) ++libip6tables.a: libip6tables.a(ip6tables.o) ++ + iptables.o: iptables.c + $(CC) $(CFLAGS) -DIPT_LIB_DIR=\"$(IPT_LIBDIR)\" -c -o $@ $< + +@@ -221,7 +232,7 @@ + .PHONY: install-devel-headers + install-devel-headers: $(DEVEL_HEADERS) + @[ -d $(DESTDIR)$(INCDIR) ] || mkdir -p $(DESTDIR)$(INCDIR) +- @cp -v $(DEVEL_HEADERS) $(DESTDIR)$(INCDIR) ++ @cd include && cp -v --parents $(patsubst include/%,%,$(DEVEL_HEADERS)) $(DESTDIR)$(INCDIR) + + .PHONY: install-devel-libs + install-devel-libs: $(DEVEL_LIBS) +--- iptables/libiptc/Makefile ++++ iptables/libiptc/Makefile +@@ -16,8 +16,12 @@ + ifeq ($(DO_IPV6), 1) + EXTRA_DEPENDS+= libiptc/libip6tc.d + libiptc/libiptc.a: libiptc/libiptc.a(libiptc/libip6tc.o) ++DEVEL_HEADERS+=include/libiptc/libip6tc.h + endif + ++DEVEL_LIBS+=libiptc/libiptc.a ++DEVEL_HEADERS+=include/libiptc/libiptc.h include/libiptc/ipt_kernel_headers.h ++ + libiptc/libip4tc.d libiptc/libip6tc.d: %.d: %.c + @-$(CC) -M -MG $(CFLAGS) $< | sed -e 's@^.*\.o:@$*.d libiptc/libiptc.a($*.o):@' > $@ + endif diff --git a/net-firewall/iptables/iptables-1.4.0-r1.ebuild b/net-firewall/iptables/iptables-1.4.0-r1.ebuild new file mode 100644 index 000000000000..02d8a4b48f15 --- /dev/null +++ b/net-firewall/iptables/iptables-1.4.0-r1.ebuild @@ -0,0 +1,191 @@ +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/iptables-1.4.0-r1.ebuild,v 1.1 2007/12/30 15:00:48 vapier Exp $ + +inherit eutils toolchain-funcs linux-info + +L7_PV=2.17 +L7_P=netfilter-layer7-v${L7_PV} + +DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools" +HOMEPAGE="http://www.iptables.org/ http://l7-filter.sf.net/" +SRC_URI="http://iptables.org/projects/iptables/files/${P}.tar.bz2 + l7filter? ( mirror://sourceforge/l7-filter/${L7_P}.tar.gz )" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86" +IUSE="extensions ipv6 l7filter static" + +DEPEND="virtual/os-headers + l7filter? ( virtual/linux-sources )" +RDEPEND="" + +pkg_setup() { + if use l7filter || use extensions ; then + ewarn "WARNING: 3rd party extensions has been enabled." + ewarn "This means that iptables will use your currently installed" + ewarn "kernel in ${KERNEL_DIR} as headers for iptables." + ewarn + if use extensions ; then + ewarn "You may have to patch your kernel to allow iptables to build." + ewarn "Please check http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ for patches" + ewarn "for your kernel." + ewarn + fi + linux-info_pkg_setup + fi + + if kernel_is ge 2 6 20 + then + L7FILE=${KERNEL_DIR}/net/netfilter/xt_layer7.c + else + L7FILE=${KERNEL_DIR}/net/ipv4/netfilter/ipt_layer7.c + fi + if use l7filter && \ + [ ! -f "${L7FILE}" ]; then + die "For layer 7 support emerge net-misc/l7-filter-${L7_PV} before this" + fi +} + +src_unpack() { + unpack ${P}.tar.bz2 + if use l7filter + then + unpack ${L7_P}.tar.gz + fi + cd "${S}" + + epatch "${FILESDIR}"/${P}-dev-files.patch + + # this provide's grsec's stealth match + EPATCH_OPTS="-p0" \ + epatch "${FILESDIR}"/1.3.1-files/grsecurity-1.2.8-iptables.patch-1.3.1 + sed -i \ + -e "s/PF_EXT_SLIB:=/PF_EXT_SLIB:=stealth /g" \ + extensions/Makefile || die "failed to enable stealth extension" + + local check base=${PORTAGE_CONFIGROOT}/etc/portage/patches + for check in {${CATEGORY}/${PF},${CATEGORY}/${P},${CATEGORY}/${PN}}; do + EPATCH_SOURCE=${base}/${CTARGET}/${check} + [[ -r ${EPATCH_SOURCE} ]] || EPATCH_SOURCE=${base}/${CHOST}/${check} + [[ -r ${EPATCH_SOURCE} ]] || EPATCH_SOURCE=${base}/${check} + if [[ -d ${EPATCH_SOURCE} ]] ; then + EPATCH_SUFFIX="patch" + EPATCH_FORCE="yes" \ + EPATCH_MULTI_MSG="Applying user patches from ${EPATCH_SOURCE} ..." \ + epatch + break + fi + done + + if use l7filter ; then + #yes choosing 2.6.20 was deliberate - upstream mistake possibly + if kernel_is ge 2 6 20 + then + L7_PATCH=iptables-1.4-for-kernel-2.6.20forward-layer7-${L7_PV}.patch + else + eerror "Currently there is no l7-filter patch available for this" + eerror "kernel iptables-1.4 and kernel version pre 2.6.20." + eerror "If you need to compile iptables 1.4.x against Linux 2.6.19.x" + eerror "or earlier, with l7-filter patch, please, report upstream." + die "No patch available." + fi + EPATCH_OPTS="-p1" epatch "${WORKDIR}"/${L7_P}/${L7_PATCH} + chmod +x extensions/.layer7-test* + fi + + if ! use extensions ; then + cat <<-EOF > "${S}"/include/linux/compiler.h + #define __user + EOF + fi +} + +src_defs() { + # these are used in both of src_compile and src_install + myconf="" + myconf="${myconf} PREFIX=" + myconf="${myconf} LIBDIR=/$(get_libdir)" + myconf="${myconf} BINDIR=/sbin" + myconf="${myconf} MANDIR=/usr/share/man" + myconf="${myconf} INCDIR=/usr/include" + # iptables and libraries are now installed to /sbin and /lib, so that + # systems with remote network-mounted /usr filesystems can get their + # network interfaces up and running correctly without /usr. + use ipv6 || myconf="${myconf} DO_IPV6=0" + use static && myconf="${myconf} NO_SHARED_LIBS=0" + export myconf + if ! use l7filter && ! use extensions ; then + export KERNEL_DIR=$( + # ugh -- iptables has scripts which check for the existence of + # files so we need to give it the right path to our toolchains + # include dir where the linux headers are. + # FYI IPTABLES: YOU FAIL + echo '#include <linux/limits.h>' | $(tc-getCPP) - | grep -o '/[^"]*linux/limits.h' | sed s:/include/linux/limits.h:: + ) + export KBUILD_OUTPUT=${KERNEL_DIR} + diemsg="failure" + else + diemsg="failure - with l7filter and/or other miscellanious patches added" + fi + export diemsg +} + +src_compile() { + src_defs + emake \ + COPT_FLAGS="${CFLAGS}" ${myconf} \ + CC="$(tc-getCC)" \ + || die "${diemsg}" +} + +src_install() { + src_defs + emake ${myconf} \ + DESTDIR="${D}" \ + KERNEL_DIR="${KERNEL_DIR}" \ + install install-devel || die "${diemsg}" + + dodir /usr/$(get_libdir) + mv -f "${D}"/$(get_libdir)/*.a "${D}"/usr/$(get_libdir) + + keepdir /var/lib/iptables + newinitd "${FILESDIR}"/${PN}-1.3.2.init iptables + newconfd "${FILESDIR}"/${PN}-1.3.2.confd iptables + + if use ipv6 ; then + keepdir /var/lib/ip6tables + newinitd "${FILESDIR}"/iptables-1.3.2.init ip6tables + newconfd "${FILESDIR}"/ip6tables-1.3.2.confd ip6tables + fi +} + +pkg_postinst() { + elog "This package now includes an initscript which loads and saves" + elog "rules stored in /var/lib/iptables/rules-save" + use ipv6 && elog "and /var/lib/ip6tables/rules-save" + elog "This location can be changed in /etc/conf.d/iptables" + elog + elog "If you are using the iptables initsscript you should save your" + elog "rules using the new iptables version before rebooting." + elog + elog "If you are upgrading to a >=2.4.21 kernel you may need to rebuild" + elog "iptables." + elog + ewarn "!!! ipforwarding is not a part of the iptables initscripts." + ewarn + ewarn "To enable ipforwarding at bootup:" + ewarn "/etc/sysctl.conf and set net.ipv4.ip_forward = 1" + if use ipv6 ; then + ewarn "and/or" + ewarn " net.ipv6.ip_forward = 1" + ewarn "for ipv6." + fi + if has_version '=net-firewall/iptables-1.2*' ; then + ewarn + ewarn "When upgrading from iptables-1.2.x, you may be unable to remove" + ewarn "rules added with iptables-1.2.x. This is a known issue, please see:" + ewarn "http://bugs.gentoo.org/92535" + fi +} |