From abf34ce024c176aa0bc10c0d84b0b33bc51a4c3e Mon Sep 17 00:00:00 2001 From: Ilya Tumaykin Date: Mon, 23 Nov 2015 17:26:19 +0300 Subject: net-firewall/fwknop: revbump to fix depend() and update regexps in initscript FWKNOPD_CONFIG file should be parsed only if it exists, which is not the case if the user has not configured fwknopd yet. See Gentoo bug #565864. Regexps that are used to parse FWKNOPD_CONFIG file now allow spaces before statements in order to handle possible indentation properly. Gentoo-Bug: 565864 --- net-firewall/fwknop/files/fwknopd.init-r1 | 92 ++++++++++++++++++++ net-firewall/fwknop/fwknop-2.6.7-r1.ebuild | 135 +++++++++++++++++++++++++++++ 2 files changed, 227 insertions(+) create mode 100644 net-firewall/fwknop/files/fwknopd.init-r1 create mode 100644 net-firewall/fwknop/fwknop-2.6.7-r1.ebuild (limited to 'net-firewall') diff --git a/net-firewall/fwknop/files/fwknopd.init-r1 b/net-firewall/fwknop/files/fwknopd.init-r1 new file mode 100644 index 000000000000..9e8ecdc36d97 --- /dev/null +++ b/net-firewall/fwknop/files/fwknopd.init-r1 @@ -0,0 +1,92 @@ +#!/sbin/runscript +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +extra_commands="checkconfig" +extra_started_commands="reload" + +: ${FWKNOPD_BINARY:=/usr/sbin/fwknopd} +: ${FWKNOPD_CONFDIR:=/etc/fwknop} +: ${FWKNOPD_CONFIG:=${FWKNOPD_CONFDIR}/fwknopd.conf} +: ${FWKNOPD_PIDFILE:=/run/fwknop/${SVCNAME}.pid} + +depend() { + after iptables ip6tables ebtables firewall + use logger + if [ "${rc_need+set}" = "set" ]; then + : # Do nothing, the user has explicitly set rc_need + elif [ -f "${FWKNOPD_CONFIG}" ]; then + local x warn_intf + for x in $(awk '/^[[:blank:]]*PCAP_INTF/{ sub(";$", ""); print $2 }' "${FWKNOPD_CONFIG}" 2>/dev/null); do + warn_intf="${warn_intf} ${x}" + done + if [ -n "${warn_intf}" ]; then + need net + ewarn "You are binding an interface in PCAP_INTF statement in your fwknopd.conf!" + ewarn "You must add rc_need=\"net.FOO\" to your /etc/conf.d/${SVCNAME}," + ewarn "where FOO is the following interface(s):" + ewarn "${warn_intf}" + else + # If PCAP_INTF and PCAP_FILE are not set, then fwknopd uses eth0 + if ! grep -q '^[[:blank:]]*PCAP_FILE' "${FWKNOPD_CONFIG}"; then + need net + ewarn "You are not binding any interface in PCAP_INTF statement in your fwknopd.conf," + ewarn "neither you are providing PCAP_FILE option. Thus fwknopd will listen on eth0." + ewarn "You must add rc_need=\"net.eth0\" to your /etc/conf.d/${SVCNAME}." + fi + fi + fi +} + +checkconfig() { + if [ ! -e "${FWKNOPD_CONFDIR}"/fwknopd.conf ]; then + eerror "You need ${FWKNOPD_CONFDIR}/fwknopd.conf file to run fwknopd" + eerror "Example is located at /etc/fwknop/fwknopd.conf.example" + return 1 + fi + + if [ ! -e "${FWKNOPD_CONFDIR}"/access.conf ]; then + eerror "You need ${FWKNOPD_CONFDIR}/access.conf file to run fwknopd" + eerror "Example is located at /etc/fwknop/access.conf.example" + return 1 + fi + + [ "${FWKNOPD_PIDFILE}" != "/run/fwknop/${SVCNAME}.pid" ] \ + && FWKNOPD_OPTS="${FWKNOPD_OPTS} --pid-file=${FWKNOPD_PIDFILE}" + + [ "${FWKNOPD_CONFDIR}" != "/etc/fwknop" ] \ + && FWKNOPD_OPTS="${FWKNOPD_OPTS} \ + --config=${FWKNOPD_CONFDIR}/fwknopd.conf \ + --access-file=${FWKNOPD_CONFDIR}/access.conf" + + return 0 +} + +start() { + checkconfig || return 1 + + ebegin "Starting ${SVCNAME}" + start-stop-daemon --start \ + --exec ${FWKNOPD_BINARY} --pidfile ${FWKNOPD_PIDFILE} \ + -- ${FWKNOPD_OPTS} + eend $? +} + +stop() { + if [ "${RC_CMD}" = "restart" ]; then + checkconfig || return 1 + fi + + ebegin "Stopping ${SVCNAME}" + start-stop-daemon --stop --pidfile ${FWKNOPD_PIDFILE} + eend $? +} + +reload() { + checkconfig || return 1 + + ebegin "Reloading ${SVCNAME} configuration" + start-stop-daemon --signal HUP --pidfile ${FWKNOPD_PIDFILE} + eend $? +} diff --git a/net-firewall/fwknop/fwknop-2.6.7-r1.ebuild b/net-firewall/fwknop/fwknop-2.6.7-r1.ebuild new file mode 100644 index 000000000000..1a798bd79f1f --- /dev/null +++ b/net-firewall/fwknop/fwknop-2.6.7-r1.ebuild @@ -0,0 +1,135 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=5 + +AUTOTOOLS_AUTORECONF=1 +DISABLE_AUTOFORMATTING=1 + +DISTUTILS_OPTIONAL=1 +# Python extension supports only Python2 +# See https://github.com/mrash/fwknop/issues/167 +PYTHON_COMPAT=( python2_7 ) + +inherit autotools-utils distutils-r1 linux-info readme.gentoo systemd + +DESCRIPTION="Single Packet Authorization and Port Knocking application" +HOMEPAGE="http://www.cipherdyne.org/fwknop/" +SRC_URI="https://github.com/mrash/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="client extras firewalld gdbm gpg iptables python server udp-server" + +RDEPEND=" + client? ( net-misc/wget[ssl] ) + gpg? ( + dev-libs/libassuan + dev-libs/libgpg-error + ) + python? ( ${PYTHON_DEPS} ) +" +DEPEND="${RDEPEND} + gdbm? ( sys-libs/gdbm ) + gpg? ( app-crypt/gpgme ) + firewalld? ( net-firewall/firewalld[${PYTHON_USEDEP}] ) + iptables? ( net-firewall/iptables ) + server? ( !udp-server? ( net-libs/libpcap ) ) +" + +REQUIRED_USE=" + python? ( ${PYTHON_REQUIRED_USE} ) + firewalld? ( server ) + iptables? ( server ) + server? ( ^^ ( firewalld iptables ) ) + udp-server? ( server ) +" + +DOCS=( ChangeLog README.md ) +DOC_CONTENTS=" +Example configuration files were installed in /etc/fwknopd directory. +Please edit them to fit your needs and then remove the .example suffix. + +fwknopd supports several backends: firewalld, iptables, ipfw, pf, ipf. +You can set the desired backend via FIREWALL_EXE option in fwknopd.conf +instead of the default one chosen at compile time. +" + +pkg_pretend() { + if use server; then + if ! linux_config_exists || ! linux_chkconfig_present NETFILTER_XT_MATCH_COMMENT; then + ewarn "fwknopd uses the iptables 'comment' match to expire SPA rules," + ewarn "which is a major security feature and is enabled by default." + ewarn "Please either enable NETFILTER_XT_MATCH_COMMENT support in your" + ewarn "kernel, or set the appropriate ENABLE_{FIREWD,IPT}_COMMENT_CHECK" + ewarn "to 'N' in your fwknopd.conf file." + fi + fi +} + +src_prepare() { + # Install example configs with .example suffix + if use server; then + sed -i -e 's/conf;/conf.example;/g' "${S}"/Makefile.am || die + fi + + autotools-utils_src_prepare + + if use python; then + cd "${S}"/python || die + distutils-r1_src_prepare + fi +} + +src_configure() { + local myeconfargs=( + --localstatedir=/run + --enable-digest-cache + $(use_enable client) + $(use_enable !gdbm file-cache) + $(use_enable server) + $(use_enable udp-server) + $(use_with gpg gpgme) + ) + use firewalld && myeconfargs+=(--with-firewalld=/usr/sbin/firewalld) + use iptables && myeconfargs+=(--with-iptables=/sbin/iptables) + + autotools-utils_src_configure +} + +src_compile() { + autotools-utils_src_compile + + if use python; then + cd "${S}"/python || die + distutils-r1_src_compile + fi +} + +src_install() { + autotools-utils_src_install + prune_libtool_files --modules + + if use server; then + newinitd "${FILESDIR}/fwknopd.init-r1" fwknopd + newconfd "${FILESDIR}/fwknopd.confd" fwknopd + systemd_dounit extras/systemd/fwknopd.service + systemd_newtmpfilesd extras/systemd/fwknopd.tmpfiles.conf fwknopd.conf + readme.gentoo_create_doc + fi + + use extras && dodoc "${S}/extras/apparmor/usr.sbin.fwknopd" + + if use python; then + # Unset DOCS since distutils-r1.eclass interferes + local DOCS=() + cd "${S}"/python || die + distutils-r1_src_install + fi +} + +pkg_postinst() { + use server && readme.gentoo_print_elog +} -- cgit v1.2.3-65-gdbad