Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
path: root/net-firewall
diff options
context:
space:
mode:
Diffstat (limited to 'net-firewall')
-rw-r--r--net-firewall/firewalld/Manifest2
-rw-r--r--net-firewall/firewalld/firewalld-2.2.1-r1.ebuild2
-rw-r--r--net-firewall/firewalld/firewalld-2.2.3.ebuild2
-rw-r--r--net-firewall/firewalld/firewalld-2.3.0.ebuild (renamed from net-firewall/firewalld/firewalld-2.1.1-r5.ebuild)200
-rw-r--r--net-firewall/firewalld/metadata.xml4
-rw-r--r--net-firewall/xtables-addons/Manifest1
-rw-r--r--net-firewall/xtables-addons/metadata.xml1
-rw-r--r--net-firewall/xtables-addons/xtables-addons-3.27.ebuild107
8 files changed, 207 insertions, 112 deletions
diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest
index c4e167cba6f3..303a9b9e7af9 100644
--- a/net-firewall/firewalld/Manifest
+++ b/net-firewall/firewalld/Manifest
@@ -1,3 +1,3 @@
-DIST firewalld-2.1.1.tar.bz2 1315222 BLAKE2B 064abfae1f2f1c5a63bbbbbec3357aa6e63936818fa2020ca882d1b834736b3735a32b0ab318e6de78b6f785cb4da0ee4e299956c922d9dbf6e7bd442e9bb2d6 SHA512 383e5ea3d451a28241e5a76f8d0efeeb8319663bdc5f680b68c5156ddb5145fac766a9ee9521c4af27b1df82861ca6f68ee81c0588b1dd6c4f6d4e4f5ca8fee1
DIST firewalld-2.2.1.tar.bz2 1295501 BLAKE2B fc7bb401895bc39c34ec585468bdcc1b3c3f8eeb35c786c0cf7d886f456c99840107db73e8f611a7d7ab1db1408c6dc349a3d5eee2fbd1e624fe06dd8a558d91 SHA512 08117be01a25a8e263cf419d7b01a98c80b53108af68f6cfc1d900692e6124c37b9dd6feaf4bc3c6e3f27958a9ee45b9795c7f5a9250eb644b6e903f97672c8a
DIST firewalld-2.2.3.tar.bz2 1310686 BLAKE2B dba517166e1588195ac76123503a2526ffa6c7bd884953ba7ec2806f9ef3a93a879936e48e0d5b638c6e3e888b558757989f8035106cc103eab92d72d8a077be SHA512 e1b1d5fc372359ecbbc074be15e8a9dc4e39836545d5a1364f05deb07eb6e43505eb37589a7b0fb5f3115e3ed3fbc58efe447e2d5b0dcc716a66903c63df824b
+DIST firewalld-2.3.0.tar.bz2 1307839 BLAKE2B f986af940841d7982c44ef5d7df9758f8b8f0e2bd511c61dc358d21e2d272ddc510571bcbdd6c7e47d0bd1ee6250240445094b30945c8de695007c1eb24ed642 SHA512 9a0fe1098c8bbb63bc4af04f56b7810d3d4e94be4247574daba64fb7a344488053f80426b7422c3a4620a54fee69a4264e1b0d66580757aac29aa65d723007c5
diff --git a/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild b/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild
index 4a115f5bf943..5b38b6e28baa 100644
--- a/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild
+++ b/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild
@@ -28,7 +28,7 @@ RDEPEND="
>=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}]
gui? (
x11-libs/gtk+:3
- dev-python/PyQt6[gui,widgets,${PYTHON_USEDEP}]
+ dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
)
')
net-firewall/nftables[xtables(+)]
diff --git a/net-firewall/firewalld/firewalld-2.2.3.ebuild b/net-firewall/firewalld/firewalld-2.2.3.ebuild
index d08a06d0215c..5ed05ae33d83 100644
--- a/net-firewall/firewalld/firewalld-2.2.3.ebuild
+++ b/net-firewall/firewalld/firewalld-2.2.3.ebuild
@@ -28,7 +28,7 @@ RDEPEND="
>=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}]
gui? (
x11-libs/gtk+:3
- dev-python/PyQt6[gui,widgets,${PYTHON_USEDEP}]
+ dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
)
')
net-firewall/nftables[xtables(+)]
diff --git a/net-firewall/firewalld/firewalld-2.1.1-r5.ebuild b/net-firewall/firewalld/firewalld-2.3.0.ebuild
index e1ff652b6c61..5ed05ae33d83 100644
--- a/net-firewall/firewalld/firewalld-2.1.1-r5.ebuild
+++ b/net-firewall/firewalld/firewalld-2.3.0.ebuild
@@ -3,7 +3,7 @@
EAPI=8
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
inherit bash-completion-r1 gnome2-utils linux-info optfeature
inherit plocale python-single-r1 systemd xdg-utils
@@ -13,8 +13,8 @@ SRC_URI="https://github.com/firewalld/firewalld/releases/download/v${PV}/${P}.ta
LICENSE="GPL-2+"
SLOT="0"
-KEYWORDS="amd64 arm arm64 ~loong ppc64 ~riscv x86"
-IUSE="gui +nftables +iptables selinux test"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="gui selinux test"
# Tests are too unreliable in sandbox environment
RESTRICT="!test? ( test ) test"
REQUIRED_USE="${PYTHON_REQUIRED_USE}"
@@ -25,18 +25,13 @@ RDEPEND="
$(python_gen_cond_dep '
dev-python/dbus-python[${PYTHON_USEDEP}]
dev-python/pygobject:3[${PYTHON_USEDEP}]
+ >=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}]
gui? (
x11-libs/gtk+:3
- dev-python/PyQt5[gui,widgets,${PYTHON_USEDEP}]
+ dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
)
- nftables? ( >=net-firewall/nftables-0.9.4[python,json] )
')
- iptables? (
- net-firewall/iptables[ipv6(+)]
- net-firewall/ebtables
- net-firewall/ipset
- nftables? ( net-firewall/nftables[xtables(+)] )
- )
+ net-firewall/nftables[xtables(+)]
selinux? ( sec-policy/selinux-firewalld )
"
DEPEND="
@@ -57,92 +52,94 @@ QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
PLOCALES="ar as ast bg bn_IN ca cs da de el en_GB en_US es et eu fa fi fr gl gu hi hr hu ia id it ja ka kn ko lt ml mr nl or pa pl pt pt_BR ro ru si sk sl sq sr sr@latin sv ta te tr uk zh_CN zh_TW"
PATCHES=(
- "${FILESDIR}"/${PN}-systemd-service.patch
+ "${FILESDIR}"/${PN}-2.2.1-systemd-service.patch
)
pkg_setup() {
# See bug #830132 for the huge list
# We can probably narrow it down a bit but it's rather fragile
- local CONFIG_CHECK="~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK
- ~NETFILTER
- ~NETFILTER_ADVANCED
- ~NETFILTER_INGRESS
- ~NF_NAT_MASQUERADE
- ~NF_NAT_REDIRECT
- ~NF_TABLES_INET
- ~NF_TABLES_IPV4
- ~NF_TABLES_IPV6
- ~NF_CONNTRACK
- ~NF_CONNTRACK_BROADCAST
- ~NF_CONNTRACK_NETBIOS_NS
- ~NF_CONNTRACK_TFTP
- ~NF_CT_NETLINK
- ~NF_CT_NETLINK_HELPER
- ~NF_DEFRAG_IPV4
- ~NF_DEFRAG_IPV6
- ~NF_NAT
- ~NF_NAT_TFTP
- ~NF_REJECT_IPV4
- ~NF_REJECT_IPV6
- ~NF_SOCKET_IPV4
- ~NF_SOCKET_IPV6
- ~NF_TABLES
- ~NF_TPROXY_IPV4
- ~NF_TPROXY_IPV6
- ~IP_NF_FILTER
- ~IP_NF_IPTABLES
- ~IP_NF_MANGLE
- ~IP_NF_NAT
- ~IP_NF_RAW
- ~IP_NF_SECURITY
- ~IP_NF_TARGET_MASQUERADE
- ~IP_NF_TARGET_REJECT
- ~IP6_NF_FILTER
- ~IP6_NF_IPTABLES
- ~IP6_NF_MANGLE
- ~IP6_NF_NAT
- ~IP6_NF_RAW
- ~IP6_NF_SECURITY
- ~IP6_NF_TARGET_MASQUERADE
- ~IP6_NF_TARGET_REJECT
- ~IP_SET
- ~NETFILTER_CONNCOUNT
- ~NETFILTER_NETLINK
- ~NETFILTER_NETLINK_OSF
- ~NETFILTER_NETLINK_QUEUE
- ~NETFILTER_SYNPROXY
- ~NETFILTER_XTABLES
- ~NETFILTER_XT_CONNMARK
- ~NETFILTER_XT_MATCH_CONNTRACK
- ~NETFILTER_XT_MATCH_MULTIPORT
- ~NETFILTER_XT_MATCH_STATE
- ~NETFILTER_XT_NAT
- ~NETFILTER_XT_TARGET_MASQUERADE
- ~NFT_COMPAT
- ~NFT_CT
- ~NFT_FIB
- ~NFT_FIB_INET
- ~NFT_FIB_IPV4
- ~NFT_FIB_IPV6
- ~NFT_HASH
- ~NFT_LIMIT
- ~NFT_LOG
- ~NFT_MASQ
- ~NFT_NAT
- ~NFT_QUEUE
- ~NFT_QUOTA
- ~NFT_REDIR
- ~NFT_REJECT
- ~NFT_REJECT_INET
- ~NFT_REJECT_IPV4
- ~NFT_REJECT_IPV6
- ~NFT_SOCKET
- ~NFT_SYNPROXY
- ~NFT_TPROXY
- ~NFT_TUNNEL
- ~NFT_XFRM"
-
- # kernel >= 4.19 has unified a NF_CONNTRACK module, bug #692944
+ local CONFIG_CHECK="
+ ~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK
+ ~NETFILTER
+ ~NETFILTER_ADVANCED
+ ~NETFILTER_INGRESS
+ ~NF_NAT_MASQUERADE
+ ~NF_NAT_REDIRECT
+ ~NF_TABLES_INET
+ ~NF_TABLES_IPV4
+ ~NF_TABLES_IPV6
+ ~NF_CONNTRACK
+ ~NF_CONNTRACK_BROADCAST
+ ~NF_CONNTRACK_NETBIOS_NS
+ ~NF_CONNTRACK_TFTP
+ ~NF_CT_NETLINK
+ ~NF_CT_NETLINK_HELPER
+ ~NF_DEFRAG_IPV4
+ ~NF_DEFRAG_IPV6
+ ~NF_NAT
+ ~NF_NAT_TFTP
+ ~NF_REJECT_IPV4
+ ~NF_REJECT_IPV6
+ ~NF_SOCKET_IPV4
+ ~NF_SOCKET_IPV6
+ ~NF_TABLES
+ ~NF_TPROXY_IPV4
+ ~NF_TPROXY_IPV6
+ ~IP_NF_FILTER
+ ~IP_NF_IPTABLES
+ ~IP_NF_MANGLE
+ ~IP_NF_NAT
+ ~IP_NF_RAW
+ ~IP_NF_SECURITY
+ ~IP_NF_TARGET_MASQUERADE
+ ~IP_NF_TARGET_REJECT
+ ~IP6_NF_FILTER
+ ~IP6_NF_IPTABLES
+ ~IP6_NF_MANGLE
+ ~IP6_NF_NAT
+ ~IP6_NF_RAW
+ ~IP6_NF_SECURITY
+ ~IP6_NF_TARGET_MASQUERADE
+ ~IP6_NF_TARGET_REJECT
+ ~IP_SET
+ ~NETFILTER_CONNCOUNT
+ ~NETFILTER_NETLINK
+ ~NETFILTER_NETLINK_OSF
+ ~NETFILTER_NETLINK_QUEUE
+ ~NETFILTER_SYNPROXY
+ ~NETFILTER_XTABLES
+ ~NETFILTER_XT_CONNMARK
+ ~NETFILTER_XT_MATCH_CONNTRACK
+ ~NETFILTER_XT_MATCH_MULTIPORT
+ ~NETFILTER_XT_MATCH_STATE
+ ~NETFILTER_XT_NAT
+ ~NETFILTER_XT_TARGET_MASQUERADE
+ ~NFT_COMPAT
+ ~NFT_CT
+ ~NFT_FIB
+ ~NFT_FIB_INET
+ ~NFT_FIB_IPV4
+ ~NFT_FIB_IPV6
+ ~NFT_HASH
+ ~NFT_LIMIT
+ ~NFT_LOG
+ ~NFT_MASQ
+ ~NFT_NAT
+ ~NFT_QUEUE
+ ~NFT_QUOTA
+ ~NFT_REDIR
+ ~NFT_REJECT
+ ~NFT_REJECT_INET
+ ~NFT_REJECT_IPV4
+ ~NFT_REJECT_IPV6
+ ~NFT_SOCKET
+ ~NFT_SYNPROXY
+ ~NFT_TPROXY
+ ~NFT_TUNNEL
+ ~NFT_XFRM
+ "
+
+ # kernel >= 4.19 has a unified NF_CONNTRACK module, bug #692944
if kernel_is -lt 4 19; then
CONFIG_CHECK+=" ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6"
fi
@@ -177,13 +174,6 @@ src_configure() {
local myeconfargs=(
--enable-systemd
- $(use_with iptables iptables "${EPREFIX}/sbin/iptables")
- $(use_with iptables iptables_restore "${EPREFIX}/sbin/iptables-restore")
- $(use_with iptables ip6tables "${EPREFIX}/sbin/ip6tables")
- $(use_with iptables ip6tables_restore "${EPREFIX}/sbin/ip6tables-restore")
- $(use_with iptables ebtables "${EPREFIX}/sbin/ebtables")
- $(use_with iptables ebtables_restore "${EPREFIX}/sbin/ebtables-restore")
- $(use_with iptables ipset "${EPREFIX}/usr/sbin/ipset")
--with-systemd-unitdir="$(systemd_get_systemunitdir)"
--with-bashcompletiondir="$(get_bashcompdir)"
)
@@ -196,15 +186,15 @@ src_install() {
python_optimize
# Get rid of junk
- rm -rf "${D}/etc/sysconfig/" || die
+ rm -rf "${ED}"/etc/sysconfig/ || die
# For non-gui installs we need to remove GUI bits
if ! use gui; then
- rm -rf "${D}/etc/xdg/autostart" || die
- rm -f "${D}/usr/bin/firewall-applet" || die
- rm -f "${D}/usr/bin/firewall-config" || die
- rm -rf "${D}/usr/share/applications" || die
- rm -rf "${D}/usr/share/icons" || die
+ rm -rf "${ED}"/etc/xdg/autostart || die
+ rm -f "${ED}"/usr/bin/firewall-applet || die
+ rm -f "${ED}"/usr/bin/firewall-config || die
+ rm -rf "${ED}"/usr/share/applications || die
+ rm -rf "${ED}"/usr/share/icons || die
fi
newinitd "${FILESDIR}"/firewalld.init firewalld
diff --git a/net-firewall/firewalld/metadata.xml b/net-firewall/firewalld/metadata.xml
index 79917d81993e..d9b61b18aba8 100644
--- a/net-firewall/firewalld/metadata.xml
+++ b/net-firewall/firewalld/metadata.xml
@@ -9,10 +9,6 @@
<email>sam@gentoo.org</email>
<name>Sam James</name>
</maintainer>
- <use>
- <flag name="nftables">Add support for <pkg>net-firewall/nftables</pkg> as firewall backend</flag>
- <flag name="iptables">Add support for <pkg>net-firewall/iptables</pkg> as firewall backend</flag>
- </use>
<upstream>
<remote-id type="github">firewalld/firewalld</remote-id>
</upstream>
diff --git a/net-firewall/xtables-addons/Manifest b/net-firewall/xtables-addons/Manifest
index 9dfa189cce62..c7600d5d4f47 100644
--- a/net-firewall/xtables-addons/Manifest
+++ b/net-firewall/xtables-addons/Manifest
@@ -1 +1,2 @@
DIST xtables-addons-3.24.tar.xz 335724 BLAKE2B c086616c0366346bd87813ae0fc561bdb8f892eecea19ef88c65afef5318ac6f75fec658e0c6595de5c620c965b2bd7f10e45ff3ec55ffb9ddf8e85643190e7e SHA512 08c3b87617e0124aef99a3953fc5e03e8d98be50ce70771e352509ec64263d5256f744489f10f39879630d9dc8d28f3c91173b4739c95bbd8d5ad56e33138eb4
+DIST xtables-addons-3.27.tar.xz 340360 BLAKE2B 5b82069e21464bc293d76c6cd298e6beafdda57bc07582be64d7ff9a5511741bd1acd9a54a7b1caa08631d108a17b51dc7e7c2926003e6a893b1df0f6b360b62 SHA512 1938342914c24621743d0460e4057ffa6d3b6d01f3d0ca5feaa3852675f18c309f57fcb73725972d4aa87b7da92667efffa16e203f4cd1362cb8bb03a116636a
diff --git a/net-firewall/xtables-addons/metadata.xml b/net-firewall/xtables-addons/metadata.xml
index 22c9b77bb8cd..461cf8e0f052 100644
--- a/net-firewall/xtables-addons/metadata.xml
+++ b/net-firewall/xtables-addons/metadata.xml
@@ -13,5 +13,6 @@
</longdescription>
<upstream>
<remote-id type="sourceforge">xtables-addons</remote-id>
+ <remote-id type="codeberg">jengelh/xtables-addons</remote-id>
</upstream>
</pkgmetadata>
diff --git a/net-firewall/xtables-addons/xtables-addons-3.27.ebuild b/net-firewall/xtables-addons/xtables-addons-3.27.ebuild
new file mode 100644
index 000000000000..dd7a313409cf
--- /dev/null
+++ b/net-firewall/xtables-addons/xtables-addons-3.27.ebuild
@@ -0,0 +1,107 @@
+# Copyright 2023-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MODULES_OPTIONAL_IUSE="+modules"
+inherit flag-o-matic linux-mod-r1
+
+XTABLES_MODULES=(
+ account chaos delude dhcpmac dnetmap echo ipmark logmark
+ proto sysrq tarpit asn condition fuzzy geoip gradm iface
+ ipp2p ipv4options length2 lscan pknock psd quota2
+)
+
+MODULES_KERNEL_MIN=4.15
+
+DESCRIPTION="iptables extensions not yet accepted in the main kernel"
+HOMEPAGE="
+ https://inai.de/projects/xtables-addons/
+ https://codeberg.org/jengelh/xtables-addons/
+"
+SRC_URI="https://inai.de/files/xtables-addons/${P}.tar.xz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="${XTABLES_MODULES[*]/#/xtables_addons_}"
+
+XTABLES_SCRIPTS_DEPEND="
+ app-arch/unzip
+ dev-perl/Net-CIDR-Lite
+ dev-perl/Text-CSV_XS
+ virtual/perl-Getopt-Long
+"
+DEPEND="net-firewall/iptables:="
+RDEPEND="
+ ${DEPEND}
+ xtables_addons_asn? ( ${XTABLES_SCRIPTS_DEPEND} )
+ xtables_addons_geoip? ( ${XTABLES_SCRIPTS_DEPEND} )
+"
+
+pkg_setup() {
+ local CONFIG_CHECK="NF_CONNTRACK NF_CONNTRACK_MARK"
+
+ if use xtables_addons_pknock; then
+ CONFIG_CHECK+=" ~CONNECTOR"
+ local ERROR_CONNECTOR="CONFIG_CONNECTOR: is not set but is needed to receive userspace
+ notifications from pknock through netlink/connector"
+ fi
+
+ linux-mod-r1_pkg_setup
+}
+
+src_prepare() {
+ default
+
+ local mod modules
+ mapfile -t modules < <(sed -En 's/^build_(.+)=.*/\L\1/p' mconfig || die)
+ [[ ${modules[*]} == "${XTABLES_MODULES[*]}" ]] ||
+ die "XTABLES_MODULES needs to be updated to: '${modules[*]}'"
+
+ for mod in "${modules[@]}"; do
+ use xtables_addons_${mod} || sed -i "/^build_${mod}=/Id" mconfig || die
+ done
+}
+
+src_configure() {
+ # Uses CFLAGS for tools, and it may mismatch with the kernel's CC
+ # FIXME?: ideally would want to build tools with normal CC
+ use modules && CC=${KERNEL_CC} strip-unsupported-flags
+
+ local econfargs=(
+ # TODO?: should move to ${EPREFIX}/usr + use default libexecdir by now
+ # (matching documentation), but could be a disruptive change for users
+ # with xt_asn/geoip_* paths they may have hardcoded in scripts
+ --prefix="${EPREFIX:-/}"
+ --libexecdir="${EPREFIX}"/$(get_libdir)
+ $(usex modules --with-kbuild="${KV_OUT_DIR}" --without-kbuild)
+ )
+
+ econf "${econfargs[@]}"
+}
+
+src_compile() {
+ use modules || MODULES_MAKEARGS=()
+
+ emake "${MODULES_MAKEARGS[@]}"
+}
+
+src_install() {
+ MODULES_MAKEARGS+=(
+ DESTDIR="${D}"
+ INSTALL_MOD_DIR=xtables_addons
+ )
+
+ emake "${MODULES_MAKEARGS[@]}" install
+ modules_post_process
+
+ dodoc -r README.rst doc/.
+
+ use xtables_addons_asn ||
+ find "${ED}" -type f -name '*_asn*' -delete || die
+ use xtables_addons_geoip ||
+ find "${ED}" -type f -name '*_geoip*' -delete || die
+
+ find "${ED}" -type f -name '*.la' -delete || die
+}