Version bump #98641 by Lars (Polynomial-C). Unified the iptables/ip6tables

  init.d scripts.  Added a new panic option to init.d #72033 by Colin
  Kingsley.
Package-Manager: portage-2.0.51.22-r1

8 files changed, 319 insertions, 21 deletions

diff --git a/net-firewall/iptables/ChangeLog b/net-firewall/iptables/ChangeLog
index 77b98f46976f..5fd73178f6ed 100644
--- a/net-firewall/iptables/ChangeLog
+++ b/net-firewall/iptables/ChangeLog
@@ -1,17 +1,15 @@
 # ChangeLog for net-firewall/iptables
 # Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.73 2005/05/30 17:21:42 ferdy Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/ChangeLog,v 1.74 2005/07/12 02:38:29 vapier Exp $
 
-  30 May 2005; Fernando J. Pereda <ferdy@gentoo.org>
-  iptables-1.3.1-r4.ebuild:
-  marked ~alpha wrt bug #91285
+*iptables-1.3.2 (12 Jul 2005)
 
-  15 May 2005; Rene Nussbaumer <killerfox@gentoo.org>
-  iptables-1.3.1-r4.ebuild:
-  added ~hppa
-
-  09 May 2005; Aron Griffis <agriffis@gentoo.org> iptables-1.3.1-r4.ebuild:
-  add ~ia64 #91285
+  12 Jul 2005; Mike Frysinger <vapier@gentoo.org>
+  +files/ip6tables-1.3.2.confd, +files/iptables-1.3.2.confd,
+  +files/iptables-1.3.2.init, +iptables-1.3.2.ebuild:
+  Version bump #98641 by Lars (Polynomial-C).  Unified the iptables/ip6tables
+  init.d scripts.  Added a new 'panic' option to init.d #72033 by Colin 
+  Kingsley.
 
 *iptables-1.3.1-r4 (05 May 2005)
 
diff --git a/net-firewall/iptables/Manifest b/net-firewall/iptables/Manifest
index 595451b1c4bf..7e4ea3bc9eca 100644
--- a/net-firewall/iptables/Manifest
+++ b/net-firewall/iptables/Manifest
@@ -1,27 +1,30 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-MD5 c3c8e3209d4ad007c2b08cc4a3ec20d9 metadata.xml 224
-MD5 cdf47a369303ed0da3bb2f6888dc1aa8 iptables-1.2.7a-r3.ebuild 1982
+MD5 9a09f8d531c582e78977dbfd96edc1f2 metadata.xml 164
+MD5 099c4bec61b25509119be3611e139c11 iptables-1.2.7a-r3.ebuild 1981
 MD5 ec86656320117bca34ac66944d47a0f8 iptables-1.3.1-r4.ebuild 5611
-MD5 a7d32873a52696ae48ea42fafc0504df iptables-1.2.9-r4.ebuild 5424
-MD5 fa4c44cc48b081db8694187f5e517e05 iptables-1.2.9-r1.ebuild 3518
-MD5 28dbcce8faa662b34f891a0886756452 iptables-1.2.11-r2.ebuild 5368
+MD5 9e0f8c58618de88773070af5a1522cdd iptables-1.2.9-r4.ebuild 5422
+MD5 156b80272ca92ece8d8dcff494cde59f iptables-1.2.9-r1.ebuild 3516
+MD5 342fd9b3fa0a056fb04531d11bf789b4 iptables-1.3.2.ebuild 4910
 MD5 9895e3a55df2ef6533205b1ed5c2ce7c iptables-1.2.11-r3.ebuild 5500
-MD5 32a2db1f34e7a7e3690aa59aa0855dd1 iptables-1.2.9.ebuild 2800
-MD5 819fbf3283d1f25295f1453b1a5752ab ChangeLog 18241
-MD5 1457a4df1ce1faccfaccc8c7208bc432 files/digest-iptables-1.2.11-r2 68
+MD5 16422469f0e4336f1e84ba6f46644050 iptables-1.2.9.ebuild 2798
+MD5 e2e40868680919cad2bf188bdf20bdac ChangeLog 18296
+MD5 db00dffc05d70ea96abce1c50171c51e files/iptables-1.3.2.init 2547
 MD5 9366ae3d4d34c4dbf665b8539c609dd0 files/digest-iptables-1.2.9 67
+MD5 b428a4b8ebd4353f3f2365bdf4da7a04 files/digest-iptables-1.3.2 206
 MD5 dd4f4563c89d33fc6987043d95531e05 files/ip6tables-1.2.9-r1.confd 266
 MD5 e16ca98d9b770d5e61b3eb760b13b7c7 files/ip6tables.confd 384
 MD5 8ac77b3fbebfb5ceb9c6166823afe21d files/iptables-1.2.9-r1.init 1829
 MD5 f74f2424c062e1b2f4b22e4e11db909b files/ip6tables-1.2.9-r1.init 1792
 MD5 23c4c7ee1b86cd191e7b17b046289c91 files/iptables-1.2.9-hppa.patch.bz2 278
 MD5 1d34d1326df13874bd2f1997f3ee4d59 files/sparc64_limit_fix.patch.bz2 1227
+MD5 dbef6253ff7e347e7fa35a02652ab684 files/ip6tables-1.3.2.confd 293
 MD5 9366ae3d4d34c4dbf665b8539c609dd0 files/digest-iptables-1.2.9-r4 67
 MD5 183ec92f9fee7f072d9edb36917b4f9e files/digest-iptables-1.2.7a-r3 68
 MD5 a61713bd63ee1e4eb188441037150629 files/ip6tables.init 2027
 MD5 4e055c59114fd6abc5a27bdaa97d2946 files/iptables-1.2.9-r1.confd 264
+MD5 956ebf5ab69e5a1e1d3983541eab643b files/iptables-1.3.2.confd 290
 MD5 1457a4df1ce1faccfaccc8c7208bc432 files/digest-iptables-1.2.11-r3 68
 MD5 c237fdc6fd86d64642da7c9751d317af files/digest-iptables-1.3.1-r4 206
 MD5 4a52b038ea76ac543c9ecc1bf93a4142 files/iptables.init 2063
@@ -53,7 +56,7 @@ MD5 c4f9d5d795f4ab2c221681e55ebac8dd files/1.2.7a-files/02_all_imq.patch.bz2 293
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (GNU/Linux)
 
-iD8DBQFC0x99gIKl8Uu19MoRAngvAJ9vfhx9oDqac5pEHpKyNJAlURCIJwCfRD5F
-2MiYvr02Xk7iCjzPG0+aB/g=
-=/KS8
+iD8DBQFC0y1wgIKl8Uu19MoRAl/bAJ9V+GFcRgwf4cFkUNWb3eBH5j5ZlACdE4HQ
+OKR/yTreO6/G9jxSAcbz+lY=
+=iMSV
 -----END PGP SIGNATURE-----
diff --git a/net-firewall/iptables/files/digest-iptables-1.3.2 b/net-firewall/iptables/files/digest-iptables-1.3.2
new file mode 100644
index 000000000000..eb3d054b2ad9
--- /dev/null
+++ b/net-firewall/iptables/files/digest-iptables-1.3.2
@@ -0,0 +1,3 @@
+MD5 9a951971de3f6c7f60dece4023a48687 iptables-1.3.2.tar.bz2 186255
+MD5 9adae8be9562775a176fc1b275b3cb29 iptables-1.3.0-imq1.diff 5369
+MD5 24963993a6f0727206a3a2d1a9c5e83b netfilter-layer7-v1.2.tar.gz 71697
diff --git a/net-firewall/iptables/files/ip6tables-1.3.2.confd b/net-firewall/iptables/files/ip6tables-1.3.2.confd
new file mode 100644
index 000000000000..93c0bc89b38a
--- /dev/null
+++ b/net-firewall/iptables/files/ip6tables-1.3.2.confd
@@ -0,0 +1,11 @@
+# /etc/conf.d/ip6tables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
diff --git a/net-firewall/iptables/files/iptables-1.3.2.confd b/net-firewall/iptables/files/iptables-1.3.2.confd
new file mode 100644
index 000000000000..91287debdbcf
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.3.2.confd
@@ -0,0 +1,11 @@
+# /etc/conf.d/iptables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IPTABLES_SAVE="/var/lib/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"
diff --git a/net-firewall/iptables/files/iptables-1.3.2.init b/net-firewall/iptables/files/iptables-1.3.2.init
new file mode 100755
index 000000000000..e58d2b770145
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.3.2.init
@@ -0,0 +1,111 @@
+#!/sbin/runscript
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.3.2.init,v 1.1 2005/07/12 02:38:29 vapier Exp $
+
+opts="save reload panic"
+
+iptables_name=${SVCNAME}
+if [[ ${iptables_name} != "iptables" && ${iptables_name} != "ip6tables" ]] ; then
+	iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+	iptables)  iptables_proc="/proc/net/ip_tables_names"
+	           iptables_save=${IPTABLES_SAVE};;
+	ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+	           iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+	before net
+	use logger
+}
+
+set_table_policy() {
+	local chains table=$1 policy=$2
+	case ${table} in
+		nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+		mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+		filter) chains="INPUT FORWARD OUTPUT";;
+		*)      chains="";;
+	esac
+	local chain
+	for chain in ${chains} ; do
+		${iptables_bin} -t ${table} -P ${chain} ${policy}
+	done
+}
+
+checkkernel() {
+	if [[ ! -e ${iptables_proc} ]] ; then
+		eerror "Your kernel lacks ${iptables_name} support, please load"
+		eerror "appropriate modules and try again."
+		return 1
+	fi
+	return 0
+}
+checkconfig() {
+	if [[ ! -f ${iptables_save} ]] ; then
+		eerror "Not starting ${iptables_name}.  First create some rules then run:"
+		eerror "/etc/init.d/${iptables_name} save"
+		return 1
+	fi
+	return 0
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Loading ${iptables_name} state and starting firewall"
+	${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+	eend $?
+}
+
+stop() {
+	if [[ ${SAVE_ON_STOP} == "yes" ]] ; then
+		save || return 1
+	fi
+	checkkernel || return 1
+	ebegin "Stopping firewall"
+	for a in $(<${iptables_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+
+		set_table_policy $a ACCEPT
+	done
+	eend $?
+}
+
+reload() {
+	checkkernel || return 1
+	ebegin "Flushing firewall"
+	for a in $(<${iptabes_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+	done
+	eend $?
+
+	start
+}
+
+save() {
+	ebegin "Saving ${iptables_name} state"
+	touch "${iptables_save}"
+	chmod 0600 "${iptables_save}"
+	${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+	eend $?
+}
+
+panic() {
+	checkkernel || return 1
+	[[ -e ${svcdir}/started/${iptables_name} ]] && svc_stop
+
+	ebegin "Dropping all packets"
+	for a in $(<${iptables_proc}) ; do
+		${iptables_bin} -F -t $a
+		${iptables_bin} -X -t $a
+
+		set_table_policy $a DROP
+	done
+	eend $?
+}
diff --git a/net-firewall/iptables/iptables-1.3.2.ebuild b/net-firewall/iptables/iptables-1.3.2.ebuild
new file mode 100644
index 000000000000..1866136df23d
--- /dev/null
+++ b/net-firewall/iptables/iptables-1.3.2.ebuild
@@ -0,0 +1,158 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/iptables-1.3.2.ebuild,v 1.1 2005/07/12 02:38:29 vapier Exp $
+
+inherit eutils flag-o-matic toolchain-funcs linux-info
+
+L7_PN="netfilter-layer7"
+L7_PV="1.2"
+L7_P="${L7_PN}-v${L7_PV}"
+L7_PATCH="iptables-layer7-${L7_PV}.patch"
+IMQ_PATCH="iptables-1.3.0-imq1.diff"
+
+DESCRIPTION="Linux kernel (2.4+) firewall, NAT and packet mangling tools"
+HOMEPAGE="http://www.iptables.org/"
+SRC_URI="http://www.iptables.org/files/${P}.tar.bz2
+	extensions? (
+		http://www.linuximq.net/patchs/${IMQ_PATCH}
+		mirror://sourceforge/l7-filter/${L7_P}.tar.gz
+	)"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="-*" #~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="ipv6 static extensions"
+
+DEPEND="virtual/os-headers
+	extensions? ( virtual/linux-sources )"
+RDEPEND=""
+
+pkg_setup() {
+	if use extensions ; then
+		ewarn "WARNING: 3rd party extensions has been enabled."
+		ewarn "This means that iptables will use your currently installed"
+		ewarn "kernel in ${KERNEL_DIR} as headers for iptables."
+		ewarn
+		ewarn "You may have to patch your kernel to allow iptables to build."
+		ewarn "Please check http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ for patches"
+		ewarn "for your kernel."
+		ewarn
+		ewarn "For layer 7 support emerge net-misc/l7-filter-${L7_PV} before this"
+		linux-info_pkg_setup
+	fi
+}
+
+src_unpack() {
+	unpack ${P}.tar.bz2
+	use extensions && unpack ${L7_P}.tar.gz
+	cd "${S}"
+
+	EPATCH_OPTS="-p0" \
+	epatch "${FILESDIR}"/1.3.1-files/install_ipv6_apps.patch.bz2
+	EPATCH_OPTS="-p1" \
+	epatch "${FILESDIR}"/1.3.1-files/install_all_dev_files.patch-1.3.1.bz2
+
+	# this provide's grsec's stealth match
+	EPATCH_OPTS="-p0" \
+	epatch "${FILESDIR}"/1.3.1-files/grsecurity-1.2.8-iptables.patch-1.3.1.bz2
+
+	sed -i \
+		-e "s/PF_EXT_SLIB:=/PF_EXT_SLIB:=stealth /g" \
+		extensions/Makefile \
+		|| die "failed to enable stealth extension"
+
+	EPATCH_OPTS="-p1" \
+	epatch "${FILESDIR}"/1.3.1-files/${PN}-1.3.1-compilefix.patch
+
+	if use extensions ; then
+		EPATCH_OPTS="-p1" epatch ${DISTDIR}/${IMQ_PATCH}
+		EPATCH_OPTS="-p1" epatch ${WORKDIR}/${L7_P}/${L7_PATCH}
+		chmod +x extensions/{.IMQ-test*,.childlevel-test*,.layer7-test*}
+	fi
+}
+
+
+src_defs() {
+	# these are used in both of src_compile and src_install
+	myconf="${myconf} PREFIX="
+	myconf="${myconf} LIBDIR=/$(get_libdir)"
+	myconf="${myconf} BINDIR=/sbin"
+	myconf="${myconf} MANDIR=/usr/share/man"
+	myconf="${myconf} INCDIR=/usr/include"
+	# iptables and libraries are now installed to /sbin and /lib, so that
+	# systems with remote network-mounted /usr filesystems can get their
+	# network interfaces up and running correctly without /usr.
+	use ipv6 || myconf="${myconf} DO_IPV6=0"
+	use static && myconf="${myconf} NO_SHARED_LIBS=0"
+	export myconf
+	if ! use extensions ; then
+		export KERNEL_DIR="/usr"
+		diemsg=""
+	else
+		diemsg="Please check http://cvs.iptables.org/patch-o-matic-ng/updates/ if your kernel needs to be patched for iptables"
+	fi
+	export diemsg
+}
+
+
+src_compile() {
+	src_defs
+
+	# iptables will NOT work correctly unless -O[123] are present!
+	replace-flags -O0 -O2
+	get-flag -O || append-flags -O2
+
+	# prevent it from causing ICMP errors.
+	# http://bugs.gentoo.org/show_bug.cgi?id=23645
+	filter-flags -fstack-protector
+
+	emake -j1 \
+		COPT_FLAGS="${CFLAGS}" ${myconf} \
+		KERNEL_DIR="${KERNEL_DIR}" \
+		CC="$(tc-getCC)" \
+		|| die "${diemsg}"
+}
+
+src_install() {
+	src_defs
+	make ${myconf} \
+		DESTDIR="${D}" \
+		KERNEL_DIR="${KERNEL_DIR}" \
+		install install-devel || die "${diemsg}"
+
+	dodir /usr/$(get_libdir)
+	mv -f "${D}"/$(get_libdir)/*.a "${D}"/usr/$(get_libdir)
+
+	keepdir /var/lib/iptables
+	newinitd "${FILESDIR}"/${PN}-1.3.2.init iptables
+	newconfd "${FILESDIR}"/${PN}-1.3.2.confd iptables
+
+	if use ipv6 ; then
+		keepdir /var/lib/ip6tables
+		newinitd "${FILESDIR}"/iptables-1.3.2.init ip6tables
+		newconfd "${FILESDIR}"/ip6tables-1.3.2.confd ip6tables
+	fi
+}
+
+pkg_postinst() {
+	einfo "This package now includes an initscript which loads and saves"
+	einfo "rules stored in /var/lib/iptables/rules-save"
+	use ipv6 && einfo "and /var/lib/ip6tables/rules-save"
+	einfo "This location can be changed in /etc/conf.d/iptables"
+	einfo
+	einfo "If you are using the iptables initsscript you should save your"
+	einfo "rules using the new iptables version before rebooting."
+	einfo
+	einfo "If you are upgrading to a >=2.4.21 kernel you may need to rebuild"
+	einfo "iptables."
+	einfo
+	ewarn "!!! ipforwarding is now not a part of the iptables initscripts."
+	einfo "Until a more permanent solution is implemented adding the following"
+	einfo "to /etc/conf.d/local.start will enable ipforwarding at bootup:"
+	einfo "  echo \"1\" > /proc/sys/net/ipv4/conf/all/forwarding"
+	if use ipv6 ; then
+		einfo "and/or"
+		einfo "  echo \"1\" > /proc/sys/net/ipv6/conf/all/forwarding"
+		einfo "for ipv6."
+	fi
+}
diff --git a/net-firewall/quicktables/Manifest b/net-firewall/quicktables/Manifest
new file mode 100644
index 000000000000..945f9ff75eaa
--- /dev/null
+++ b/net-firewall/quicktables/Manifest
@@ -0,0 +1,3 @@
+MD5 23d681afa1c67bbdf5e580ebb7ea3359 quicktables-2.3.ebuild 535
+MD5 4f0e61f76f31a204c0bcfdc4b105f85b ChangeLog 375
+MD5 00a0c3461c456b01bfbc44b3210b6b5f files/digest-quicktables-2.3 66