net-firewall/nftables-0.9.7-r1: revbump, fix initd (bug #753491, #744955)

Closes: https://bugs.gentoo.org/753491
Closes: https://bugs.gentoo.org/744955
Package-Manager: Portage-3.0.9, Repoman-3.0.2
Signed-off-by: Patrick McLean <chutzpah@gentoo.org>

5 files changed, 280 insertions, 90 deletions

diff --git a/net-firewall/nftables/files/nftables-mk.init-r1 b/net-firewall/nftables/files/nftables-mk.init-r1
index 45b2abdbda77..1f03301c0535 100644
--- a/net-firewall/nftables/files/nftables-mk.init-r1
+++ b/net-firewall/nftables/files/nftables-mk.init-r1
@@ -20,7 +20,7 @@ checkkernel() {
 }
 
 checkconfig() {
-	if [ -z "${NFTABLES_SAVE}" -o ! -f "${NFTABLES_SAVE}" ] ; then
+	if [ -z "${NFTABLES_SAVE}" ] || [ ! -f "${NFTABLES_SAVE}" ] ; then
 		eerror "Not starting nftables. First create some rules then run:"
 		eerror "/etc/init.d/${SVCNAME} save"
 		return 1
@@ -28,6 +28,11 @@ checkconfig() {
 	return 0
 }
 
+_nftables() {
+	export NFTABLES_SAVE SAVE_OPTIONS
+	/usr/libexec/nftables/nftables.sh "${@}"
+}
+
 start_pre() {
 	checkconfig || return 1
 	checkkernel || return 1
@@ -36,8 +41,8 @@ start_pre() {
 
 start() {
 	ebegin "Loading ${SVCNAME} state and starting firewall"
-	/usr/libexec/nftables/nftables.sh load "${NFTABLES_SAVE}"
-	eend $?
+	_nftables load "${NFTABLES_SAVE}"
+	eend ${?}
 }
 
 stop() {
@@ -47,13 +52,13 @@ stop() {
 
 	ebegin "Stopping firewall"
 	if [ "${PANIC_ON_STOP}" = "hard" ]; then
-		/usr/libexec/nftables/nftables.sh panic
+		_nftables panic
 	elif [ "${PANIC_ON_STOP}" = "soft" ]; then
-		/usr/libexec/nftables/nftables.sh soft_panic
+		_nftables soft_panic
 	else
-		/usr/libexec/nftables/nftables.sh clear
+		_nftables clear
 	fi
-	eend $?
+	eend ${?}
 }
 
 reload() {
@@ -63,43 +68,42 @@ reload() {
 
 clear() {
 	ebegin "Clearing rules"
-	/usr/libexec/nftables/nftables.sh clear
-	eend $?
+	_nftables clear
+	eend ${?}
 }
 
 list() {
-	/usr/libexec/nftables/nftables.sh list
+	_nftables list
 }
 
 check() {
 	ebegin "Checking rules"
-	/usr/libexec/nftables/nftables.sh check "${NFTABLES_SAVE}"
-	eend $?
+	_nftables check "${NFTABLES_SAVE}"
+	eend ${?}
 }
 
 save() {
 	ebegin "Saving ${SVCNAME} state"
 	checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
 	checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
-	SAVE_OPTIONS="${SAVE_OPTIONS}" \
-		/usr/libexec/nftables/nftables.sh store "${NFTABLES_SAVE}"
-	eend $?
+	_nftables store "${NFTABLES_SAVE}"
+	eend ${?}
 }
 
 panic() {
-	if service_started ${SVCNAME}; then
-		rc-service ${SVCNAME} zap
+	if service_started "${SVCNAME}"; then
+		rc-service "${SVCNAME}" zap
 	fi
 	ebegin "Dropping all packets"
-	/usr/libexec/nftables/nftables.sh panic
-	eend $?
+	_nftables panic
+	eend ${?}
 }
 
 soft_panic() {
-	if service_started ${SVCNAME}; then
-		rc-service ${SVCNAME} zap
+	if service_started "${SVCNAME}"; then
+		rc-service "${SVCNAME}" zap
 	fi
 	ebegin "Dropping new connections"
-	/usr/libexec/nftables/nftables.sh soft_panic
-	eend $?
+	_nftables soft_panic
+	eend ${?}
 }
diff --git a/net-firewall/nftables/files/nftables.init-r1 b/net-firewall/nftables/files/nftables.init-r1
index 45b2abdbda77..60f1632f4551 100644
--- a/net-firewall/nftables/files/nftables.init-r1
+++ b/net-firewall/nftables/files/nftables.init-r1
@@ -1,105 +1,129 @@
 #!/sbin/openrc-run
+# Copyright 2014-2017 Nicholas Vinson
 # Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-extra_commands="check clear list panic save soft_panic"
+extra_commands="clear list panic save"
 extra_started_commands="reload"
-
 depend() {
 	need localmount #434774
 	before net
 }
 
-checkkernel() {
-	if ! /sbin/nft list ruleset >/dev/null 2>/dev/null ; then
-		eerror "Your kernel lacks nftables support, please load"
-		eerror "appropriate modules and try again."
-		return 1
-	fi
-	return 0
+_nftables() {
+	export NFTABLES_SAVE SAVE_OPTIONS
+	/usr/libexec/nftables/nftables.sh "${@}"
 }
 
-checkconfig() {
-	if [ -z "${NFTABLES_SAVE}" -o ! -f "${NFTABLES_SAVE}" ] ; then
-		eerror "Not starting nftables. First create some rules then run:"
-		eerror "/etc/init.d/${SVCNAME} save"
-		return 1
-	fi
+start_pre() {
+	checkkernel || return 1
+	checkconfig || return 1
 	return 0
 }
 
-start_pre() {
-	checkconfig || return 1
-	checkkernel || return 1
-	check || return 1
+clear() {
+	_nftables clear || return 1
+	return 0
 }
 
-start() {
-	ebegin "Loading ${SVCNAME} state and starting firewall"
-	/usr/libexec/nftables/nftables.sh load "${NFTABLES_SAVE}"
-	eend $?
+list() {
+	_nftables list || return 1
+	return 0
 }
 
-stop() {
-	if [ "${SAVE_ON_STOP}" = "yes" ] ; then
-		save || return 1
+panic() {
+	checkkernel || return 1
+	if service_started "${RC_SVCNAME}"; then
+		rc-service "${RC_SVCNAME}" stop
 	fi
 
-	ebegin "Stopping firewall"
-	if [ "${PANIC_ON_STOP}" = "hard" ]; then
-		/usr/libexec/nftables/nftables.sh panic
-	elif [ "${PANIC_ON_STOP}" = "soft" ]; then
-		/usr/libexec/nftables/nftables.sh soft_panic
-	else
-		/usr/libexec/nftables/nftables.sh clear
+	ebegin "Dropping all packets"
+	clear
+	if nft create table ip filter >/dev/null 2>&1; then
+	nft -f /dev/stdin <<-EOF
+		table ip filter {
+			chain input {
+				type filter hook input priority 0;
+				drop
+			}
+			chain forward {
+				type filter hook forward priority 0;
+				drop
+			}
+			chain output {
+				type filter hook output priority 0;
+				drop
+			}
+		}
+	EOF
+	fi
+	if nft create table ip6 filter >/dev/null 2>&1; then
+	nft -f /dev/stdin <<-EOF
+		table ip6 filter {
+			chain input {
+				type filter hook input priority 0;
+				drop
+			}
+			chain forward {
+				type filter hook forward priority 0;
+				drop
+			}
+			chain output {
+				type filter hook output priority 0;
+				drop
+			}
+		}
+	EOF
 	fi
-	eend $?
 }
 
 reload() {
-	start_pre || return 1
+	checkkernel || return 1
+	ebegin "Flushing firewall"
+	clear
 	start
 }
 
-clear() {
-	ebegin "Clearing rules"
-	/usr/libexec/nftables/nftables.sh clear
-	eend $?
+save() {
+	ebegin "Saving nftables state"
+	checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
+	checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
+	export SAVE_OPTIONS
+	_nftables store "${NFTABLES_SAVE}"
+	return $?
 }
 
-list() {
-	/usr/libexec/nftables/nftables.sh list
+start() {
+	ebegin "Loading nftables state and starting firewall"
+	clear
+	_nftables load "${NFTABLES_SAVE}"
+	eend ${?}
 }
 
-check() {
-	ebegin "Checking rules"
-	/usr/libexec/nftables/nftables.sh check "${NFTABLES_SAVE}"
-	eend $?
-}
+stop() {
+	if yesno "${SAVE_ON_STOP:-yes}"; then
+		save || return 1
+	fi
 
-save() {
-	ebegin "Saving ${SVCNAME} state"
-	checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
-	checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
-	SAVE_OPTIONS="${SAVE_OPTIONS}" \
-		/usr/libexec/nftables/nftables.sh store "${NFTABLES_SAVE}"
-	eend $?
+	ebegin "Stopping firewall"
+	clear
+	eend ${?}
 }
 
-panic() {
-	if service_started ${SVCNAME}; then
-		rc-service ${SVCNAME} zap
+checkconfig() {
+	if [ ! -f "${NFTABLES_SAVE}" ]; then
+		eerror "Not starting nftables.  First create some rules then run:"
+		eerror "rc-service nftables save"
+		return 1
 	fi
-	ebegin "Dropping all packets"
-	/usr/libexec/nftables/nftables.sh panic
-	eend $?
+	return 0
 }
 
-soft_panic() {
-	if service_started ${SVCNAME}; then
-		rc-service ${SVCNAME} zap
+checkkernel() {
+	if ! nft list tables >/dev/null 2>&1; then
+		eerror "Your kernel lacks nftables support, please load"
+		eerror "appropriate modules and try again."
+		return 1
 	fi
-	ebegin "Dropping new connections"
-	/usr/libexec/nftables/nftables.sh soft_panic
-	eend $?
+	return 0
 }
diff --git a/net-firewall/nftables/nftables-0.9.7-r1.ebuild b/net-firewall/nftables/nftables-0.9.7-r1.ebuild
new file mode 100644
index 000000000000..99305e2ed641
--- /dev/null
+++ b/net-firewall/nftables/nftables-0.9.7-r1.ebuild
@@ -0,0 +1,162 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{6,7,8,9} )
+
+inherit autotools linux-info python-r1 systemd
+
+DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~ppc64 ~sparc ~x86"
+IUSE="debug doc +gmp json +modern-kernel python +readline static-libs xtables"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:0=
+	>=net-libs/libnftnl-1.1.8:0=
+	gmp? ( dev-libs/gmp:0= )
+	json? ( dev-libs/jansson )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	xtables? ( >=net-firewall/iptables-1.6.1 )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND="
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+python_make() {
+	emake \
+		-C py \
+		abs_builddir="${S}" \
+		DESTDIR="${D}" \
+		PYTHON_BIN="${PYTHON}" \
+		"${@}"
+}
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		if use modern-kernel && kernel_is lt 3 18; then
+			eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
+		fi
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+
+	# fix installation path for doc stuff
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels@' \
+		-i files/nftables/Makefile.am || die
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels/osf@' \
+		-i files/osf/Makefile.am || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		# We handle python separately
+		--disable-python
+		--sbindir="${EPREFIX}"/sbin
+		$(use_enable debug)
+		$(use_enable doc man-doc)
+		$(use_with !gmp mini_gmp)
+		$(use_with json)
+		$(use_with readline cli readline)
+		$(use_enable static-libs static)
+		$(use_with xtables)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		python_foreach_impl python_make
+	fi
+}
+
+src_install() {
+	default
+
+	if ! use doc; then
+		pushd doc >/dev/null || die
+		doman *.?
+		popd >/dev/null || die
+	fi
+
+	local mksuffix="$(usex modern-kernel '-mk' '')"
+
+	exeinto /usr/libexec/${PN}
+	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
+	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
+	newinitd "${FILESDIR}"/${PN}${mksuffix}.init-r1 ${PN}
+	keepdir /var/lib/nftables
+
+	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
+
+	if use python ; then
+		python_foreach_impl python_make install
+		python_foreach_impl python_optimize
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	local save_file
+	save_file="${EROOT}/var/lib/nftables/rules-save"
+
+	# In order for the nftables-restore systemd service to start
+	# the save_file must exist.
+	if [[ ! -f "${save_file}" ]]; then
+		( umask 177; touch "${save_file}" )
+	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
+		ewarn "Your system has dangerous permissions for ${save_file}"
+		ewarn "It is probably affected by bug #691326."
+		ewarn "You may need to fix the permissions of the file. To do so,"
+		ewarn "you can run the command in the line below as root."
+		ewarn "    'chmod 600 \"${save_file}\"'"
+	fi
+
+	if has_version 'sys-apps/systemd'; then
+		elog "If you wish to enable the firewall rules on boot (on systemd) you"
+		elog "will need to enable the nftables-restore service."
+		elog "    'systemctl enable ${PN}-restore.service'"
+		elog
+		elog "If you are creating firewall rules before the next system restart"
+		elog "the nftables-restore service must be manually started in order to"
+		elog "save those rules on shutdown."
+	fi
+	if has_version 'sys-apps/openrc'; then
+		elog "If you wish to enable the firewall rules on boot (on openrc) you"
+		elog "will need to enable the nftables service."
+		elog "    'rc-update add ${PN} default'"
+		elog
+		elog "If you are creating or updating the firewall rules and wish to save"
+		elog "them to be loaded on the next restart, use the \"save\" functionality"
+		elog "in the init script."
+		elog "    'rc-service ${PN} save'"
+	fi
+}
diff --git a/net-firewall/nftables/nftables-0.9.7.ebuild b/net-firewall/nftables/nftables-0.9.7.ebuild
index c14134222620..99305e2ed641 100644
--- a/net-firewall/nftables/nftables-0.9.7.ebuild
+++ b/net-firewall/nftables/nftables-0.9.7.ebuild
@@ -111,7 +111,7 @@ src_install() {
 	exeinto /usr/libexec/${PN}
 	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
 	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}${mksuffix}.init ${PN}
+	newinitd "${FILESDIR}"/${PN}${mksuffix}.init-r1 ${PN}
 	keepdir /var/lib/nftables
 
 	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
diff --git a/net-firewall/nftables/nftables-9999.ebuild b/net-firewall/nftables/nftables-9999.ebuild
index 2230bbd4f989..1cc0dea3eb82 100644
--- a/net-firewall/nftables/nftables-9999.ebuild
+++ b/net-firewall/nftables/nftables-9999.ebuild
@@ -122,7 +122,7 @@ src_install() {
 	exeinto /usr/libexec/${PN}
 	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
 	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}${mksuffix}.init ${PN}
+	newinitd "${FILESDIR}"/${PN}${mksuffix}.init-r1 ${PN}
 	keepdir /var/lib/nftables
 
 	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service