From 6ff4e9b7c4caa36b66492096b9d1edde7372d452 Mon Sep 17 00:00:00 2001
From: EnumDev <enumdev@enumerated.dev>
Date: Thu, 8 May 2025 17:14:21 +0300
Subject: [PATCH] Initial Commit

---
 pkg.info                                 |  8 +++++
 source-files/iptables.esv                |  5 +++
 source-files/iptables.sh                 | 30 +++++++++++++++++
 source-files/rules/empty-filter.rules    |  6 ++++
 source-files/rules/empty-mangle.rules    |  8 +++++
 source-files/rules/empty-nat.rules       |  7 ++++
 source-files/rules/empty-raw.rules       |  5 +++
 source-files/rules/empty-security.rules  |  6 ++++
 source-files/rules/empty.rules           |  6 ++++
 source-files/rules/simple_firewall.rules | 11 +++++++
 source.sh                                | 41 ++++++++++++++++++++++++
 11 files changed, 133 insertions(+)
 create mode 100644 pkg.info
 create mode 100644 source-files/iptables.esv
 create mode 100755 source-files/iptables.sh
 create mode 100644 source-files/rules/empty-filter.rules
 create mode 100644 source-files/rules/empty-mangle.rules
 create mode 100644 source-files/rules/empty-nat.rules
 create mode 100644 source-files/rules/empty-raw.rules
 create mode 100644 source-files/rules/empty-security.rules
 create mode 100644 source-files/rules/empty.rules
 create mode 100644 source-files/rules/simple_firewall.rules
 create mode 100644 source.sh

diff --git a/pkg.info b/pkg.info
new file mode 100644
index 0000000..346b707
--- /dev/null
+++ b/pkg.info
@@ -0,0 +1,8 @@
+name: iptables
+description: userspace CLI program used to configure the Linux packet filtering ruleset
+version: 1.8.10
+url: https://www.netfilter.org/projects/iptables/index.html
+license: GPL2-only
+architecture: any
+depends: ["bash"]
+type: source
diff --git a/source-files/iptables.esv b/source-files/iptables.esv
new file mode 100644
index 0000000..0db14aa
--- /dev/null
+++ b/source-files/iptables.esv
@@ -0,0 +1,5 @@
+name: iptables
+description: IPv4 Packet Filtering Framework
+type: background
+start_cmd: /etc/esvm/scripts/iptables.sh
+exit_method: kill
diff --git a/source-files/iptables.sh b/source-files/iptables.sh
new file mode 100755
index 0000000..d583ff6
--- /dev/null
+++ b/source-files/iptables.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+stop() {
+	# Flush iptables (Code from archlinux)
+	iptables=ip$1tables
+	if ! type -p "$iptables" &>/dev/null; then
+	  echo "error: invalid argument"
+	  exit 1
+	fi
+	
+	while read -r table; do
+	  tables+=("/usr/share/iptables/empty-$table.rules")
+	done <"/proc/net/ip$1_tables_names"
+	
+	if (( ${#tables[*]} )); then
+	  cat "${tables[@]}" | "$iptables-restore"
+	fi
+
+	# Clear the trap
+    trap - SIGINT SIGTERM
+    kill -- -$(pgrep iptables.sh)
+}
+
+/usr/sbin/iptables-restore /etc/iptables/iptables.rules
+
+# Run stop function when SIGINT or SIGTERM signals are caught
+trap "stop $1" SIGINT SIGTERM
+sleep infinity
+
+
diff --git a/source-files/rules/empty-filter.rules b/source-files/rules/empty-filter.rules
new file mode 100644
index 0000000..5a4de48
--- /dev/null
+++ b/source-files/rules/empty-filter.rules
@@ -0,0 +1,6 @@
+# Empty iptables filter table rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/empty-mangle.rules b/source-files/rules/empty-mangle.rules
new file mode 100644
index 0000000..49d493c
--- /dev/null
+++ b/source-files/rules/empty-mangle.rules
@@ -0,0 +1,8 @@
+# Empty iptables mangle table rules file
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/empty-nat.rules b/source-files/rules/empty-nat.rules
new file mode 100644
index 0000000..437e964
--- /dev/null
+++ b/source-files/rules/empty-nat.rules
@@ -0,0 +1,7 @@
+# Empty iptables nat table rules file
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/empty-raw.rules b/source-files/rules/empty-raw.rules
new file mode 100644
index 0000000..8dc50d2
--- /dev/null
+++ b/source-files/rules/empty-raw.rules
@@ -0,0 +1,5 @@
+# Empty iptables raw table rules file
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/empty-security.rules b/source-files/rules/empty-security.rules
new file mode 100644
index 0000000..4531fa1
--- /dev/null
+++ b/source-files/rules/empty-security.rules
@@ -0,0 +1,6 @@
+# Empty iptables security table rules file
+*security
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/empty.rules b/source-files/rules/empty.rules
new file mode 100644
index 0000000..e24e1aa
--- /dev/null
+++ b/source-files/rules/empty.rules
@@ -0,0 +1,6 @@
+# Empty iptables rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
diff --git a/source-files/rules/simple_firewall.rules b/source-files/rules/simple_firewall.rules
new file mode 100644
index 0000000..63426b0
--- /dev/null
+++ b/source-files/rules/simple_firewall.rules
@@ -0,0 +1,11 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -p icmp -j ACCEPT 
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
+-A INPUT -i lo -j ACCEPT 
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
+-A INPUT -j REJECT --reject-with icmp-proto-unreachable 
+COMMIT
diff --git a/source.sh b/source.sh
new file mode 100644
index 0000000..adafb83
--- /dev/null
+++ b/source.sh
@@ -0,0 +1,41 @@
+# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+DOWNLOAD="https://www.netfilter.org/projects/iptables/files/iptables-${BPM_PKG_VERSION}.tar.xz"
+FILENAME="${DOWNLOAD##*/}"
+
+# The prepare function is executed in the root of the temp directory
+# This function is used for downloading files and putting them into the correct location
+prepare() {
+  wget "$DOWNLOAD"
+  tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE"
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {
+  ./configure --prefix=/usr      \
+              --disable-nftables \
+              --enable-libipq
+  make
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  make DESTDIR="$BPM_OUTPUT" install
+
+  # Install esvm service
+  install -Dm644 "$BPM_WORKDIR"/iptables.esv "$BPM_OUTPUT"/etc/esvm/services/iptables.esv
+  install -Dm755 "$BPM_WORKDIR"/iptables.sh "$BPM_OUTPUT"/etc/esvm/scripts/iptables.sh
+
+  # Rules from Arch Linux
+  install -Dm644 "$BPM_WORKDIR"/rules/empty.rules "$BPM_OUTPUT"/etc/iptables/iptables.rules
+  install -Dm644 "$BPM_WORKDIR"/rules/empty.rules "$BPM_OUTPUT"/etc/iptables/ip6tables.rules
+  install -Dm644 "$BPM_WORKDIR"/rules/*.rules -t "$BPM_OUTPUT"/usr/share/iptables/
+  ln -srt "$BPM_OUTPUT"/etc/iptables "$BPM_OUTPUT"/usr/share/iptables/{empty,simple_firewall}.rules
+
+  # Install package license
+  install -Dm644 "$BPM_SOURCE"/COPYING "$BPM_OUTPUT"/usr/share/licenses/iptables/LICENSE
+}