Initial Commit

pkg.info

@@ -0,0 +1,8 @@
+name: iptables
+description: userspace CLI program used to configure the Linux packet filtering ruleset
+version: 1.8.10
+url: https://www.netfilter.org/projects/iptables/index.html
+license: GPL2-only
+architecture: any
+depends: ["bash"]
+type: source

source-files/iptables.esv

@@ -0,0 +1,5 @@
+name: iptables
+description: IPv4 Packet Filtering Framework
+type: background
+start_cmd: /etc/esvm/scripts/iptables.sh
+exit_method: kill

source-files/iptables.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+stop() {
+	# Flush iptables (Code from archlinux)
+	iptables=ip$1tables
+	if ! type -p "$iptables" &>/dev/null; then
+	  echo "error: invalid argument"
+	  exit 1
+	fi
+	
+	while read -r table; do
+	  tables+=("/usr/share/iptables/empty-$table.rules")
+	done <"/proc/net/ip$1_tables_names"
+	
+	if (( ${#tables[*]} )); then
+	  cat "${tables[@]}" | "$iptables-restore"
+	fi
+
+	# Clear the trap
+    trap - SIGINT SIGTERM
+    kill -- -$(pgrep iptables.sh)
+}
+
+/usr/sbin/iptables-restore /etc/iptables/iptables.rules
+
+# Run stop function when SIGINT or SIGTERM signals are caught
+trap "stop $1" SIGINT SIGTERM
+sleep infinity
+
+

source-files/rules/empty-filter.rules

@@ -0,0 +1,6 @@
+# Empty iptables filter table rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty-mangle.rules

@@ -0,0 +1,8 @@
+# Empty iptables mangle table rules file
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

source-files/rules/empty-nat.rules

@@ -0,0 +1,7 @@
+# Empty iptables nat table rules file
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

source-files/rules/empty-raw.rules

@@ -0,0 +1,5 @@
+# Empty iptables raw table rules file
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty-security.rules

@@ -0,0 +1,6 @@
+# Empty iptables security table rules file
+*security
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/empty.rules

@@ -0,0 +1,6 @@
+# Empty iptables rule file
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT

source-files/rules/simple_firewall.rules

@@ -0,0 +1,11 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -p icmp -j ACCEPT 
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
+-A INPUT -i lo -j ACCEPT 
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
+-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
+-A INPUT -j REJECT --reject-with icmp-proto-unreachable 
+COMMIT

source.sh

@@ -0,0 +1,41 @@
+# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+DOWNLOAD="https://www.netfilter.org/projects/iptables/files/iptables-${BPM_PKG_VERSION}.tar.xz"
+FILENAME="${DOWNLOAD##*/}"
+
+# The prepare function is executed in the root of the temp directory
+# This function is used for downloading files and putting them into the correct location
+prepare() {
+  wget "$DOWNLOAD"
+  tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE"
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {
+  ./configure --prefix=/usr      \
+              --disable-nftables \
+              --enable-libipq
+  make
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  make DESTDIR="$BPM_OUTPUT" install
+
+  # Install esvm service
+  install -Dm644 "$BPM_WORKDIR"/iptables.esv "$BPM_OUTPUT"/etc/esvm/services/iptables.esv
+  install -Dm755 "$BPM_WORKDIR"/iptables.sh "$BPM_OUTPUT"/etc/esvm/scripts/iptables.sh
+
+  # Rules from Arch Linux
+  install -Dm644 "$BPM_WORKDIR"/rules/empty.rules "$BPM_OUTPUT"/etc/iptables/iptables.rules
+  install -Dm644 "$BPM_WORKDIR"/rules/empty.rules "$BPM_OUTPUT"/etc/iptables/ip6tables.rules
+  install -Dm644 "$BPM_WORKDIR"/rules/*.rules -t "$BPM_OUTPUT"/usr/share/iptables/
+  ln -srt "$BPM_OUTPUT"/etc/iptables "$BPM_OUTPUT"/usr/share/iptables/{empty,simple_firewall}.rules
+
+  # Install package license
+  install -Dm644 "$BPM_SOURCE"/COPYING "$BPM_OUTPUT"/usr/share/licenses/iptables/LICENSE
+}