Initial commit

.gitignore

@@ -0,0 +1,2 @@
+# Exclude bpm archives
+*.bpm

check-version.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Git repository
+REPO="https://git.netfilter.org/nftables"
+
+# Get tag name using 'git ls-remote'
+TAG_NAME=$(git ls-remote --exit-code --refs --tags --sort='v:refname' "$REPO" | tail -1 | cut -d'/' -f3)
+
+# Trim prefix
+VERSION=${TAG_NAME//v/}
+
+echo "$VERSION"

pkg.info

@@ -0,0 +1,29 @@
+name: nftables
+description: Netfilter tables userspace tools
+version: 1.1.5
+revision: 1
+url: https://netfilter.org/projects/nftables/
+license: GPL2-only
+architecture: any
+type: source
+depends:
+  - gmp
+  - jansson
+  - libmnl
+  - libnftnl
+  - ncurses
+  - readline
+optional_depends:
+  - python3
+make_depends:
+  - asciidoc
+  - python3
+  - python-build
+  - python-installer
+  - python-setuptools
+  - python-wheel
+downloads:
+  - url: https://www.netfilter.org/pub/nftables/nftables-${BPM_PKG_VERSION}.tar.xz
+    extract_to_bpm_source: true
+    extract_strip_components: 1
+    checksum: 1daf10f322e14fd90a017538aaf2c034d7cc1eb1cc418ded47445d714ea168d4

source-files/nftables.conf

@@ -0,0 +1,26 @@
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+# IPv4/IPv6 Simple & Safe firewall ruleset.
+# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
+
+destroy table inet filter
+table inet filter {
+  chain input {
+    type filter hook input priority filter
+    policy drop
+
+    ct state invalid drop comment "early drop of invalid connections"
+    ct state {established, related} accept comment "allow tracked connections"
+    iif lo accept comment "allow from loopback"
+    ip protocol icmp accept comment "allow icmp"
+    meta l4proto ipv6-icmp accept comment "allow icmp v6"
+    tcp dport ssh accept comment "allow sshd"
+    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
+    counter
+  }
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+  }
+}

source-files/nftables.esv

@@ -0,0 +1,6 @@
+name: nftables
+description: Nftables daemon
+type: simple
+start_cmd: /usr/bin/nft -f /etc/nftables.conf
+stop_cmd: /usr/bin/nft flush ruleset
+exit_method: stop_command

source.sh

@@ -0,0 +1,43 @@
+# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+prepare() {
+	cd "$BPM_SOURCE"
+	autoreconf -fi
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {
+  ./configure --prefix=/usr \
+              --sbindir=/usr/bin \
+              --sysconfdir=/usr/share \
+              --with-json \
+              --with-cli=readline \
+              --disable-python \
+              --disable-debug
+  make
+
+  # Build python module
+  cd py
+  python -m build --wheel --no-isolation
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  make DESTDIR="$BPM_OUTPUT" install
+
+  # Install python module
+  python -m installer --destdir="$BPM_OUTPUT" py/dist/*.whl
+
+  # Install config file
+  install -Dm644 "$BPM_WORKDIR"/nftables.conf "$BPM_OUTPUT"/etc/nftables.conf
+
+  # Install esvm service
+  install -Dm644 "$BPM_WORKDIR"/nftables.esv "$BPM_OUTPUT"/etc/esvm/services/nftables.esv
+
+  # Install package license
+  install -Dm644 "$BPM_SOURCE"/COPYING "$BPM_OUTPUT"/usr/share/licenses/nftables/COPYING
+}