committing changes in /etc after emerge run

Package changes:
+net-firewall/iptables-1.4.12.1

diff --git a/.etckeeper b/.etckeeper
index 79155816b0bd0ed06f58e5cd374315c403cdd2bb..1935f6b665e63fe6426dfb50c7693c9fda4a4bc6 100755 (executable)
--- a/.etckeeper
+++ b/.etckeeper
@@ -29,6 +29,8 @@ maybe chmod 0644 './conf.d/git-daemon'
 maybe chmod 0644 './conf.d/gpm'
 maybe chmod 0644 './conf.d/hostname'
 maybe chmod 0644 './conf.d/hwclock'
+maybe chmod 0644 './conf.d/ip6tables'
+maybe chmod 0644 './conf.d/iptables'
 maybe chmod 0644 './conf.d/keymaps'
 maybe chmod 0644 './conf.d/killprocs'
 maybe chmod 0644 './conf.d/localmount'
@@ -176,6 +178,8 @@ maybe chmod 0755 './init.d/git-daemon'
 maybe chmod 0755 './init.d/gpm'
 maybe chmod 0755 './init.d/hostname'
 maybe chmod 0755 './init.d/hwclock'
+maybe chmod 0755 './init.d/ip6tables'
+maybe chmod 0755 './init.d/iptables'
 maybe chmod 0755 './init.d/keymaps'
 maybe chmod 0755 './init.d/killprocs'
 maybe chmod 0755 './init.d/local'

diff --git a/conf.d/ip6tables b/conf.d/ip6tables
new file mode 100644 (file)
index 0000000..93c0bc8
--- /dev/null
+++ b/conf.d/ip6tables
@@ -0,0 +1,11 @@
+# /etc/conf.d/ip6tables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IP6TABLES_SAVE="/var/lib/ip6tables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"

diff --git a/conf.d/iptables b/conf.d/iptables
new file mode 100644 (file)
index 0000000..91287de
--- /dev/null
+++ b/conf.d/iptables
@@ -0,0 +1,11 @@
+# /etc/conf.d/iptables
+
+# Location in which iptables initscript will save set rules on 
+# service shutdown
+IPTABLES_SAVE="/var/lib/iptables/rules-save"
+
+# Options to pass to iptables-save and iptables-restore 
+SAVE_RESTORE_OPTIONS="-c"
+
+# Save state on stopping iptables
+SAVE_ON_STOP="yes"

diff --git a/init.d/ip6tables b/init.d/ip6tables
new file mode 100755 (executable)
index 0000000..5c9cbb7
--- /dev/null
+++ b/init.d/ip6tables
@@ -0,0 +1,117 @@
+#!/sbin/runscript
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $
+
+extra_commands="save panic"
+extra_started_commands="reload"
+
+iptables_name=${SVCNAME}
+if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then
+       iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+       iptables)  iptables_proc="/proc/net/ip_tables_names"
+                  iptables_save=${IPTABLES_SAVE};;
+       ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+                  iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+       before net
+       use logger
+}
+
+set_table_policy() {
+       local chains table=$1 policy=$2
+       case ${table} in
+               nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+               mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+               filter) chains="INPUT FORWARD OUTPUT";;
+               *)      chains="";;
+       esac
+       local chain
+       for chain in ${chains} ; do
+               ${iptables_bin} -t ${table} -P ${chain} ${policy}
+       done
+}
+
+checkkernel() {
+       if [ ! -e ${iptables_proc} ] ; then
+               eerror "Your kernel lacks ${iptables_name} support, please load"
+               eerror "appropriate modules and try again."
+               return 1
+       fi
+       return 0
+}
+checkconfig() {
+       if [ ! -f ${iptables_save} ] ; then
+               eerror "Not starting ${iptables_name}.  First create some rules then run:"
+               eerror "/etc/init.d/${iptables_name} save"
+               return 1
+       fi
+       return 0
+}
+
+start() {
+       checkconfig || return 1
+       ebegin "Loading ${iptables_name} state and starting firewall"
+       ${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+       eend $?
+}
+
+stop() {
+       if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+               save || return 1
+       fi
+       checkkernel || return 1
+       ebegin "Stopping firewall"
+       local a
+       for a in $(cat ${iptables_proc}) ; do
+               set_table_policy $a ACCEPT
+
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+       done
+       eend $?
+}
+
+reload() {
+       checkkernel || return 1
+       ebegin "Flushing firewall"
+       local a
+       for a in $(cat ${iptables_proc}) ; do
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+       done
+       eend $?
+
+       start
+}
+
+save() {
+       ebegin "Saving ${iptables_name} state"
+       touch "${iptables_save}"
+       chmod 0600 "${iptables_save}"
+       ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+       eend $?
+}
+
+panic() {
+       checkkernel || return 1
+       if service_started ${iptables_name}; then
+               rc-service ${iptables_name} stop
+       fi
+
+       local a
+       ebegin "Dropping all packets"
+       for a in $(cat ${iptables_proc}) ; do
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+
+               set_table_policy $a DROP
+       done
+       eend $?
+}

diff --git a/init.d/iptables b/init.d/iptables
new file mode 100755 (executable)
index 0000000..5c9cbb7
--- /dev/null
+++ b/init.d/iptables
@@ -0,0 +1,117 @@
+#!/sbin/runscript
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/iptables/files/iptables-1.4.11.init,v 1.2 2011/12/04 10:15:59 swegener Exp $
+
+extra_commands="save panic"
+extra_started_commands="reload"
+
+iptables_name=${SVCNAME}
+if [ "${iptables_name}" != "iptables" -a "${iptables_name}" != "ip6tables" ] ; then
+       iptables_name="iptables"
+fi
+
+iptables_bin="/sbin/${iptables_name}"
+case ${iptables_name} in
+       iptables)  iptables_proc="/proc/net/ip_tables_names"
+                  iptables_save=${IPTABLES_SAVE};;
+       ip6tables) iptables_proc="/proc/net/ip6_tables_names"
+                  iptables_save=${IP6TABLES_SAVE};;
+esac
+
+depend() {
+       before net
+       use logger
+}
+
+set_table_policy() {
+       local chains table=$1 policy=$2
+       case ${table} in
+               nat)    chains="PREROUTING POSTROUTING OUTPUT";;
+               mangle) chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING";;
+               filter) chains="INPUT FORWARD OUTPUT";;
+               *)      chains="";;
+       esac
+       local chain
+       for chain in ${chains} ; do
+               ${iptables_bin} -t ${table} -P ${chain} ${policy}
+       done
+}
+
+checkkernel() {
+       if [ ! -e ${iptables_proc} ] ; then
+               eerror "Your kernel lacks ${iptables_name} support, please load"
+               eerror "appropriate modules and try again."
+               return 1
+       fi
+       return 0
+}
+checkconfig() {
+       if [ ! -f ${iptables_save} ] ; then
+               eerror "Not starting ${iptables_name}.  First create some rules then run:"
+               eerror "/etc/init.d/${iptables_name} save"
+               return 1
+       fi
+       return 0
+}
+
+start() {
+       checkconfig || return 1
+       ebegin "Loading ${iptables_name} state and starting firewall"
+       ${iptables_bin}-restore ${SAVE_RESTORE_OPTIONS} < "${iptables_save}"
+       eend $?
+}
+
+stop() {
+       if [ "${SAVE_ON_STOP}" = "yes" ] ; then
+               save || return 1
+       fi
+       checkkernel || return 1
+       ebegin "Stopping firewall"
+       local a
+       for a in $(cat ${iptables_proc}) ; do
+               set_table_policy $a ACCEPT
+
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+       done
+       eend $?
+}
+
+reload() {
+       checkkernel || return 1
+       ebegin "Flushing firewall"
+       local a
+       for a in $(cat ${iptables_proc}) ; do
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+       done
+       eend $?
+
+       start
+}
+
+save() {
+       ebegin "Saving ${iptables_name} state"
+       touch "${iptables_save}"
+       chmod 0600 "${iptables_save}"
+       ${iptables_bin}-save ${SAVE_RESTORE_OPTIONS} > "${iptables_save}"
+       eend $?
+}
+
+panic() {
+       checkkernel || return 1
+       if service_started ${iptables_name}; then
+               rc-service ${iptables_name} stop
+       fi
+
+       local a
+       ebegin "Dropping all packets"
+       for a in $(cat ${iptables_proc}) ; do
+               ${iptables_bin} -F -t $a
+               ${iptables_bin} -X -t $a
+
+               set_table_policy $a DROP
+       done
+       eend $?
+}