commit: 098d7c9931e31aeab8b1f1dac651b4060b13e55c Author: Thomas D <whissi <AT> whissi <DOT> de> AuthorDate: Mon Apr 25 23:12:43 2016 +0000 Commit: Ian Delaney <idella4 <AT> gentoo <DOT> org> CommitDate: Tue Apr 26 08:49:42 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=098d7c99
net-firewall/shorewall: Bump to v5.0.8 - "reload" action added to runscripts (#580632) Package-Manager: portage-2.2.28 Closes: https://github.com/gentoo/gentoo/pull/1354 Signed-off-by: Ian Delaney <idella4 <AT> gentoo.org> net-firewall/shorewall/Manifest | 7 + .../shorewall/files/shorewall-lite.confd-r1 | 19 + .../shorewall/files/shorewall-lite.initd-r1 | 83 ++++ net-firewall/shorewall/files/shorewall.confd-r1 | 19 + net-firewall/shorewall/files/shorewall.initd-r1 | 108 +++++ .../shorewall/files/shorewall6-lite.confd-r1 | 19 + .../shorewall/files/shorewall6-lite.initd-r1 | 93 +++++ net-firewall/shorewall/files/shorewall6.confd-r1 | 19 + net-firewall/shorewall/files/shorewall6.initd-r1 | 118 ++++++ net-firewall/shorewall/shorewall-5.0.8.ebuild | 446 +++++++++++++++++++++ 10 files changed, 931 insertions(+) diff --git a/net-firewall/shorewall/Manifest b/net-firewall/shorewall/Manifest index 659efd4..8610ecd 100644 --- a/net-firewall/shorewall/Manifest +++ b/net-firewall/shorewall/Manifest @@ -1,14 +1,21 @@ DIST shorewall-5.0.4.tar.bz2 482227 SHA256 34a4ab3e4ded052cb563a280f07f350616db913ded124bfceb39adb325f1ce0a SHA512 7912d46e794b4facf29d290370a5cbad83a568873d8aca1b6efe7856c1420a7da882957d16bd4d376d9e7c69accb5263bfa0dd73af06f3c85eab41a0e244c362 WHIRLPOOL eb7351b01c9a3c709179eb6e21d6bb54935a11c066fb31588a1b90c9a089eac7e2d8387006f436c2a68c1618847f5ea69c65e8233240a8d3c8352e0a4d685dc9 DIST shorewall-5.0.7.2.tar.bz2 488554 SHA256 f88746e8fbce315e333855120c9c7bc0390ddd170696a8059bfe0a7c94887c50 SHA512 31fc0c2c1498eb67a311dd181340bdabb90170e16240a9cf4fb85d08773bbb33f6f857e9229133d98100d39e7c1a1b9c39118749094f65382698155d897ec7f1 WHIRLPOOL af78482e9b9909eda84b4dfc831a13219073c38db4d324d32a593b7be5829f7be8eba733db42dfdb6d5e86d638c8462c2b755bc5ba2f210c1ccd0cedfe369918 +DIST shorewall-5.0.8.tar.bz2 497396 SHA256 a1a598a3bb73793de245841ff54fae01cc2e29e006a4f4c09f04f16be4c41f54 SHA512 b0ad03aa86f1c5d607026db37fe3fb6ba335d29dd596770ef1b4b338b8afa5916062c07372427d44e8cdbd7e59183b3a73f4b531a869cc1dd4025f72ae5fc945 WHIRLPOOL 6e5643b094199a5bfa8da253e1348547525449b74f22ddfc5fa75fd504f456e914a56122a040532b460632ce43e178f28c22174ac000e724f43a2523c572819b DIST shorewall-core-5.0.4.tar.bz2 50604 SHA256 ea80b9e1854033c723a5321fc920b35aa0ebb0dea3721a47cee616aa3b92ed9f SHA512 1db3b7a44bf2f99d1a9c6775c798285bbc9a4bec5a340a10fd762600c01486f90d305297247cceb451616e852d9deb89163a43082e06f9eadad75cdd5d480a21 WHIRLPOOL bb4cea303c7ea1190ec3788f9e7cab4f0febf88ab5047c18adbe9e88476c5ebe569bd3ead6105131a61ac6c31bdab6d3192383e1709847e637220f223a8875b9 DIST shorewall-core-5.0.7.2.tar.bz2 53796 SHA256 97f984261ca24e11e0ce4ab8c6ee2bb7f877dad9ed5b3df292bc6a6336e50b4c SHA512 7d76fede69e1cd218e574087cdf609b8fce6997a0f904151f2f514558d1664008a5e7516e1d97a912fe028c95a4d313c3db8e180745c99b5e15b28d25a67ccf6 WHIRLPOOL 0be39a6b9db6c561d5d2bd5e192b77d81a59c9236dcd3595a2d9b03af00e7df06b8f9e7aeedc03f9226714c987b1e812fb053e472099649bc0f1295943ac1459 +DIST shorewall-core-5.0.8.tar.bz2 57121 SHA256 1cd2449e4f86a23c518d180c9c802fa77400d33f0a2945b4434d89407167ecad SHA512 901673f76a65d7039abbad6d8b8553d9a1751dcc7559d25f0f798135121a52b4c25159b7ef4c95affdba6ed92e6a37d7d39928468e6a7737eaa78acb365c8a32 WHIRLPOOL df60d7ecb7422d5dd81c0a9b487bc7a4b15a1384c5a2ba262d9a8041262fec048d27d72c03dedfbe7a3b310b2708d40412d355dd70eeba7427eb5f43a3d44edf DIST shorewall-docs-html-5.0.4.tar.bz2 4263406 SHA256 501d76f53d6e638aaa14ab60718fa173ef0c3a7756e325326288c353d2845707 SHA512 7e35191fbd5a1b7f0172880fa03ce95f4ac13da3a481c4c2cace83380bcacd23809c56ea12876e55c6d2371a4c88ba44d6a8a600c83481156294ff1a2a48c0e4 WHIRLPOOL 347666e97898ea19af93aef3fb2852b1453791038fa534bb5cad8e96acff75460cb5527389b726f7e09d4721a7b171ca9d2171ac5704f8fa50e172d7ac403929 DIST shorewall-docs-html-5.0.7.2.tar.bz2 4269013 SHA256 cf25f6f3db125ccdb45a27252f9896c338078b4d7c5dc2c73fda1edb5887c103 SHA512 11239c5d271b6e71aaa15880a1ed56566c1ce30b100c00a25e49279d0a9d07bd86484a43a4810a0904b84264a44c3cc65f0b12ec579ab0c953db26af3d8ed152 WHIRLPOOL 34f579be4799e8b5c17edc4b4b7a245bc7e6519a03226156fdc56f73abb6912d9a2b71c404b36ffd2458d4ab37a7a5ad1cc1622d3d2cc139204a3279c6a5b503 +DIST shorewall-docs-html-5.0.8.tar.bz2 4270299 SHA256 8646627ce8a4ceb8e0800e82c8a62facf5e4c8240b6fded00d4fed4516a275d1 SHA512 a820a3e0a2e6d95b8f349e66bd7ed8d27d7155801494042d6732b16cd93ad7f7e1a76a62b32335a62e98eb9528b49f16e11a4b2fe7bc0d9d8064a270cbd52d4f WHIRLPOOL 358b5948d3bb9912e8634e025003a969ecd546b7552e149c5e779844446a107f66a662c381f393d43a6d3cf241dafd8299341ae9ef56fb3ff37ca7277608deb8 DIST shorewall-init-5.0.4.tar.bz2 29902 SHA256 97c99c9e68f2546139f26f1f713e1a3377754e53bf2ba0d8f431469aed47ee9c SHA512 67a66ba6db64a320192f5affa38fb779c1f7d7b915523fe82e4dc8a79bb6590b8da62979f9108ba3f56beef05c1cddb5bb2ffea21317e516c2d8a380a5117567 WHIRLPOOL b4f7875ed0f52d8667135dc7204b1a570dec351a7d3fb42a37618af3d54b808355b4479bfb3421d29d4ab808aeae37cd3f1d12b66046f96ec80f776e796d86c7 DIST shorewall-init-5.0.7.2.tar.bz2 32525 SHA256 82b56c01e427e4806c4590b854adfe71feff4bed33185ec7be0310d8e8ae4991 SHA512 6ea2e2379d9baaca0730797f4d7f896f7350965cb203b8c322edc9e47bf0ce8966fd0d0ae5a01f50e5acc3a2578089bfe262e5567428aa13923e68cededda4b9 WHIRLPOOL de074623c93a43ca586a87f5ddae184ec2ce41a3a225f88aa0c92d0311e20cfd4c4b0c5a152bf8c9ca1daa0b159a306aeb321b960082000e99552704c34f9d1b +DIST shorewall-init-5.0.8.tar.bz2 35665 SHA256 953a1ed63bcb36e2ecbe98813c85e4bae90f3dfadd4a4d034544b5eec113af4e SHA512 bc20cee91140e39c7cfcbf8b08c4dc3f19ce3cb76df62d7321a41679af007a2c4da49b6fff160a3cc4fb909a7cbb984157ad78e156df1c6094812f66cb549d2d WHIRLPOOL c56dace686dbe2e29123854374ed350cea0a399389577d7c8c2cc68a5534da6145a8b22819d53f1f4a42cee2e020085cac2544a20d3889476980a9fb4f062884 DIST shorewall-lite-5.0.4.tar.bz2 46454 SHA256 23ac0c1b5f8f1650e6a03a70022b3de0c705fb4257c56d0f84d823b0a10f659d SHA512 8f29c4318de4464eaaaab81096e6290abb0c5d148b043dda70f2f38b21823338e093766dd6fcf0d8924a8a7cd3dd84b5c253fdae421982bc2f9ada13a38db7ba WHIRLPOOL 271b9605e97b1f2c5891cae9c30b4b56b8e07e69f1effbc277d784d781cb35f33f1f3c8e2bcbae0e7ae0e6fe092937573cdbf7c9adea498212007b4db7a5ee95 DIST shorewall-lite-5.0.7.2.tar.bz2 48465 SHA256 7511a2f721c10e42628fe4dab1d8ce0c4499a76ad1ecb071a59575513f6b3d74 SHA512 d49fe0419da71ac492f2b48e142e353a09de746c5b842cf9f90added2e9e7578b1542d71c1f99251cbfd469bda73cd6fe151d45d71b38055365d5d36e67a806d WHIRLPOOL 8a0ff4aa17a2ab635488456f9bbd50d32a714dea56370b8cefe8938a5d12c16f906c24e0de8680251e5827038ea45f2c1bef1b477b1ffec76e2d4ff9c3703cc4 +DIST shorewall-lite-5.0.8.tar.bz2 51897 SHA256 42c2a2f7c81bfab47371748e8e5230bbac7bd5985372dce64071e695f9d8746a SHA512 7a2497a768102c331fda410206c77ef9e57b012eb6932ed519caf036b7cd8ae110bad536175db0339024c4d8aaa77b682a2b816358a3268e15018371c4fd69b8 WHIRLPOOL 4738355687e05ca133a6f9d7c3b467567cd49a8124bee4d12ec04981e38642555911b7249a9e161d22e6c1b64f221fea202141f7fcd05be8ea973cf78bc1900d DIST shorewall6-5.0.4.tar.bz2 221062 SHA256 86b939f5a27e464d2d4928b66ba145c30c299bc90fd19802817d8a013cfc1fff SHA512 cc38b44fd4af38981d2a7acff11be4f481683f5d6227ed072a2147650ff20fbafdf2bdca63f66b330c11cabf521484f6d860ad1dc426f1d952d94643ff3d63dc WHIRLPOOL 2e0abbcd7e308f2523907be285c77a257a37aa70b81af0d356de53cd6e330305ca66be6972ab53954d0b02ada9fc6b5176b928db8f4a9ee588410c81dce55792 DIST shorewall6-5.0.7.2.tar.bz2 222450 SHA256 cf78fb9c75e65315502a56b963baf81afec0563d5e2e7bf5e7461c0a0772a29a SHA512 d052185ef2edcf0c4c81de41c52ff4db5b31649ae14847791b87a99e644b9a0a3026aeaa09bdd7d90687eeca5e86938af400574c31e6f44255fdf045b6716505 WHIRLPOOL 4b0779d7870700a62f614deb7a359add26520d6d989dfbe9c6feb0f027073d53752f0bc604008a2e9dfc5d719521fb25bef1967eea1b92d88efb151bb6b574f4 +DIST shorewall6-5.0.8.tar.bz2 224839 SHA256 564fb305c8d816d9e2b5a2487b68b80e34049144b8499931767a647d8bbd2192 SHA512 7d0eeac59c965cb4599b0fb42bdc8791ad29f284de9635a96df0c1e27bbdf69a35c501b72b4787380176c97fbbbdcd22a1a6b113c24344f296ec6b2438d2f77f WHIRLPOOL 47dc867b7c84db50cae87aeed79ba2c0f954841a5d593e76ca3c3caa0547ff1dd3e9e433a649cb655e8c1ad876faa518cd04fbf7daeb7be3f9d89625bfd2c77d DIST shorewall6-lite-5.0.4.tar.bz2 45573 SHA256 ea578f90bdb5b797c5604a4490ce90437bb4fbc1384f99ef131b2a6415ce6cfe SHA512 eb85ba4cc7992acb0667c735593cceb958ffa06fedd101a6c987078cbfb8509a7b979c92147dfbc4be58a00a2042a20d88873ba6048038ba5c6c8695487c3a85 WHIRLPOOL b040e1850f30103642d83a93467bb21d31a22a1e2c3759677720f0efc613d43759a278536f6304968fba208121f91a151df1b64f9dec6aaae3859f04a2da8215 DIST shorewall6-lite-5.0.7.2.tar.bz2 47869 SHA256 3351ec654e7c65c5f0e6865b604d04f8fd164ff10af892aa0e586282dbd8def1 SHA512 75003fba3d2dc6e3b4eea27b21574c893d1759de2db1b008fff2de233d90159c4221cc1018a693745f7786702049cfe21636d12e80c02aedd2cdc904599bda5b WHIRLPOOL 1129bcae9878fe0f2b34944fd0b10f117160c617be79d837da056c0fd50f6f5f1b0855707b014618a7a8db41a6ab59e30707e468dfed9ff6f1ca9437dce05833 +DIST shorewall6-lite-5.0.8.tar.bz2 51351 SHA256 970b738ac1d3f6c7ca64769fde7daedd855dfb4ce000127f48bb6a352e28c184 SHA512 bc4fa6cb635b25856764009a7d10cf9d38d3df820ee291658a38c8014491baa407476ff5f5955168b84090ee6c8fdaf2718ea77dacdf15abd5c862f0e2e6eed6 WHIRLPOOL 8cabd7086f0fe593dea29ace8fedcff7078a9ce5c07b314c104c53d758962a3f344a46268e814516ebd03a225b4296d0b381b676c9d52fe94ce2afa5557bf5da diff --git a/net-firewall/shorewall/files/shorewall-lite.confd-r1 b/net-firewall/shorewall/files/shorewall-lite.confd-r1 new file mode 100644 index 0000000..daef305 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall-lite.confd-r1 @@ -0,0 +1,19 @@ +# Global start/restart/stop options +# +OPTIONS="-tvv" + +# Start options +# +STARTOPTIONS="" + +# Stop options +# +STOPOPTIONS="" + +# Reload options +# +RELOADOPTIONS="" + +# Restart options +# +RESTARTOPTIONS="" diff --git a/net-firewall/shorewall/files/shorewall-lite.initd-r1 b/net-firewall/shorewall/files/shorewall-lite.initd-r1 new file mode 100644 index 0000000..f6dbccd --- /dev/null +++ b/net-firewall/shorewall/files/shorewall-lite.initd-r1 @@ -0,0 +1,83 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +description='The Shoreline Firewall Lite, more commonly known as "Shorewall Lite", is' +description="${description} a high-level tool for configuring Netfilter." + +extra_commands="clear" +extra_started_commands="reload reset" + +description_clear="Clear will remove all rules and chains installed by" +description_clear="${description_clear} Shorewall Lite. The firewall is" +description_clear="${description_clear} then wide open and unprotected." + +description_reload="Reload is similar to \"${RC_SERVICE} start\" except that it assumes" +description_reload="${description_reload} that the firewall is already started." +description_reload="${description_reload} Existing connections are maintained." + +description_reset="All the packet and byte counters in the firewall are reset." + +command="/usr/sbin/shorewall-lite" + +depend() { + provide firewall + after ulogd +} + +status() { + local _retval + ${command} status 1>/dev/null + _retval=$? + if [ ${_retval} = '0' ]; then + einfo 'status: started' + mark_service_started "${SVCNAME}" + return 0 + else + einfo 'status: stopped' + mark_service_stopped "${SVCNAME}" + return 3 + fi +} + +start() { + ebegin "Starting shorewall-lite" + ${command} ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null + eend $? +} + +stop() { + ebegin "Stopping shorewall-lite" + ${command} ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null + eend $? +} + +restart() { + ebegin "Restarting shorewall-lite" + ${command} status 1>/dev/null + if [ $? != 0 ] ; then + svc_start + else + ${command} ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null + fi + eend $? +} + +reload() { + ebegin "Reloading shorewall-lite" + ${command} ${OPTIONS} reload ${RELOADOPTIONS} 1>/dev/null + eend $? +} + +clear() { + ebegin "Clearing all shorewall-lite rules and setting policy to ACCEPT" + ${command} ${OPTIONS} clear 1>/dev/null + eend $? +} + +reset() { + ebegin "Resetting the packet and byte counters in shorewall-lite" + ${command} ${OPTIONS} reset 1>/dev/null + eend $? +} diff --git a/net-firewall/shorewall/files/shorewall.confd-r1 b/net-firewall/shorewall/files/shorewall.confd-r1 new file mode 100644 index 0000000..daef305 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall.confd-r1 @@ -0,0 +1,19 @@ +# Global start/restart/stop options +# +OPTIONS="-tvv" + +# Start options +# +STARTOPTIONS="" + +# Stop options +# +STOPOPTIONS="" + +# Reload options +# +RELOADOPTIONS="" + +# Restart options +# +RESTARTOPTIONS="" diff --git a/net-firewall/shorewall/files/shorewall.initd-r1 b/net-firewall/shorewall/files/shorewall.initd-r1 new file mode 100644 index 0000000..74cadf2 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall.initd-r1 @@ -0,0 +1,108 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +description='The Shoreline Firewall, more commonly known as "Shorewall", is' +description="${description} a high-level tool for configuring Netfilter." + +extra_commands="check clear" +extra_started_commands="refresh reload reset" + +description_check="Checks if the configuration will compile or not." + +description_clear="Clear will remove all rules and chains installed by" +description_clear="${description_clear} Shorewall. The firewall is then" +description_clear="${description_clear} wide open and unprotected." + +description_refresh="The mangle table will be refreshed along with the" +description_refresh="${description_refresh} blacklist chain (if any)." + +description_reload="Reload is similar to \"${RC_SERVICE} start\" except that it assumes" +description_reload="${description_reload} that the firewall is already started." +description_reload="${description_reload} Existing connections are maintained." + +description_reset="All the packet and byte counters in the firewall are reset." + +command="/usr/sbin/shorewall" + +depend() { + provide firewall + after ulogd +} + +status() { + local _retval + ${command} status 1>/dev/null + _retval=$? + if [ ${_retval} = '0' ]; then + einfo 'status: started' + mark_service_started "${SVCNAME}" + return 0 + else + einfo 'status: stopped' + mark_service_stopped "${SVCNAME}" + return 3 + fi +} + +start() { + ebegin "Starting shorewall" + ${command} ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null + eend $? +} + +stop() { + ebegin "Stopping shorewall" + ${command} ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null + eend $? +} + +restart() { + ebegin "Restarting shorewall" + ${command} status 1>/dev/null + if [ $? != 0 ] ; then + svc_start + else + ${command} ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null + fi + eend $? +} + +clear() { + ebegin "Clearing all shorewall rules and setting policy to ACCEPT" + ${command} ${OPTIONS} clear 1>/dev/null + eend $? +} + +reload() { + ebegin "Reloading shorewall" + ${command} ${OPTIONS} reload ${RELOADOPTIONS} 1>/dev/null + eend $? +} + +reset() { + ebegin "Resetting the packet and byte counters in shorewall" + ${command} ${OPTIONS} reset 1>/dev/null + eend $? +} + +refresh() { + # refresh the rules involving the broadcast addresses of firewall + # interfaces, the black list, traffic control rules and + # ECN control rules + + ebegin "Refreshing shorewall rules" + ${command} ${OPTIONS} refresh 1>/dev/null + eend $? +} + +check() { + # perform cursory validation of the zones, interfaces, hosts, rules + # and policy files. CAUTION: does not parse and validate the generated + # iptables commands. + + ebegin "Checking shorewall configuration" + ${command} ${OPTIONS} check 1>/dev/null + eend $? +} diff --git a/net-firewall/shorewall/files/shorewall6-lite.confd-r1 b/net-firewall/shorewall/files/shorewall6-lite.confd-r1 new file mode 100644 index 0000000..daef305 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall6-lite.confd-r1 @@ -0,0 +1,19 @@ +# Global start/restart/stop options +# +OPTIONS="-tvv" + +# Start options +# +STARTOPTIONS="" + +# Stop options +# +STOPOPTIONS="" + +# Reload options +# +RELOADOPTIONS="" + +# Restart options +# +RESTARTOPTIONS="" diff --git a/net-firewall/shorewall/files/shorewall6-lite.initd-r1 b/net-firewall/shorewall/files/shorewall6-lite.initd-r1 new file mode 100644 index 0000000..8bca1e1 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall6-lite.initd-r1 @@ -0,0 +1,93 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +description='The Shoreline Firewall 6 Lite, more commonly known as "Shorewall6 Lite", is' +description="${description} a high-level tool for configuring Netfilter." + +extra_commands="clear" +extra_started_commands="reload reset" + +description_clear="Clear will remove all rules and chains installed by" +description_clear="${description_clear} Shorewall6 Lite. The firewall is" +description_clear="${description_clear} then wide open and unprotected." + +description_reload="Reload is similar to \"${RC_SERVICE} start\" except that it assumes" +description_reload="${description_reload} that the firewall is already started." +description_reload="${description_reload} Existing connections are maintained." + +description_reset="All the packet and byte counters in the firewall are reset." + +command="/usr/sbin/shorewall6-lite" + +depend() { + provide firewall + after ulogd +} + +status() { + local _retval + ${command} status 1>/dev/null + _retval=$? + if [ ${_retval} = '0' ]; then + einfo 'status: started' + mark_service_started "${SVCNAME}" + return 0 + else + einfo 'status: stopped' + mark_service_stopped "${SVCNAME}" + return 3 + fi +} + +start() { + ebegin "Starting shorewall6-lite" + ${command} ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null + eend $? +} + +stop() { + ebegin "Stopping shorewall6-lite" + ${command} ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null + eend $? +} + +restart() { + # shorewall comes with its own control script that includes a + # restart function, so refrain from calling svc_stop/svc_start + # here. Note that this comment is required to fix bug 55576; + # runscript.sh greps this script... (09 Jul 2004 agriffis) + + ebegin "Restarting shorewall6-lite" + ${command} status 1>/dev/null + if [ $? != 0 ] ; then + svc_start + else + ${command} ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null + fi + eend $? +} + +clear() { + # clear will remove all the rules and bring the system to an unfirewalled + # state. (21 Nov 2004 eldad) + + ebegin "Clearing all shorewall6-lite rules and setting policy to ACCEPT" + ${command} ${OPTIONS} clear 1>/dev/null + eend $? +} + +reload() { + ebegin "Reloading shorewall6-lite" + ${command} ${OPTIONS} reload ${RELOADOPTIONS} 1>/dev/null + eend $? +} + +reset() { + # reset the packet and byte counters in the firewall + + ebegin "Resetting the packet and byte counters in shorewall6-lite" + ${command} ${OPTIONS} reset 1>/dev/null + eend $? +} diff --git a/net-firewall/shorewall/files/shorewall6.confd-r1 b/net-firewall/shorewall/files/shorewall6.confd-r1 new file mode 100644 index 0000000..f372685 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall6.confd-r1 @@ -0,0 +1,19 @@ +# Global start/restart/stop options +# +OPTIONS="-tvv" + +# Start options +# +STARTOPTIONS="" + +# Stop options +# +STOPOPTIONS="" + +# Reload options +# +RELOADOPTIONS="" + +# Restart options +# +RESTARTOPTIONS="" diff --git a/net-firewall/shorewall/files/shorewall6.initd-r1 b/net-firewall/shorewall/files/shorewall6.initd-r1 new file mode 100644 index 0000000..c725a28 --- /dev/null +++ b/net-firewall/shorewall/files/shorewall6.initd-r1 @@ -0,0 +1,118 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +description='The Shoreline Firewall 6, more commonly known as "Shorewall6", is' +description="${description} a high-level tool for configuring Netfilter." + +extra_commands="check clear" +extra_started_commands="refresh reload reset" + +description_check="Checks if the configuration will compile or not." + +description_clear="Clear will remove all rules and chains installed by" +description_clear="${description_clear} Shorewall6. The firewall is then" +description_clear="${description_clear} wide open and unprotected." + +description_refresh="The mangle table will be refreshed along with the" +description_refresh="${description_refresh} blacklist chain (if any)." + +description_reload="Reload is similar to \"${RC_SERVICE} start\" except that it assumes" +description_reload="${description_reload} that the firewall is already started." +description_reload="${description_reload} Existing connections are maintained." + +description_reset="All the packet and byte counters in the firewall are reset." + +command="/usr/sbin/shorewall6" + +depend() { + provide firewall + after ulogd +} + +status() { + local _retval + ${command} status 1>/dev/null + _retval=$? + if [ ${_retval} = '0' ]; then + einfo 'status: started' + mark_service_started "${SVCNAME}" + return 0 + else + einfo 'status: stopped' + mark_service_stopped "${SVCNAME}" + return 3 + fi +} + +start() { + ebegin "Starting shorewall6" + ${command} ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null + eend $? +} + +stop() { + ebegin "Stopping shorewall6" + ${command} ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null + eend $? +} + +restart() { + # shorewall comes with its own control script that includes a + # restart function, so refrain from calling svc_stop/svc_start + # here. Note that this comment is required to fix bug 55576; + # runscript.sh greps this script... (09 Jul 2004 agriffis) + + ebegin "Restarting shorewall6" + ${command} status 1>/dev/null + if [ $? != 0 ] ; then + svc_start + else + ${command} ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null + fi + eend $? +} + +clear() { + # clear will remove all the rules and bring the system to an unfirewalled + # state. (21 Nov 2004 eldad) + + ebegin "Clearing all shorewall rules and setting policy to ACCEPT" + ${command} ${OPTIONS} clear 1>/dev/null + eend $? +} + +reload() { + ebegin "Reloading shorewall6" + ${command} ${OPTIONS} reload ${RELOADOPTIONS} 1>/dev/null + eend $? +} + +reset() { + # reset the packet and byte counters in the firewall + + ebegin "Resetting the packet and byte counters in shorewall6" + ${command} ${OPTIONS} reset 1>/dev/null + eend $? +} + +refresh() { + # refresh the rules involving the broadcast addresses of firewall + # interfaces, the black list, traffic control rules and + # ECN control rules + + ebegin "Refreshing shorewall6 rules" + ${command} ${OPTIONS} refresh 1>/dev/null + eend $? +} + +check() { + # perform cursory validation of the zones, interfaces, hosts, rules + # and policy files. CAUTION: does not parse and validate the generated + # iptables commands. + + ebegin "Checking shorewall6 configuration" + ${command} ${OPTIONS} check 1>/dev/null + eend $? +} diff --git a/net-firewall/shorewall/shorewall-5.0.8.ebuild b/net-firewall/shorewall/shorewall-5.0.8.ebuild new file mode 100644 index 0000000..96d62a2 --- /dev/null +++ b/net-firewall/shorewall/shorewall-5.0.8.ebuild @@ -0,0 +1,446 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +inherit linux-info prefix systemd versionator + +DESCRIPTION='A high-level tool for configuring Netfilter' +HOMEPAGE="http://www.shorewall.net/"; +LICENSE="GPL-2" +SLOT="0" +IUSE="doc +init +ipv4 ipv6 lite4 lite6" + +MY_PV=${PV/_rc/-RC} +MY_PV=${MY_PV/_beta/-Beta} +MY_P=${PN}-${MY_PV} + +MY_MAJOR_RELEASE_NUMBER=$(get_version_component_range 1-2) +MY_MAJORMINOR_RELEASE_NUMBER=$(get_version_component_range 1-3) + +# shorewall +MY_PN_IPV4=Shorewall +MY_P_IPV4=${MY_PN_IPV4/#S/s}-${MY_PV} + +# shorewall6 +MY_PN_IPV6=Shorewall6 +MY_P_IPV6=${MY_PN_IPV6/#S/s}-${MY_PV} + +# shorewall-lite +MY_PN_LITE4=Shorewall-lite +MY_P_LITE4=${MY_PN_LITE4/#S/s}-${MY_PV} + +# shorewall6-lite +MY_PN_LITE6=Shorewall6-lite +MY_P_LITE6=${MY_PN_LITE6/#S/s}-${MY_PV} + +# shorewall-init +MY_PN_INIT=Shorewall-init +MY_P_INIT=${MY_PN_INIT/#S/s}-${MY_PV} + +# shorewall-core +MY_PN_CORE=Shorewall-core +MY_P_CORE=${MY_PN_CORE/#S/s}-${MY_PV} + +# shorewall-docs-html +MY_PN_DOCS=Shorewall-docs-html +MY_P_DOCS=${MY_PN_DOCS/#S/s}-${MY_PV} + +# Upstream URL schema: +# Beta: $MIRROR/pub/shorewall/development/4.6/shorewall-4.6.4-Beta2/shorewall-4.6.4-Beta2.tar.bz2 +# RC: $MIRROR/pub/shorewall/development/4.6/shorewall-4.6.4-RC1/shorewall-4.6.4-RC1.tar.bz2 +# Release: $MIRROR/pub/shorewall/4.6/shorewall-4.6.3/shorewall-4.6.3.3.tar.bz2 + +MY_URL_PREFIX= +MY_URL_SUFFIX= +if [[ ${MY_PV} = *-Beta* ]] || [[ ${MY_PV} = *-RC* ]]; then + MY_URL_PREFIX='development/' + + _tmp_last_index=$(($(get_last_version_component_index ${MY_PV})+1)) + _tmp_suffix=$(get_version_component_range ${_tmp_last_index} ${MY_PV}) + if [[ ${_tmp_suffix} = *Beta* ]] || [[ ${_tmp_suffix} = *RC* ]]; then + MY_URL_SUFFIX="-${_tmp_suffix}" + fi + + # Cleaning up temporary variables + unset _tmp_last_index + unset _tmp_suffix +else + KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +fi + +SRC_URI=" + http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-core-${MY_PV}.tar.bz2 + ipv4? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-${MY_PV}.tar.bz2 ) + ipv6? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall6-${MY_PV}.tar.bz2 ) + lite4? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-lite-${MY_PV}.tar.bz2 ) + lite6? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall6-lite-${MY_PV}.tar.bz2 ) + init? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-init-${MY_PV}.tar.bz2 ) + doc? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/${MY_P_DOCS}.tar.bz2 ) +" + +# - Shorewall6 requires Shorewall +# - Installing Shorewall-init or just the documentation doesn't make any sense, +# that's why we force the user to select at least one "real" Shorewall product +# +# See http://shorewall.net/download.htm#Which +REQUIRED_USE=" + ipv6? ( ipv4 ) + || ( ipv4 lite4 lite6 ) +" + +# No build dependencies! Just plain shell scripts... +DEPEND="" + +RDEPEND=" + >=net-firewall/iptables-1.4.20 + >=sys-apps/iproute2-3.8.0[-minimal] + >=sys-devel/bc-1.06.95 + ipv4? ( + >=dev-lang/perl-5.16 + virtual/perl-Digest-SHA + ) + ipv6? ( + >=dev-perl/Socket6-0.230.0 + >=net-firewall/iptables-1.4.20[ipv6] + >=sys-apps/iproute2-3.8.0[ipv6] + ) + lite6? ( + >=net-firewall/iptables-1.4.20[ipv6] + >=sys-apps/iproute2-3.8.0[ipv6] + ) + init? ( >=sys-apps/coreutils-8.20 ) + !net-firewall/shorewall-core + !net-firewall/shorewall6 + !net-firewall/shorewall-lite + !net-firewall/shorewall6-lite + !net-firewall/shorewall-init + !<sys-apps/systemd-214 +" + +S=${WORKDIR} + +pkg_pretend() { + local CONFIG_CHECK="~NF_CONNTRACK" + + local WARNING_CONNTRACK="Without NF_CONNTRACK support, you will be unable" + local WARNING_CONNTRACK+=" to run any shorewall-based firewall on the local system." + + if use ipv4 || use lite4; then + CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4" + + local WARNING_CONNTRACK_IPV4="Without NF_CONNTRACK_IPV4 support, you will" + local WARNING_CONNTRACK_IPV4+=" be unable to run any shorewall-based IPv4 firewall on the local system." + fi + + if use ipv6 || use lite6; then + CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV6" + + local WARNING_CONNTRACK_IPV6="Without NF_CONNTRACK_IPV6 support, you will" + local WARNING_CONNTRACK_IPV6+=" be unable to run any shorewall-based IPv6 firewall on the local system." + fi + + check_extra_config +} + +pkg_setup() { + if [ -n "${DIGEST}" ]; then + einfo "Unsetting environment variable \"DIGEST\" to prevent conflicts with package's \"install.sh\" script ..." + unset DIGEST + fi +} + +src_prepare() { + # We are moving each unpacked source from MY_P_* to MY_PN_*. + # This allows us to use patches from upstream and keeps epatch_user working + + einfo "Preparing shorewallrc ..." + cp "${FILESDIR}"/shorewallrc "${S}"/shorewallrc.gentoo || die "Copying shorewallrc failed" + eprefixify "${S}"/shorewallrc.gentoo + + # shorewall-core + mv "${S}"/${MY_P_CORE} "${S}"/${MY_PN_CORE} || die "Failed to move '${S}/${MY_P_CORE}' to '${S}/${MY_PN_CORE}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_CORE} ..." + ln -s ../shorewallrc.gentoo ${MY_PN_CORE}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + eend 0 + + # shorewall + if use ipv4; then + mv "${S}"/${MY_P_IPV4} "${S}"/${MY_PN_IPV4} || die "Failed to move '${S}/${MY_P_IPV4}' to '${S}/${MY_PN_IPV4}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_IPV4}" + ln -s ../shorewallrc.gentoo ${MY_PN_IPV4}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + cp "${FILESDIR}"/shorewall.confd-r1 "${S}"/${MY_PN_IPV4}/default.gentoo || die "Copying shorewall.confd-r1 failed" + cp "${FILESDIR}"/shorewall.initd-r1 "${S}"/${MY_PN_IPV4}/init.gentoo.sh || die "Copying shorewall.initd-r1 failed" + cp "${FILESDIR}"/shorewall.systemd "${S}"/${MY_PN_IPV4}/gentoo.service || die "Copying shorewall.systemd failed" + eend 0 + fi + + # shorewall6 + if use ipv6; then + mv "${S}"/${MY_P_IPV6} "${S}"/${MY_PN_IPV6} || die "Failed to move '${S}/${MY_P_IPV6}' to '${S}/${MY_PN_IPV6}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_IPV6}" + ln -s ../shorewallrc.gentoo ${MY_PN_IPV6}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + cp "${FILESDIR}"/shorewall6.confd-r1 "${S}"/${MY_PN_IPV6}/default.gentoo || die "Copying shorewall6.confd-r1 failed" + cp "${FILESDIR}"/shorewall6.initd-r1 "${S}"/${MY_PN_IPV6}/init.gentoo.sh || die "Copying shorewall6.initd-r1 failed" + cp "${FILESDIR}"/shorewall6.systemd "${S}"/${MY_PN_IPV6}/gentoo.service || die "Copying shorewall6.systemd failed" + eend 0 + fi + + # shorewall-lite + if use lite4; then + mv "${S}"/${MY_P_LITE4} "${S}"/${MY_PN_LITE4} || die "Failed to move '${S}/${MY_P_LITE4}' to '${S}/${MY_PN_LITE4}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_LITE4}" + ln -s ../shorewallrc.gentoo ${MY_PN_LITE4}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + cp "${FILESDIR}"/shorewall-lite.confd-r1 "${S}"/${MY_PN_LITE4}/default.gentoo || die "Copying shorewall-lite.confd-r1 failed" + cp "${FILESDIR}"/shorewall-lite.initd-r1 "${S}"/${MY_PN_LITE4}/init.gentoo.sh || die "Copying shorewall-lite.initd-r1 failed" + cp "${FILESDIR}"/shorewall-lite.systemd "${S}"/${MY_PN_LITE4}/gentoo.service || die "Copying shorewall-lite.systemd failed" + eend 0 + fi + + # shorewall6-lite + if use lite6; then + mv "${S}"/${MY_P_LITE6} "${S}"/${MY_PN_LITE6} || die "Failed to move '${S}/${MY_P_LITE6}' to '${S}/${MY_PN_LITE6}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_LITE6}" + ln -s ../shorewallrc.gentoo ${MY_PN_LITE6}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + cp "${FILESDIR}"/shorewall6-lite.confd-r1 "${S}"/${MY_PN_LITE6}/default.gentoo || die "Copying shorewall6-lite.confd-r1 failed" + cp "${FILESDIR}"/shorewall6-lite.initd-r1 "${S}"/${MY_PN_LITE6}/init.gentoo.sh || die "Copying shorewall6-lite.initd-r1 failed" + cp "${FILESDIR}"/shorewall6-lite.systemd "${S}"/${MY_PN_LITE6}/gentoo.service || die "Copying shorewall6-lite.systemd failed" + eend 0 + fi + + # shorewall-init + if use init; then + mv "${S}"/${MY_P_INIT} "${S}"/${MY_PN_INIT} || die "Failed to move '${S}/${MY_P_INIT}' to '${S}/${MY_PN_INIT}'" + ebegin "Applying Gentoo-specific changes to ${MY_P_INIT}" + ln -s ../shorewallrc.gentoo ${MY_PN_INIT}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo" + cp "${FILESDIR}"/shorewall-init.confd "${S}"/${MY_PN_INIT}/default.gentoo || die "Copying shorewall-init.confd failed" + cp "${FILESDIR}"/shorewall-init.initd "${S}"/${MY_PN_INIT}/init.gentoo.sh || die "Copying shorewall-init.initd failed" + cp "${FILESDIR}"/shorewall-init.systemd "${S}"/${MY_PN_INIT}/gentoo.service || die "Copying shorewall-init.systemd failed" + cp "${FILESDIR}"/shorewall-init.readme "${S}"/${MY_PN_INIT}/shorewall-init.README.Gentoo.txt || die "Copying shorewall-init.systemd failed" + eend 0 + + eprefixify "${S}"/${MY_PN_INIT}/init.gentoo.sh + + cd "${S}"/${MY_PN_INIT} + eapply -p2 "${FILESDIR}"/shorewall-init-01_remove-ipset-functionality.patch + cd "${S}" + fi + + # shorewall-docs-html + if use doc; then + mv "${S}"/${MY_P_DOCS} "${S}"/${MY_PN_DOCS} || die "Failed to move '${S}/${MY_P_DOCS}' to '${S}/${MY_PN_DOCS}'" + fi + + eapply_user +} + +src_configure() { + :; +} + +src_compile() { + :; +} + +src_install() { + # shorewall-core + einfo "Installing ${MY_P_CORE} ..." + DESTDIR="${D%/}" ${MY_PN_CORE}/install.sh shorewallrc.gentoo || die "${MY_PN_CORE}/install.sh failed" + dodoc "${S}"/${MY_PN_CORE}/changelog.txt "${S}"/${MY_PN_CORE}/releasenotes.txt + + # shorewall + if use ipv4; then + einfo "Installing ${MY_P_IPV4} ..." + keepdir /var/lib/shorewall + DESTDIR="${D%/}" ${MY_PN_IPV4}/install.sh shorewallrc.gentoo || die "${MY_PN_IPV4}/install.sh failed" + + if use doc; then + dodoc -r "${S}"/${MY_PN_IPV4}/Samples + fi + fi + + # shorewall6 + if use ipv6; then + einfo "Installing ${MY_P_IPV6} ..." + keepdir /var/lib/shorewall6 + DESTDIR="${D%/}" ${MY_PN_IPV6}/install.sh shorewallrc.gentoo || die "${MY_PN_IPV6}/install.sh failed" + + if use doc; then + dodoc -r "${S}"/${MY_PN_IPV6}/Samples6 + fi + fi + + # shorewall-lite + if use lite4; then + einfo "Installing ${MY_P_LITE4} ..." + keepdir /var/lib/shorewall-lite + DESTDIR="${D%/}" ${MY_PN_LITE4}/install.sh shorewallrc.gentoo || die "${MY_PN_LITE4}/install.sh failed" + fi + + # shorewall6-lite + if use lite6; then + einfo "Installing ${MY_P_LITE6} ..." + keepdir /var/lib/shorewall6-lite + DESTDIR="${D%/}" ${MY_PN_LITE6}/install.sh shorewallrc.gentoo || die "${MY_PN_LITE6}/install.sh failed" + fi + + # shorewall-init + if use init; then + einfo "Installing ${MY_P_INIT} ..." + DESTDIR="${D%/}" ${MY_PN_INIT}/install.sh shorewallrc.gentoo || die "${MY_PN_INIT}/install.sh failed" + dodoc "${S}"/${MY_PN_INIT}/shorewall-init.README.Gentoo.txt + + if [ -f "${D}etc/logrotate.d/shorewall-init" ]; then + # On Gentoo, shorewall-init will not create shorewall-ifupdown.log, + # so we don't need a logrotate configuration file for shorewall-init + einfo "Removing unused \"${D}etc/logrotate.d/shorewall-init\" ..." + rm -rf "${D}"etc/logrotate.d/shorewall-init || die "Removing \"${D}etc/logrotate.d/shorewall-init\" failed" + fi + + if [ -d "${D}etc/NetworkManager" ]; then + # On Gentoo, we don't support NetworkManager + # so we don't need this folder at all + einfo "Removing unused \"${D}etc/NetworkManager\" ..." + rm -rf "${D}"etc/NetworkManager || die "Removing \"${D}etc/NetworkManager\" failed" + fi + + if [ -f "${D}usr/share/shorewall-init/ifupdown" ]; then + # This script isn't supported on Gentoo + rm -rf "${D}"usr/share/shorewall-init/ifupdown || die "Removing \"${D}usr/share/shorewall-init/ifupdown\" failed" + fi + fi + + if use doc; then + einfo "Installing ${MY_P_DOCS} ..." + docinto html && dodoc -r "${S}"/${MY_PN_DOCS}/* + fi +} + +pkg_postinst() { + if [[ -z "${REPLACING_VERSIONS}" ]]; then + # This is a new installation + + # Show first steps for shorewall/shorewall6 + local _PRODUCTS="" + if use ipv4; then + _PRODUCTS="shorewall" + + if use ipv6; then + _PRODUCTS="${_PRODUCTS}/shorewall6" + fi + fi + + if [[ -n "${_PRODUCTS}" ]]; then + elog "Before you can use ${_PRODUCTS}, you need to edit its configuration in:" + elog "" + elog " /etc/shorewall/shorewall.conf" + + if use ipv6; then + elog " /etc/shorewall6/shorewall6.conf" + fi + + elog "" + elog "To activate your shorewall-based firewall on system start, please add ${_PRODUCTS} to your default runlevel:" + elog "" + elog " # rc-update add shorewall default" + + if use ipv6; then + elog " # rc-update add shorewall6 default" + fi + fi + + # Show first steps for shorewall-lite/shorewall6-lite + _PRODUCTS="" + if use lite4; then + _PRODUCTS="shorewall-lite" + fi + + if use lite6; then + if [[ -z "${_PRODUCTS}" ]]; then + _PRODUCTS="shorewall6-lite" + else + _PRODUCTS="${_PRODUCTS}/shorewall6-lite" + fi + fi + + if [[ -n "${_PRODUCTS}" ]]; then + if use ipv4; then + elog "" + fi + + elog "Before you can use ${_PRODUCTS}, you need to provide a configuration, which you can" + elog "create using ${CATEGORY}/shorewall (with \"ipv4\" and or \"ipv6\" USE flag)." + elog "" + elog "To read more about ${_PRODUCTS}, please visit" + elog " http://shorewall.net/CompiledPrograms.html"; + elog "" + elog "To activate your shorewall-lite-based firewall on system start, please add ${PRODUCTS} to your default runlevel:" + elog "" + + if use lite4; then + elog " # rc-update add shorewall-lite default" + fi + + if use lite6; then + elog " # rc-update add shorewall6-lite default" + fi + fi + + if use init; then + elog "" + elog "To secure your system on boot, please add shorewall-init to your boot runlevel:" + elog "" + elog " # rc-update add shorewall-init boot" + elog "" + elog "and review \$PRODUCTS in" + elog "" + elog " /etc/conf.d/shorewall-init" + fi + + fi + + if [[ -n "${REPLACING_VERSIONS}" && ${REPLACING_VERSIONS} < ${MY_MAJOR_RELEASE_NUMBER} ]]; then + # This is an upgrade + + elog "You are upgrading from a previous major version. It is highly recommended that you read" + elog "" + elog " - /usr/share/doc/shorewall*/releasenotes.tx*" + elog " - http://shorewall.net/upgrade_issues.htm#idp8704902640"; + + if use ipv4; then + elog "" + elog "You can auto-migrate your configuration using" + elog "" + elog " # shorewall update -A" + + if use ipv6; then + elog " # shorewall6 update -A" + fi + + elog "" + elog "But if you are not familiar with the \"shorewall[6] update\" command," + elog "please read the shorewall[6] man page first." + fi + fi + + if ! use init; then + elog "" + elog "Consider emerging ${CATEGORY}/${PN} with USE flag \"init\" to secure your system on boot" + elog "before your shorewall-based firewall is ready to start." + elog "" + elog "To read more about shorewall-init, please visit" + elog " http://www.shorewall.net/Shorewall-init.html"; + fi + + if ! has_version "net-firewall/conntrack-tools"; then + elog "" + elog "Your Shorewall firewall can utilize \"conntrack\" from the \"net-firewall/conntrack-tools\"" + elog "package. if you want to use this feature, you need to install \"net-firewall/conntrack-tools\"!" + fi + + if ! has_version "dev-perl/Devel-NYTProf"; then + elog "" + elog "If you want to profile your Shorewall firewall you need to install \"dev-perl/Devel-NYTProf\"!" + fi +}
