diff options
| author | V3n3RiX <venerix@koprulu.sector> | 2023-03-15 06:20:30 +0000 |
|---|---|---|
| committer | V3n3RiX <venerix@koprulu.sector> | 2023-03-15 06:20:30 +0000 |
| commit | bb007f0b04c719fd2b846d177c3c4739fdb7c318 (patch) | |
| tree | 80f756c3d190f4dbf28e8016c211ab618a50ccb9 /net-firewall/nftables/nftables-9999.ebuild | |
| parent | 1f048d9b860b8c7b69ac8dd085edc9ee3191b2d5 (diff) | |
gentoo auto-resync : 15:03:2023 - 06:20:30
Diffstat (limited to 'net-firewall/nftables/nftables-9999.ebuild')
| -rw-r--r-- | net-firewall/nftables/nftables-9999.ebuild | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/net-firewall/nftables/nftables-9999.ebuild b/net-firewall/nftables/nftables-9999.ebuild index f60144b1a850..f9713c4a95f6 100644 --- a/net-firewall/nftables/nftables-9999.ebuild +++ b/net-firewall/nftables/nftables-9999.ebuild @@ -26,7 +26,8 @@ else BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )" fi -LICENSE="GPL-2" +# See COPYING: new code is GPL-2+, existing code is GPL-2 +LICENSE="GPL-2 GPL-2+" SLOT="0/1" IUSE="debug doc +gmp json libedit +modern-kernel python +readline static-libs test xtables" RESTRICT="!test? ( test )" @@ -167,10 +168,23 @@ src_install() { } pkg_preinst() { + local stderr + # There's a history of regressions with nftables upgrades. Add a safety # check to help us spot them earlier. if [[ -d /sys/module/nf_tables ]] && [[ -x /sbin/nft ]] && [[ -z ${ROOT} ]]; then - if ! /sbin/nft -t list ruleset | "${ED}"/sbin/nft -c -f -; then + # Check the current loaded ruleset, if any, using the newly + # built instance of nft(8). + if ! stderr=$(umask 177; /sbin/nft -t list ruleset 2>&1 >"${T}"/ruleset.nft); then + # Report errors induced by trying to list the ruleset + # but don't treat them as being fatal. + printf '%s\n' "${stderr}" >&2 + elif [[ ${stderr} == *"is managed by iptables-nft"* ]]; then + # Rulesets generated by iptables-nft are special in + # nature and will not always be printed in a way that + # constitutes a valid syntax for ntf(8). Ignore them. + return + elif ! "${ED}"/sbin/nft -c -f "${T}"/ruleset.nft; then eerror "Your currently loaded ruleset cannot be parsed by the newly built instance of" eerror "nft. This probably means that there is a regression introduced by v${PV}." eerror "(To make the ebuild fail instead of warning, set NFTABLES_ABORT_ON_RELOAD_FAILURE=1.)" |