#!/usr/bin/bash
# JOBoRun		: Jwm OpenBox Obarun RUNit
# Maintainer	: Joe Bo Run <joborun@disroot.org>
# PkgSource		: url="https://gittea.disroot.org/joborun-pkg/jobcore/$pkgname"
# Website		: https://pozol.eu
#-----------------------------------------| DESCRIPTION |---------------------------------------

pkgbase=iptables
pkgname=(iptables iptables-nft)
pkgver=1.8.9
pkgrel=01
epoch=1
pkgdesc='Linux kernel packet control tool - w/o ipv6 & systemd'
arch=(x86_64)
url='https://www.netfilter.org/projects/iptables/index.html'
depends=(libnftnl libpcap libnfnetlink libnetfilter_conntrack bash)
makedepends=(linux-api-headers)
backup=(etc/ethertypes etc/iptables/{ip,ip6}tables.rules)
source=(https://www.netfilter.org/projects/iptables/files/$pkgbase-$pkgver.tar.xz{,.sig}
        empty.rules simple_firewall.rules empty-{filter,mangle,nat,raw,security}.rules
        iptables-format-security-libxt_NAT.patch::https://git.netfilter.org/iptables/patch/?id=ed4082a7405a5838c205a34c1559e289949200cc
        iptables-apply-default-path.patch)

prepare() {
  mkdir build
  cd $pkgbase-$pkgver

  # use system one
  rm include/linux/types.h

  ln -rs libiptc/linux_list.h include/libiptc
  patch -p1 -i ../iptables-format-security-libxt_NAT.patch # Fix build with -Werror=format-security
  # use Arch path
  patch -p0 -i ../iptables-apply-default-path.patch

}

build() {
  cd build
  ../$pkgbase-$pkgver/configure \
    --prefix=/usr \
    --sysconfdir=/etc \
    --sbindir=/usr/bin \
    --libexecdir=/usr/lib \
    --enable-bpf-compiler \
    --enable-devel \
    --enable-libipq \
    --enable-shared \
    --disable-ipv6
  sed -e 's/ -shared / -Wl,-O1,--as-needed\0/g' -i libtool
  make
}

package_iptables() {
  pkgdesc+=' (using legacy interface - no ipv6)'
  _package legacy
}

package_iptables-nft() {
  pkgdesc+=' (using nft interface - no ipv6)'
  depends+=(nftables)
  provides=(iptables arptables ebtables)
  conflicts=(iptables arptables ebtables)
  backup+=(etc/{arp,eb}tables.conf)

  _package nft

#  install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {arp,eb}tables.service
  touch "$pkgdir"/etc/{arp,eb}tables.conf
}

_package() {
  DESTDIR="$pkgdir" make -C build install

  for _x in {arp,eb,ip}tables{,-restore,-save} iptables-xml; do
    if [[ $1 = nft || $_x = ip* ]]; then
      ln -sf xtables-$1-multi "$pkgdir/usr/bin/$_x"
    else
      rm "$pkgdir/usr/bin/$_x"
    fi
  done

#  install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {ip,ip6}tables.service
#  install -D iptables-$1-flush "$pkgdir/usr/lib/systemd/scripts/iptables-flush"

  install -Dm644 empty.rules "$pkgdir/etc/iptables/iptables.rules"
#  install -Dm644 empty.rules "$pkgdir/etc/iptables/ip6tables.rules"
  install -Dt "$pkgdir/usr/share/iptables" -m644 *.rules
  ln -srt "$pkgdir/etc/iptables" "$pkgdir"/usr/share/iptables/{empty,simple_firewall}.rules
}

#---- license gpg-key sha256sums ----

license=(GPL2)

validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4'
              '37D964ACC04981C75500FB9BD55D978A8A1420E4') # Netfilter Core Team

sha256sums=(ef6639a43be8325a4f8ea68123ffac236cb696e8c78501b64e8106afb008c87f  # iptables-1.8.9.tar.xz
	868cceb5bb6a44b89d6f22f0be3291056df1fbc300542dbb7a62f6539bf28673  # iptables-1.8.9.tar.xz.sig
	630d774f089703c2c7370db6d7c188dae25d00c26feaa3d3de8eb52519033948  # empty.rules
	9e83d7ae39d31881790f814930d44acbaeab1520adb2fb4fcb80f0bbfab174b9  # simple_firewall.rules
	09b90da35c2c8cb0fbda63b300f06d2387a102ca53a40980ef0b49829e249528  # empty-filter.rules
	92755648f456e235d17a8faeb5f46d27af66eb4db10ea4bac0abd3e35e2dae07  # empty-mangle.rules
	52bd70dff3e1e1a64127ad7ed86840834b79756c3bdb6947b7c6279ffe95dd48  # empty-nat.rules
	5768a471c0559848635c39d270e456bfa5c43eda65f5f6f666fea2d277183a37  # empty-raw.rules
	91161a73f323016a9efc5eabd16243d20f8ca2467995cf0eabfb95f845090121  #  empty-security.rules
	3784e61958cf96a8e5e04df885defadf1cd70caa1e9d6c6f144bdbc64441eabe  # iptables-format-security-libxt_NAT.patch
	770ceaedce26d05eb1b9d0c4c65f5b8e92facd1dc0652a29c859336d6bc347f6) # iptables-apply-default-path.patch