iptables-fullconenat-nft

maintainer edward-p · 6 votes · base iptables-fullconenat · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code files (libipt_FULLCONENAT.c, libip6t_FULLCONENAT.c) from a GitHub repository to add FULLCONENAT support to iptables; these are C source files that are compiled as part of the build process, not prebuilt binaries or executable payloads, and the host, while not whitelisted, hosts legitimate project source code, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code files (libipt_FULLCONENAT.c, libip6t_FULLCONENAT.c) from a GitHub repository to add FULLCONENAT support to iptables; these are C source files that are compiled as part of the build process, not prebuilt binaries or executable payloads, and the host, while not whitelisted, hosts legitimate project source code, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=(https://www.netfilter.org/projects/iptables/files/$_pkgbase-$pkgver.tar.xz{,.sig}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Edward Pacman <edward@edward-p.xyz>
    
      2
    
      3_pkgbase=iptables
    
      4pkgbase=iptables-fullconenat
    
      5pkgname=(iptables-fullconenat iptables-fullconenat-nft)
    
      6pkgver=1.8.13
    
      7pkgrel=1
    
      8epoch=1
    
      9pkgdesc='Linux kernel packet control tool with FULLCONENAT support.'
    
      10arch=(x86_64)
    
      11license=('GPL-2.0-only')
    
      12url='https://www.netfilter.org/projects/iptables/index.html'
    
      13depends=(libnftnl libpcap libnfnetlink libnetfilter_conntrack bash)
    
      14makedepends=(linux-api-headers)
    
      15optdepends=("netfilter-fullconenat: kernel module for fullconenat")
    
      16provides=(libip4tc.so libip6tc.so libipq.so libxtables.so)
    
      17conflicts=(iptables)
    
      18install=${pkgbase}.install
    
      19backup=(etc/ethertypes etc/iptables/{ip,ip6}tables.rules)
    
      20source=(https://www.netfilter.org/projects/iptables/files/$_pkgbase-$pkgver.tar.xz{,.sig}
    
      21        empty.rules simple_firewall.rules empty-{filter,mangle,nat,raw,security}.rules
    
      22        {arp,eb,ip,ip6}tables.service iptables-{legacy,nft}-flush
    
      23        iptables-apply-default-path.patch
    
      24        "libipt_FULLCONENAT.c::https://raw.githubusercontent.com/llccd/netfilter-full-cone-nat/dev/libipt_FULLCONENAT.c"
    
      25        "libip6t_FULLCONENAT.c::https://raw.githubusercontent.com/llccd/netfilter-full-cone-nat/dev/libip6t_FULLCONENAT.c")
    
      26sha256sums=('1afcd33da9e8f913ace6a2126788162e207e26f5d5e29c6573c0e581ffc58b99'
    
      27            'SKIP'
    
      28            '630d774f089703c2c7370db6d7c188dae25d00c26feaa3d3de8eb52519033948'
    
      29            '9e83d7ae39d31881790f814930d44acbaeab1520adb2fb4fcb80f0bbfab174b9'
    
      30            '09b90da35c2c8cb0fbda63b300f06d2387a102ca53a40980ef0b49829e249528'
    
      31            '92755648f456e235d17a8faeb5f46d27af66eb4db10ea4bac0abd3e35e2dae07'
    
      32            '52bd70dff3e1e1a64127ad7ed86840834b79756c3bdb6947b7c6279ffe95dd48'
    
      33            '5768a471c0559848635c39d270e456bfa5c43eda65f5f6f666fea2d277183a37'
    
      34            '91161a73f323016a9efc5eabd16243d20f8ca2467995cf0eabfb95f845090121'
    
      35            'dd1a867085900eec1f1d4e12f97a1f44707c717246f6787ed42d4225343920d6'
    
      36            '82e09b4151d5c1dd0fc212189c670f8f29e8ec85e7e9cdc57f49dcea00d7e9ca'
    
      37            '78f090812b5bb9aec597ce2cf757da1c58ec772c60bf55f10267f06459aefd9b'
    
      38            'c37c69db5077a061fd72fc3b199712f1bed8688de8008f219223fadd6fa6c06f'
    
      39            '40680b3c877926a2bac698ea58f52d1d4b3ab152ee68ccd7fa7ca51aeedc3b2d'
    
      40            '6d3e7bdeebdaeaf83ed448f4d42a979c8c59fb5e919f6f860ed340c2c9afef1a'
    
      41            '770ceaedce26d05eb1b9d0c4c65f5b8e92facd1dc0652a29c859336d6bc347f6'
    
      42            '8db6a5a00ea5a40bb96a7bbdf4e4ce6bc92b5b6ef6c12b7a18559d1516e4c3e0'
    
      43            'dba600c891b5d7a83083f3baf076da7d80535a8d8a2fc6feae43faa650676470')
    
      44validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4'
    
      45              '37D964ACC04981C75500FB9BD55D978A8A1420E4'
    
      46              '8C5F7146A1757A65E2422A94D70D1A666ACF2B21') # Netfilter Core Teamls
    
      47
    
      48prepare() {
    
      49  mkdir build
    
      50  cd $_pkgbase-$pkgver
    
      51
    
      52  cp ../libip{,6}t_FULLCONENAT.c extensions/
    
      53  # use system one
    
      54  rm include/linux/types.h
    
      55
    
      56  ln -rs libiptc/linux_list.h include/libiptc
    
      57
    
      58  # use Arch path
    
      59  patch -p0 -i ../iptables-apply-default-path.patch
    
      60}
    
      61
    
      62build() {
    
      63  cd build
    
      64  ../$_pkgbase-$pkgver/configure \
    
      65    --prefix=/usr \
    
      66    --sysconfdir=/etc \
    
      67    --sbindir=/usr/bin \
    
      68    --libexecdir=/usr/lib \
    
      69    --enable-bpf-compiler \
    
      70    --enable-devel \
    
      71    --enable-libipq \
    
      72    --enable-shared
    
      73  sed -e 's/ -shared / -Wl,-O1,--as-needed\0/g' -i libtool
    
      74  make
    
      75}
    
      76
    
      77package_iptables-fullconenat() {
    
      78  pkgdesc+=' (using legacy interface)'
    
      79  _package legacy
    
      80}
    
      81
    
      82package_iptables-fullconenat-nft() {
    
      83  pkgdesc+=' (using nft interface)'
    
      84  depends+=(nftables)
    
      85  provides+=(iptables iptables-fullconenat arptables ebtables)
    
      86  conflicts+=(iptables iptables-fullconenat arptables ebtables)
    
      87  backup+=(etc/{arp,eb}tables.conf)
    
      88
    
      89  _package nft
    
      90
    
      91  install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {arp,eb}tables.service
    
      92  touch "$pkgdir"/etc/{arp,eb}tables.conf
    
      93}
    
      94
    
      95_package() {
    
      96  DESTDIR="$pkgdir" make -C build install
    
      97
    
      98  for _x in {arp,eb,ip,ip6}tables{,-restore,-save} iptables-xml; do
    
      99    if [[ $1 = nft || $_x = ip* ]]; then
    
      100      ln -sf xtables-$1-multi "$pkgdir/usr/bin/$_x"
    
      101    else
    
      102      rm "$pkgdir/usr/bin/$_x"
    
      103    fi
    
      104  done
    
      105
    
      106  install -Dt "$pkgdir/usr/lib/systemd/system" -m644 {ip,ip6}tables.service
    
      107  install -D iptables-$1-flush "$pkgdir/usr/lib/systemd/scripts/iptables-flush"
    
      108
    
      109  install -Dm644 empty.rules "$pkgdir/etc/iptables/iptables.rules"
    
      110  install -Dm644 empty.rules "$pkgdir/etc/iptables/ip6tables.rules"
    
      111  install -Dt "$pkgdir/usr/share/iptables" -m644 *.rules
    
      112  ln -srt "$pkgdir/etc/iptables" "$pkgdir"/usr/share/iptables/{empty,simple_firewall}.rules
    
      113}
    
      114
    
      115# vim:set sw=2 et:
    
      116

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2