1#!/bin/bash
2#
3# Copyright (C) 2018 The Android Open Source Project
4#
5# Licensed under the Apache License, Version 2.0 (the "License");
6# you may not use this file except in compliance with the License.
7# You may obtain a copy of the License at
8#
9#      http://www.apache.org/licenses/LICENSE-2.0
10#
11# Unless required by applicable law or agreed to in writing, software
12# distributed under the License is distributed on an "AS IS" BASIS,
13# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14# See the License for the specific language governing permissions and
15# limitations under the License.
16#
17
18set -e
19
20SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
21
22. $SCRIPT_DIR/common.sh
23
24chroot_sanity_check
25
26cd /root
27
28# Add the needed debian sources
29cat >/etc/apt/sources.list <<EOF
30deb http://ftp.debian.org/debian bullseye main
31deb-src http://ftp.debian.org/debian bullseye main
32EOF
33
34# Disable the automatic installation of recommended packages
35cat >/etc/apt/apt.conf.d/90recommends <<EOF
36APT::Install-Recommends "0";
37EOF
38
39# Update for the above changes
40apt-get update
41
42# Note what we have installed; we will go back to this
43LANG=C dpkg --get-selections | sort >originally-installed
44
45# Install everything needed from bullseye to build iptables
46apt-get install -y \
47  build-essential \
48  autoconf \
49  automake \
50  bison \
51  debhelper \
52  devscripts \
53  fakeroot \
54  flex \
55  libmnl-dev \
56  libnetfilter-conntrack-dev \
57  libnfnetlink-dev \
58  libnftnl-dev \
59  libtool
60
61# We are done with apt; reclaim the disk space
62apt-get clean
63
64# Construct the iptables source package to build
65iptables=iptables-1.8.4
66mkdir -p /usr/src/$iptables
67
68cd /usr/src/$iptables
69# Download a specific revision of iptables from AOSP
70wget -qO - \
71  https://android.googlesource.com/platform/external/iptables/+archive/master.tar.gz | \
72  tar -zxf -
73# Download a compatible 'debian' overlay from Debian salsa
74# We don't want all of the sources, just the Debian modifications
75# NOTE: This will only work if Android always uses a version of iptables that exists
76#       for Debian as well.
77debian_iptables=1.8.4-3
78debian_iptables_dir=pkg-iptables-debian-$debian_iptables
79wget -qO - \
80  https://salsa.debian.org/pkg-netfilter-team/pkg-iptables/-/archive/debian/$debian_iptables/$debian_iptables_dir.tar.gz | \
81  tar --strip-components 1 -zxf - \
82  $debian_iptables_dir/debian
83cd -
84
85cd /usr/src
86# Generate a source package to leave in the filesystem. This is done for license
87# compliance and build reproducibility.
88tar --exclude=debian -cf - $iptables | \
89  xz -9 >`echo $iptables | tr -s '-' '_'`.orig.tar.xz
90cd -
91
92cd /usr/src/$iptables
93# Build debian packages from the integrated iptables source
94dpkg-buildpackage -F -us -uc
95cd -
96
97# Record the list of packages we have installed now
98LANG=C dpkg --get-selections | sort >installed
99
100# Compute the difference, and remove anything installed between the snapshots
101dpkg -P `comm -3 originally-installed installed | sed -e 's,install,,' -e 's,\t,,' | xargs`
102
103cd /usr/src
104# Find any packages generated, resolve to the debian package name, then
105# exclude any compat, header or symbol packages
106packages=`find -maxdepth 1 -name '*.deb' | colrm 1 2 | cut -d'_' -f1 |
107          grep -ve '-compat$\|-dbg$\|-dbgsym$\|-dev$' | xargs`
108# Install the patched iptables packages, and 'hold' then so
109# "apt-get dist-upgrade" doesn't replace them
110dpkg -i `
111for package in $packages; do
112  echo ${package}_*.deb
113done | xargs`
114for package in $packages; do
115  echo "$package hold" | dpkg --set-selections
116done
117# Tidy up the mess we left behind, leaving just the source tarballs
118rm -rf $iptables *.buildinfo *.changes *.deb *.dsc
119cd -
120
121# Ensure a getty is spawned on ttyS0, if booting the image manually
122ln -s /lib/systemd/system/serial-getty\@.service \
123  /etc/systemd/system/getty.target.wants/serial-getty\@ttyS0.service
124
125# systemd needs some directories to be created
126mkdir -p /var/lib/systemd/coredump /var/lib/systemd/rfkill \
127  /var/lib/systemd/timesync
128
129# Finalize and tidy up the created image
130chroot_cleanup
131