Re: [Buildroot] [PATCH v3] package/iptables: add init script

[Arnout Vandecappelle <arnout@mind.be>]

On 15/09/2021 15:06, José Pekkarinen wrote:
> This patch will add an init script that allows
> to set a ruleset in /etc/iptables.conf to be loaded
> on boot, or flushed on stop, as well as a saving
> command to generate a new file.
> 
> Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
> ---
> [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/
> [v2 -> v3] Execute before networking script, handle ro rootfs
> 
>   package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++
>   package/iptables/iptables.mk |  6 ++++
>   2 files changed, 68 insertions(+)
>   create mode 100644 package/iptables/S35iptables
> 
> diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables
> new file mode 100644
> index 0000000000..6023297236
> --- /dev/null
> +++ b/package/iptables/S35iptables
> @@ -0,0 +1,62 @@
> +#!/bin/sh
> +
> +DAEMON="iptables"
> +
> +IPTABLES_ARGS=""
> +
> +start() {
> +	printf 'Starting %s: ' "$DAEMON"
> +	iptables-restore < /etc/iptables.conf
> +	status=$?
> +	if [ "$status" -eq 0 ]; then
> +		echo "OK"
> +	else
> +		echo "FAIL"
> +	fi
> +	return "$status"
> +}
> +
> +stop() {
> +	printf 'Stopping %s: ' "$DAEMON"
> +	iptables -F
> +	status=$?
> +	if [ "$status" -eq 0 ]; then
> +		echo "OK"
> +	else
> +		echo "FAIL"
> +	fi
> +	return "$status"
> +}
> +
> +restart() {
> +	stop
> +	sleep 1
> +	start
> +}
> +
> +save() {
> +	printf 'Saving %s: ' "$DAEMON"
> +	if iptables-save > /etc/iptables.conf; then
> +		status=$?
> +		if [ "$status" -eq 0 ]; then

  This makes no sense - if you enter the if branch, then status is by definition 
0...

  Since it's not terribly important IMHO (I don't think the complexity of the 
S20urandom stuff is really warranted, since 'save' is just a manual operation), 
I fixed it up so it just prints OK in the if branch and SKIP in the else branch.

  Baruch, any objections?


  BTW, I have no problem with this in the default installation, because by 
default it doesn't do anything (iptables.conf is an empty file). Personally I'd 
have implemented it by testing if it exists in the init script, but that's 
really bikeshedding.

  Thus, applied to master, thanks.

  Regards,
  Arnout

> +			echo "OK"
> +		else
> +			echo "FAIL"
> +		fi
> +	else
> +		status=$?
> +		echo "SKIP (read-only file system detected)"
> +	fi
> +	return "$status"
> +}
> +
> +case "$1" in
> +	start|stop|restart|save)
> +		"$1";;
> +	reload)
> +		# Restart, since there is no true "reload" feature.
> +		restart;;
> +	*)
> +		echo "Usage: $0 {start|stop|restart|reload}"
> +		exit 1
> +esac
> diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk
> index dc01466607..f0ddca8f9a 100644
> --- a/package/iptables/iptables.mk
> +++ b/package/iptables/iptables.mk
> @@ -57,4 +57,10 @@ define IPTABLES_LINUX_CONFIG_FIXUPS
>   	$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES)
>   endef
>   
> +define IPTABLES_INSTALL_INIT_SYSV
> +	$(INSTALL) -m 0755 -D package/iptables/S35iptables \
> +		$(TARGET_DIR)/etc/init.d/S35iptables
> +	touch $(TARGET_DIR)/etc/iptables.conf
> +endef
> +
>   $(eval $(autotools-package))
> 
_______________________________________________
buildroot mailing list
buildroot@lists.buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot