* [Buildroot] [PATCH v3] package/iptables: add init script @ 2021-09-15 13:06 José Pekkarinen 2021-09-22 21:33 ` Arnout Vandecappelle 2021-10-05 13:41 ` Peter Korsgaard 0 siblings, 2 replies; 6+ messages in thread From: José Pekkarinen @ 2021-09-15 13:06 UTC (permalink / raw) To: buildroot; +Cc: José Pekkarinen This patch will add an init script that allows to set a ruleset in /etc/iptables.conf to be loaded on boot, or flushed on stop, as well as a saving command to generate a new file. Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com> --- [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/ [v2 -> v3] Execute before networking script, handle ro rootfs package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++ package/iptables/iptables.mk | 6 ++++ 2 files changed, 68 insertions(+) create mode 100644 package/iptables/S35iptables diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables new file mode 100644 index 0000000000..6023297236 --- /dev/null +++ b/package/iptables/S35iptables @@ -0,0 +1,62 @@ +#!/bin/sh + +DAEMON="iptables" + +IPTABLES_ARGS="" + +start() { + printf 'Starting %s: ' "$DAEMON" + iptables-restore < /etc/iptables.conf + status=$? + if [ "$status" -eq 0 ]; then + echo "OK" + else + echo "FAIL" + fi + return "$status" +} + +stop() { + printf 'Stopping %s: ' "$DAEMON" + iptables -F + status=$? + if [ "$status" -eq 0 ]; then + echo "OK" + else + echo "FAIL" + fi + return "$status" +} + +restart() { + stop + sleep 1 + start +} + +save() { + printf 'Saving %s: ' "$DAEMON" + if iptables-save > /etc/iptables.conf; then + status=$? + if [ "$status" -eq 0 ]; then + echo "OK" + else + echo "FAIL" + fi + else + status=$? + echo "SKIP (read-only file system detected)" + fi + return "$status" +} + +case "$1" in + start|stop|restart|save) + "$1";; + reload) + # Restart, since there is no true "reload" feature. + restart;; + *) + echo "Usage: $0 {start|stop|restart|reload}" + exit 1 +esac diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk index dc01466607..f0ddca8f9a 100644 --- a/package/iptables/iptables.mk +++ b/package/iptables/iptables.mk @@ -57,4 +57,10 @@ define IPTABLES_LINUX_CONFIG_FIXUPS $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES) endef +define IPTABLES_INSTALL_INIT_SYSV + $(INSTALL) -m 0755 -D package/iptables/S35iptables \ + $(TARGET_DIR)/etc/init.d/S35iptables + touch $(TARGET_DIR)/etc/iptables.conf +endef + $(eval $(autotools-package)) -- 2.25.1 _______________________________________________ buildroot mailing list buildroot@lists.buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH v3] package/iptables: add init script 2021-09-15 13:06 [Buildroot] [PATCH v3] package/iptables: add init script José Pekkarinen @ 2021-09-22 21:33 ` Arnout Vandecappelle 2021-10-05 13:41 ` Peter Korsgaard 1 sibling, 0 replies; 6+ messages in thread From: Arnout Vandecappelle @ 2021-09-22 21:33 UTC (permalink / raw) To: José Pekkarinen, buildroot, Baruch Siach On 15/09/2021 15:06, José Pekkarinen wrote: > This patch will add an init script that allows > to set a ruleset in /etc/iptables.conf to be loaded > on boot, or flushed on stop, as well as a saving > command to generate a new file. > > Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com> > --- > [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/ > [v2 -> v3] Execute before networking script, handle ro rootfs > > package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++ > package/iptables/iptables.mk | 6 ++++ > 2 files changed, 68 insertions(+) > create mode 100644 package/iptables/S35iptables > > diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables > new file mode 100644 > index 0000000000..6023297236 > --- /dev/null > +++ b/package/iptables/S35iptables > @@ -0,0 +1,62 @@ > +#!/bin/sh > + > +DAEMON="iptables" > + > +IPTABLES_ARGS="" > + > +start() { > + printf 'Starting %s: ' "$DAEMON" > + iptables-restore < /etc/iptables.conf > + status=$? > + if [ "$status" -eq 0 ]; then > + echo "OK" > + else > + echo "FAIL" > + fi > + return "$status" > +} > + > +stop() { > + printf 'Stopping %s: ' "$DAEMON" > + iptables -F > + status=$? > + if [ "$status" -eq 0 ]; then > + echo "OK" > + else > + echo "FAIL" > + fi > + return "$status" > +} > + > +restart() { > + stop > + sleep 1 > + start > +} > + > +save() { > + printf 'Saving %s: ' "$DAEMON" > + if iptables-save > /etc/iptables.conf; then > + status=$? > + if [ "$status" -eq 0 ]; then This makes no sense - if you enter the if branch, then status is by definition 0... Since it's not terribly important IMHO (I don't think the complexity of the S20urandom stuff is really warranted, since 'save' is just a manual operation), I fixed it up so it just prints OK in the if branch and SKIP in the else branch. Baruch, any objections? BTW, I have no problem with this in the default installation, because by default it doesn't do anything (iptables.conf is an empty file). Personally I'd have implemented it by testing if it exists in the init script, but that's really bikeshedding. Thus, applied to master, thanks. Regards, Arnout > + echo "OK" > + else > + echo "FAIL" > + fi > + else > + status=$? > + echo "SKIP (read-only file system detected)" > + fi > + return "$status" > +} > + > +case "$1" in > + start|stop|restart|save) > + "$1";; > + reload) > + # Restart, since there is no true "reload" feature. > + restart;; > + *) > + echo "Usage: $0 {start|stop|restart|reload}" > + exit 1 > +esac > diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk > index dc01466607..f0ddca8f9a 100644 > --- a/package/iptables/iptables.mk > +++ b/package/iptables/iptables.mk > @@ -57,4 +57,10 @@ define IPTABLES_LINUX_CONFIG_FIXUPS > $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES) > endef > > +define IPTABLES_INSTALL_INIT_SYSV > + $(INSTALL) -m 0755 -D package/iptables/S35iptables \ > + $(TARGET_DIR)/etc/init.d/S35iptables > + touch $(TARGET_DIR)/etc/iptables.conf > +endef > + > $(eval $(autotools-package)) > _______________________________________________ buildroot mailing list buildroot@lists.buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH v3] package/iptables: add init script 2021-09-15 13:06 [Buildroot] [PATCH v3] package/iptables: add init script José Pekkarinen 2021-09-22 21:33 ` Arnout Vandecappelle @ 2021-10-05 13:41 ` Peter Korsgaard 2021-10-05 16:28 ` José Pekkarinen 1 sibling, 1 reply; 6+ messages in thread From: Peter Korsgaard @ 2021-10-05 13:41 UTC (permalink / raw) To: José Pekkarinen; +Cc: buildroot >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes: > This patch will add an init script that allows > to set a ruleset in /etc/iptables.conf to be loaded > on boot, or flushed on stop, as well as a saving > command to generate a new file. > Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com> > --- > [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/ > [v2 -> v3] Execute before networking script, handle ro rootfs > package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++ > package/iptables/iptables.mk | 6 ++++ > 2 files changed, 68 insertions(+) > create mode 100644 package/iptables/S35iptables > diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables > new file mode 100644 > index 0000000000..6023297236 > --- /dev/null > +++ b/package/iptables/S35iptables > @@ -0,0 +1,62 @@ > +#!/bin/sh > + > +DAEMON="iptables" > + > +IPTABLES_ARGS="" > + > +start() { > + printf 'Starting %s: ' "$DAEMON" > + iptables-restore < /etc/iptables.conf Any special reason for the redirect? iptables-save / restor accepts a filename argument. > +case "$1" in > + start|stop|restart|save) > + "$1";; > + reload) > + # Restart, since there is no true "reload" feature. > + restart;; > + *) > + echo "Usage: $0 {start|stop|restart|reload}" NIT: This doesn't document the save argument. -- Bye, Peter Korsgaard _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH v3] package/iptables: add init script 2021-10-05 13:41 ` Peter Korsgaard @ 2021-10-05 16:28 ` José Pekkarinen 2021-10-05 16:54 ` Peter Korsgaard 0 siblings, 1 reply; 6+ messages in thread From: José Pekkarinen @ 2021-10-05 16:28 UTC (permalink / raw) To: Peter Korsgaard; +Cc: buildroot [-- Attachment #1.1: Type: text/plain, Size: 1853 bytes --] On Tue, Oct 5, 2021 at 4:41 PM Peter Korsgaard <peter@korsgaard.com> wrote: > >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes: > > > This patch will add an init script that allows > > to set a ruleset in /etc/iptables.conf to be loaded > > on boot, or flushed on stop, as well as a saving > > command to generate a new file. > > > Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com> > > --- > > [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/ > > [v2 -> v3] Execute before networking script, handle ro rootfs > > > package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++ > > package/iptables/iptables.mk | 6 ++++ > > 2 files changed, 68 insertions(+) > > create mode 100644 package/iptables/S35iptables > > > diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables > > new file mode 100644 > > index 0000000000..6023297236 > > --- /dev/null > > +++ b/package/iptables/S35iptables > > @@ -0,0 +1,62 @@ > > +#!/bin/sh > > + > > +DAEMON="iptables" > > + > > +IPTABLES_ARGS="" > > + > > +start() { > > + printf 'Starting %s: ' "$DAEMON" > > + iptables-restore < /etc/iptables.conf > > Any special reason for the redirect? iptables-save / restor accepts a > filename argument. > Not from my side, I just didn't notice. I can change it for you if you want. > > +case "$1" in > > + start|stop|restart|save) > > + "$1";; > > + reload) > > + # Restart, since there is no true "reload" feature. > > + restart;; > > + *) > > + echo "Usage: $0 {start|stop|restart|reload}" > > NIT: This doesn't document the save argument. > Very true, please let me know and I'm happy to send a v3 tomorrow with those stuff. Thanks! José. [-- Attachment #1.2: Type: text/html, Size: 3560 bytes --] [-- Attachment #2: Type: text/plain, Size: 150 bytes --] _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH v3] package/iptables: add init script 2021-10-05 16:28 ` José Pekkarinen @ 2021-10-05 16:54 ` Peter Korsgaard 2021-10-06 6:23 ` José Pekkarinen 0 siblings, 1 reply; 6+ messages in thread From: Peter Korsgaard @ 2021-10-05 16:54 UTC (permalink / raw) To: José Pekkarinen; +Cc: buildroot >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes: Hi, >> Any special reason for the redirect? iptables-save / restor accepts a >> filename argument. >> > Not from my side, I just didn't notice. I can > change it for you if you want. Yes, please. >> > + echo "Usage: $0 {start|stop|restart|reload}" >> >> NIT: This doesn't document the save argument. >> > Very true, please let me know and I'm happy to send a v3 > tomorrow with those stuff. Ehh, this was already v3 and it was applied, so you will need to send a followup patch changing the script instead. Thanks. -- Bye, Peter Korsgaard _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH v3] package/iptables: add init script 2021-10-05 16:54 ` Peter Korsgaard @ 2021-10-06 6:23 ` José Pekkarinen 0 siblings, 0 replies; 6+ messages in thread From: José Pekkarinen @ 2021-10-06 6:23 UTC (permalink / raw) To: Peter Korsgaard; +Cc: buildroot [-- Attachment #1.1: Type: text/plain, Size: 794 bytes --] On Tue, Oct 5, 2021 at 7:54 PM Peter Korsgaard <peter@korsgaard.com> wrote: > >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes: > > Hi, > > >> Any special reason for the redirect? iptables-save / restor accepts a > >> filename argument. > >> > > > Not from my side, I just didn't notice. I can > > > change it for you if you want. > > Yes, please. > > > >> > + echo "Usage: $0 {start|stop|restart|reload}" > >> > >> NIT: This doesn't document the save argument. > >> > > > Very true, please let me know and I'm happy to send a v3 > > > tomorrow with those stuff. > > Ehh, this was already v3 and it was applied, so you will need to send a > followup patch changing the script instead. > Just sent, thanks! José. [-- Attachment #1.2: Type: text/html, Size: 1624 bytes --] [-- Attachment #2: Type: text/plain, Size: 150 bytes --] _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-10-06 6:23 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-09-15 13:06 [Buildroot] [PATCH v3] package/iptables: add init script José Pekkarinen 2021-09-22 21:33 ` Arnout Vandecappelle 2021-10-05 13:41 ` Peter Korsgaard 2021-10-05 16:28 ` José Pekkarinen 2021-10-05 16:54 ` Peter Korsgaard 2021-10-06 6:23 ` José Pekkarinen
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.