[ptxdist] [PATCH] Add persistant iptable-rules via systemd

[Gavin Schenk <g.schenk@eckelmann.de>]

Supports ipv4 and ipv6 and both options can be selected in menuconfig IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT

If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from file /etc/iptables/rules.v4.
If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from the file /etc/iptables/rules.v6.
You have to provide this files. Both files can easily be generated with the utils iptables-save ip6tables-save from the iptables package.

e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4
1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP
2.) iptables-save > /etc/iptables/rules.v4

The basic idea was taken from https://github.com/gronke/systemd-iptables written by Stefan Grönke in 2015.
---
 .../0001-Added-files-for-systemd-support.patch     | 115 +++++++++++++++++++++
 patches/iptables-1.4.21/series                     |   4 +
 rules/iptables.in                                  |  10 ++
 rules/iptables.make                                |  17 +++
 4 files changed, 146 insertions(+)
 create mode 100644 patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
 create mode 100644 patches/iptables-1.4.21/series

diff --git a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
new file mode 100644
index 0000000..e98a788
--- /dev/null
+++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
@@ -0,0 +1,115 @@
+From: Gavin Schenk <g.schenk@eckelmann.de>
+Date: Wed, 6 Apr 2016 10:19:52 +0200
+Subject: [PATCH] Added files for systemd support
+
+---
+ etc/iptables/rules.v4            |  0
+ etc/iptables/rules.v6            |  0
+ scripts/ip6tables-flush          | 19 +++++++++++++++++++
+ scripts/iptables-flush           | 19 +++++++++++++++++++
+ systemd/system/ip6tables.service | 14 ++++++++++++++
+ systemd/system/iptables.service  | 14 ++++++++++++++
+ 6 files changed, 66 insertions(+)
+ create mode 100644 etc/iptables/rules.v4
+ create mode 100644 etc/iptables/rules.v6
+ create mode 100755 scripts/ip6tables-flush
+ create mode 100755 scripts/iptables-flush
+ create mode 100755 systemd/system/ip6tables.service
+ create mode 100755 systemd/system/iptables.service
+
+diff --git a/etc/iptables/rules.v4 b/etc/iptables/rules.v4
+new file mode 100644
+index 000000000000..e69de29bb2d1
+diff --git a/etc/iptables/rules.v6 b/etc/iptables/rules.v6
+new file mode 100644
+index 000000000000..e69de29bb2d1
+diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush
+new file mode 100755
+index 000000000000..cf6d22bb2923
+--- /dev/null
++++ b/scripts/ip6tables-flush
+@@ -0,0 +1,19 @@
++#!/bin/sh
++
++if ! ip6tables --list >/dev/null 2>&1; then
++        echo "ipv6 filtering is not supported by the running kernel."
++        exit 3
++fi
++
++ip6tables -F
++ip6tables -X
++ip6tables -Z
++for table in $(</proc/net/ip6_tables_names)
++do
++        ip6tables -t $table -F
++        ip6tables -t $table -X
++        ip6tables -t $table -Z
++done
++ip6tables -P INPUT ACCEPT
++ip6tables -P OUTPUT ACCEPT
++ip6tables -P FORWARD ACCEPT
+diff --git a/scripts/iptables-flush b/scripts/iptables-flush
+new file mode 100755
+index 000000000000..a6e056f31a75
+--- /dev/null
++++ b/scripts/iptables-flush
+@@ -0,0 +1,19 @@
++#!/bin/sh
++
++if ! iptables --list >/dev/null 2>&1; then
++	echo "ipv4 filtering is not supported by the running kernel." 	
++	exit 3
++fi 
++
++iptables -F
++iptables -X
++iptables -Z
++for table in $(</proc/net/ip_tables_names)
++do
++        iptables -t $table -F
++        iptables -t $table -X
++        iptables -t $table -Z
++done
++iptables -P INPUT ACCEPT
++iptables -P FORWARD ACCEPT
++iptables -P OUTPUT ACCEPT
+diff --git a/systemd/system/ip6tables.service b/systemd/system/ip6tables.service
+new file mode 100755
+index 000000000000..e842cc1973a1
+--- /dev/null
++++ b/systemd/system/ip6tables.service
+@@ -0,0 +1,14 @@
++[Unit]
++Description=Packet Filtering Framework
++DefaultDependencies=no
++After=systemd-sysctl.service
++Before=sysinit.target
++ConditionFileNotEmpty=/etc/iptables/rules.v6
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
++ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
++ExecStop=/usr/sbin/iptables/ip6tables-flush
++RemainAfterExit=yes
++[Install]
++WantedBy=multi-user.target
+diff --git a/systemd/system/iptables.service b/systemd/system/iptables.service
+new file mode 100755
+index 000000000000..fa4a8b367ca0
+--- /dev/null
++++ b/systemd/system/iptables.service
+@@ -0,0 +1,14 @@
++[Unit]
++Description=Packet Filtering Framework
++DefaultDependencies=no
++After=systemd-sysctl.service
++Before=sysinit.target
++ConditionFileNotEmpty=/etc/iptables/rules.v4
++[Service]
++Type=oneshot
++ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4
++ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4
++ExecStop=/usr/sbin/iptables-flush
++RemainAfterExit=yes
++[Install]
++WantedBy=multi-user.target
diff --git a/patches/iptables-1.4.21/series b/patches/iptables-1.4.21/series
new file mode 100644
index 0000000..b8f388f
--- /dev/null
+++ b/patches/iptables-1.4.21/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-Added-files-for-systemd-support.patch
+# 366b7fd90bb4fe7e229f0ba777703fb5  - git-ptx-patches magic
diff --git a/rules/iptables.in b/rules/iptables.in
index e6f3699..8354060 100644
--- a/rules/iptables.in
+++ b/rules/iptables.in
@@ -25,6 +25,16 @@ config IPTABLES_IPV4
 	bool
 	prompt "IPv4 support"
 
+config IPTABLES_IPV6_SYSTEMD_UNIT
+	bool
+	prompt "Activate IPv6 systemd service unit"
+	select IPTABLES_IPV6
+
+config IPTABLES_IPV4_SYSTEMD_UNIT
+	bool
+	prompt "Activate IPv4 systemd service unit"
+	select IPTABLES_IPV4
+
 config IPTABLES_LIBIPQ
 	bool
 	prompt "Enable libipq"
diff --git a/rules/iptables.make b/rules/iptables.make
index 8a1ea66..12d3867 100644
--- a/rules/iptables.make
+++ b/rules/iptables.make
@@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4
 	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore)
 	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save)
 endif
+
+ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT
+# 	# IPv6 systemd service unit part
+	@$(call install_copy, iptables, 0, 0, 0755,  $(IPTABLES_DIR)/scripts/ip6tables-flush, /usr/sbin/ip6tables-flush)
+	@$(call install_copy, iptables, 0, 0, 0644,  $(IPTABLES_DIR)/systemd/system/ip6tables.service, /lib/systemd/system/ip6tables.service)
+	@$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service)
+	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6)
+endif
+
+ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT
+# 	# IPv4 systemd service unit part
+	@$(call install_copy, iptables, 0, 0, 0755,  $(IPTABLES_DIR)/scripts/iptables-flush, /usr/sbin/iptables-flush)
+	@$(call install_copy, iptables, 0, 0, 0644,  $(IPTABLES_DIR)/systemd/system/iptables.service, /lib/systemd/system/iptables.service)
+	@$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service)
+	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4)
+endif
+
 endif
 
 ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY
-- 
1.9.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de