Re: [ptxdist] [PATCH] Add persistant iptable-rules via systemd

["Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>]

Hello,

On Thu, Apr 07, 2016 at 09:14:01AM +0000, Schenk, Gavin wrote:
> > > +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush new
> > > +file mode 100755 index 000000000000..95086b0470d3
> > > +--- /dev/null
> > > ++++ b/scripts/ip6tables-flush
> > > +@@ -0,0 +1,13 @@
> > > ++#!/bin/sh
> > > ++ip6tables -F
> > > ++ip6tables -X
> > > ++ip6tables -Z
> > > ++for table in $(</proc/net/ip6_tables_names)
> > 
> > What happens if there is no ipv6 iptables support in the kernel? Maybe catch
> > that with an error message?
> > 
> 
> This is what happens on both ipv4 and ipv6:
> iptables-flush 
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> /usr/sbin/iptables-flush: line 5: /proc/net/ip_tables_names: No such file or directory
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> modprobe: module ip_tables not found in modules.dep
> iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
> Perhaps iptables or your kernel needs to be upgraded.
> 
> 
> What is a good way to detect if the kernel supports iptables? 
> Instead of digging into /proc my idea is to add something like:
> 
> iptables --list &> /dev/null
> IPTABLES_SUPPORT=$?

Assuming this does the trick, this has the added benefit that module
loading is tried.

> 
> If [ $IPTABLES_SUPPORT -gt 0 ]; then
> 	echo "iptables is not supported by your kernel"
> 	exit $IPTABLES_SUPPORT
> fi

I'd use:

	if ! iptables --list >/dev/null 2>&1; then

(note that &> is a bashism and for example doesn't work with dash).

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de