Re: [ptxdist] [PATCH] Add persistant iptable-rules via systemd

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Fri, Apr 08, 2016 at 03:04:10PM +0200, Gavin Schenk wrote:
> Supports ipv4 and ipv6 and both options can be selected in menuconfig
> by IPTABLES_IPV6_SYSTEMD_UNIT and/or IPTABLES_IPV4_SYSTEMD_UNIT
> 
> If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on
> multiuser.target that set the iptable rules from file:
> /etc/iptables/rules.v4
> 
> If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on
> multiuser.target that set the iptable rules from the file:
> /etc/iptables/rules.v6
> 
> The Package provides empty files. If you want to add custom rules, you
> have to provide your own files. The rule files can be generated with
> the utils iptables-save ip6tables-save from the iptables package.
> 
> Example:
> Generating a rule file, that drops port 5000 on interface eth0 for ipv4
> 
> 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP
> 2.) iptables-save > /etc/iptables/rules.v4
> 
> The basic idea was taken from https://github.com/gronke/systemd-iptables
> written by Stefan Grönke <stefan@gronke.net> in 2015.
> 
> Signed-off-by: Gavin Schenk <g.schenk@eckelmann.de>
> ---
>  projectroot/etc/iptables/rules.v4                |  0
>  projectroot/etc/iptables/rules.v6                |  0
>  projectroot/lib/systemd/system/ip6tables.service | 14 ++++++++++++++
>  projectroot/lib/systemd/system/iptables.service  | 14 ++++++++++++++
>  projectroot/usr/sbin/ip6tables-flush             | 19 +++++++++++++++++++
>  projectroot/usr/sbin/iptables-flush              | 19 +++++++++++++++++++
>  rules/iptables.in                                | 10 ++++++++++
>  rules/iptables.make                              | 17 +++++++++++++++++
>  8 files changed, 93 insertions(+)
>  create mode 100644 projectroot/etc/iptables/rules.v4
>  create mode 100644 projectroot/etc/iptables/rules.v6
>  create mode 100644 projectroot/lib/systemd/system/ip6tables.service
>  create mode 100644 projectroot/lib/systemd/system/iptables.service
>  create mode 100755 projectroot/usr/sbin/ip6tables-flush
>  create mode 100755 projectroot/usr/sbin/iptables-flush
> 
> diff --git a/projectroot/etc/iptables/rules.v4 b/projectroot/etc/iptables/rules.v4
> new file mode 100644
> index 0000000..e69de29
> diff --git a/projectroot/etc/iptables/rules.v6 b/projectroot/etc/iptables/rules.v6
> new file mode 100644
> index 0000000..e69de29
> diff --git a/projectroot/lib/systemd/system/ip6tables.service b/projectroot/lib/systemd/system/ip6tables.service
> new file mode 100644
> index 0000000..e842cc1
> --- /dev/null
> +++ b/projectroot/lib/systemd/system/ip6tables.service
> @@ -0,0 +1,14 @@
> +[Unit]
> +Description=Packet Filtering Framework
> +DefaultDependencies=no
> +After=systemd-sysctl.service
> +Before=sysinit.target
> +ConditionFileNotEmpty=/etc/iptables/rules.v6
> +[Service]
> +Type=oneshot
> +ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
> +ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
> +ExecStop=/usr/sbin/iptables/ip6tables-flush
> +RemainAfterExit=yes
> +[Install]
> +WantedBy=multi-user.target
> diff --git a/projectroot/lib/systemd/system/iptables.service b/projectroot/lib/systemd/system/iptables.service
> new file mode 100644
> index 0000000..fa4a8b3
> --- /dev/null
> +++ b/projectroot/lib/systemd/system/iptables.service
> @@ -0,0 +1,14 @@
> +[Unit]
> +Description=Packet Filtering Framework
> +DefaultDependencies=no
> +After=systemd-sysctl.service
> +Before=sysinit.target
> +ConditionFileNotEmpty=/etc/iptables/rules.v4
> +[Service]
> +Type=oneshot
> +ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4
> +ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4
> +ExecStop=/usr/sbin/iptables-flush
> +RemainAfterExit=yes
> +[Install]
> +WantedBy=multi-user.target
> diff --git a/projectroot/usr/sbin/ip6tables-flush b/projectroot/usr/sbin/ip6tables-flush
> new file mode 100755
> index 0000000..cf6d22b
> --- /dev/null
> +++ b/projectroot/usr/sbin/ip6tables-flush
> @@ -0,0 +1,19 @@
> +#!/bin/sh
> +
> +if ! ip6tables --list >/dev/null 2>&1; then
> +        echo "ipv6 filtering is not supported by the running kernel."
> +        exit 3
> +fi
> +
> +ip6tables -F
> +ip6tables -X
> +ip6tables -Z
> +for table in $(</proc/net/ip6_tables_names)

This does not work with a busybox /bin/sh. I think that's bashism.

This should work:

for table in $(cat /proc/net/ip6_tables_names); do
...

Note: It doesn't fail! The list is always empty!

> +do
> +        ip6tables -t $table -F
> +        ip6tables -t $table -X
> +        ip6tables -t $table -Z
> +done
> +ip6tables -P INPUT ACCEPT
> +ip6tables -P OUTPUT ACCEPT
> +ip6tables -P FORWARD ACCEPT
> diff --git a/projectroot/usr/sbin/iptables-flush b/projectroot/usr/sbin/iptables-flush
> new file mode 100755
> index 0000000..a6e056f
> --- /dev/null
> +++ b/projectroot/usr/sbin/iptables-flush
> @@ -0,0 +1,19 @@
> +#!/bin/sh
> +
> +if ! iptables --list >/dev/null 2>&1; then
> +	echo "ipv4 filtering is not supported by the running kernel." 	
> +	exit 3
> +fi 
> +
> +iptables -F
> +iptables -X
> +iptables -Z
> +for table in $(</proc/net/ip_tables_names)

Same here.

> +do
> +        iptables -t $table -F
> +        iptables -t $table -X
> +        iptables -t $table -Z
> +done
> +iptables -P INPUT ACCEPT
> +iptables -P FORWARD ACCEPT
> +iptables -P OUTPUT ACCEPT
> diff --git a/rules/iptables.in b/rules/iptables.in
> index e6f3699..8354060 100644
> --- a/rules/iptables.in
> +++ b/rules/iptables.in
> @@ -25,6 +25,16 @@ config IPTABLES_IPV4
>  	bool
>  	prompt "IPv4 support"
>  
> +config IPTABLES_IPV6_SYSTEMD_UNIT
> +	bool
> +	prompt "Activate IPv6 systemd service unit"
> +	select IPTABLES_IPV6
> +
> +config IPTABLES_IPV4_SYSTEMD_UNIT
> +	bool
> +	prompt "Activate IPv4 systemd service unit"
> +	select IPTABLES_IPV4
> +
>  config IPTABLES_LIBIPQ
>  	bool
>  	prompt "Enable libipq"
> diff --git a/rules/iptables.make b/rules/iptables.make
> index 8a1ea66..3dff774 100644
> --- a/rules/iptables.make
> +++ b/rules/iptables.make
> @@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4
>  	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore)
>  	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save)
>  endif
> +
> +ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT
> +# 	# IPv6 systemd service unit part
> +	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6)
> +	@$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/ip6tables-flush)
> +	@$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/ip6tables.service)
> +	@$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service)

	@$(call install_link, iptables, ../ip6tables.service,  \
		/lib/systemd/system/multi-user.target.wants/ip6tables.service)

Break like this.

> +endif
> +
> +ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT
> +# 	# IPv4 systemd service unit part
> +	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4)
> +	@$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/iptables-flush)
> +	@$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/iptables.service)
> +	@$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service)

Same here.

Michael

> +endif
> +
>  endif
>  
>  ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY
> -- 
> 1.9.1
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de