[ptxdist] [PATCH] nftables: add option for installing systemd unit

[ptxdist] [PATCH] nftables: add option for installing systemd unit

[Baeuerle, Florian]

Allow installing a systemd unit for loading the nftables configuration
file. The systemd unit is taken from Arch Linux.

Signed-off-by: Florian Bäuerle <florian.baeuerle@allegion.com>
---
 .../usr/lib/systemd/system/nftables.service       | 15 +++++++++++++++
 rules/nftables.in                                 |  6 ++++++
 rules/nftables.make                               |  6 ++++++
 3 files changed, 27 insertions(+)
 create mode 100644 projectroot/usr/lib/systemd/system/nftables.service

diff --git a/projectroot/usr/lib/systemd/system/nftables.service b/projectroot/usr/lib/systemd/system/nftables.service
new file mode 100644
index 000000000..16f390d6a
--- /dev/null
+++ b/projectroot/usr/lib/systemd/system/nftables.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/nft -f /etc/nftables.conf
+ExecReload=/usr/sbin/nft flush ruleset ';' include '"/etc/nftables.conf"'
+ExecStop=/usr/sbin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/rules/nftables.in b/rules/nftables.in
index aafd7cdd6..089f68d2e 100644
--- a/rules/nftables.in
+++ b/rules/nftables.in
@@ -36,4 +36,10 @@ config NFTABLES_STARTSCRIPT
 	bool
 	prompt "install /etc/init.d/nftables"
 
+config NFTABLES_SYSTEMD_UNIT
+	bool
+	default y
+	depends on INITMETHOD_SYSTEMD
+	prompt "install systemd unit file for nftables"
+
 endif
diff --git a/rules/nftables.make b/rules/nftables.make
index 4a95694ad..15368f965 100644
--- a/rules/nftables.make
+++ b/rules/nftables.make
@@ -69,6 +69,12 @@ endif
 endif
 endif
 
+ifdef PTXCONF_NFTABLES_SYSTEMD_UNIT
+	@$(call install_alternative, nftables, 0, 0, 0644, /usr/lib/systemd/system/nftables.service)
+	@$(call install_link, nftables, ../nftables.service, \
+		/usr/lib/systemd/system/multi-user.target.wants/nftables.service)
+endif
+
 	@$(call install_finish, nftables)
 
 	@$(call touch)
-- 
2.21.0

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] nftables: add option for installing systemd unit

[Alexander Dahl]

[-- Attachment #1.1: Type: text/plain, Size: 2752 bytes --]

Hei hei,

On Wed, Apr 03, 2019 at 02:12:04PM +0000, Baeuerle, Florian wrote:
> Allow installing a systemd unit for loading the nftables configuration
> file. The systemd unit is taken from Arch Linux.
> 
> Signed-off-by: Florian Bäuerle <florian.baeuerle@allegion.com>

Looks good, not tested however.

Acked-by: Alexander Dahl <post@lespocky.de>

> ---
>  .../usr/lib/systemd/system/nftables.service       | 15 +++++++++++++++
>  rules/nftables.in                                 |  6 ++++++
>  rules/nftables.make                               |  6 ++++++
>  3 files changed, 27 insertions(+)
>  create mode 100644 projectroot/usr/lib/systemd/system/nftables.service
> 
> diff --git a/projectroot/usr/lib/systemd/system/nftables.service b/projectroot/usr/lib/systemd/system/nftables.service
> new file mode 100644
> index 000000000..16f390d6a
> --- /dev/null
> +++ b/projectroot/usr/lib/systemd/system/nftables.service
> @@ -0,0 +1,15 @@
> +[Unit]
> +Description=Netfilter Tables
> +Documentation=man:nft(8)
> +Wants=network-pre.target
> +Before=network-pre.target
> +
> +[Service]
> +Type=oneshot
> +ExecStart=/usr/sbin/nft -f /etc/nftables.conf
> +ExecReload=/usr/sbin/nft flush ruleset ';' include '"/etc/nftables.conf"'
> +ExecStop=/usr/sbin/nft flush ruleset
> +RemainAfterExit=yes
> +
> +[Install]
> +WantedBy=multi-user.target
> diff --git a/rules/nftables.in b/rules/nftables.in
> index aafd7cdd6..089f68d2e 100644
> --- a/rules/nftables.in
> +++ b/rules/nftables.in
> @@ -36,4 +36,10 @@ config NFTABLES_STARTSCRIPT
>  	bool
>  	prompt "install /etc/init.d/nftables"
>  
> +config NFTABLES_SYSTEMD_UNIT
> +	bool
> +	default y
> +	depends on INITMETHOD_SYSTEMD
> +	prompt "install systemd unit file for nftables"
> +
>  endif
> diff --git a/rules/nftables.make b/rules/nftables.make
> index 4a95694ad..15368f965 100644
> --- a/rules/nftables.make
> +++ b/rules/nftables.make
> @@ -69,6 +69,12 @@ endif
>  endif
>  endif
>  
> +ifdef PTXCONF_NFTABLES_SYSTEMD_UNIT
> +	@$(call install_alternative, nftables, 0, 0, 0644, /usr/lib/systemd/system/nftables.service)
> +	@$(call install_link, nftables, ../nftables.service, \
> +		/usr/lib/systemd/system/multi-user.target.wants/nftables.service)
> +endif
> +
>  	@$(call install_finish, nftables)
>  
>  	@$(call touch)
> -- 
> 2.21.0
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de

-- 
/"\ ASCII RIBBON | »With the first link, the chain is forged. The first
\ / CAMPAIGN     | speech censured, the first thought forbidden, the
 X  AGAINST      | first freedom denied, chains us all irrevocably.«
/ \ HTML MAIL    | (Jean-Luc Picard, quoting Judge Aaron Satie)

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 91 bytes --]

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de