From: Alexander Dahl <ada@thorsis.com>
To: ptxdist@pengutronix.de
Cc: Michael Olbrich <m.olbrich@pengutronix.de>
Subject: Re: [ptxdist] [PATCH v2 5/5] nftables: Add bbinit startscript
Date: Tue, 10 Apr 2018 08:57:01 +0200 [thread overview]
Message-ID: <6513165.U8Eh4E8lWP@ada> (raw)
In-Reply-To: <20180409083056.lj4ad22armucmoms@pengutronix.de>
[-- Attachment #1: Type: text/plain, Size: 490 bytes --]
Hello Michael,
Am Montag, 9. April 2018, 10:30:56 CEST schrieb Michael Olbrich:
> This patch does not apply. I'm not sure why:
> [...]
> error: sha1 information is lacking or useless (rules/nftables.in).
> error: could not build fake ancestor
> [...]
I tried to apply the series from the mails by myself on two systems and got no
error. Strange.
> Please resent. Maybe as an attachment.
I attach it to this mail. You may need to apply other patches of this series
first?
Greets
Alex
[-- Attachment #2: v2-0005-nftables-Add-bbinit-startscript.patch --]
[-- Type: text/x-patch, Size: 4479 bytes --]
From 29a2513f241e3be9428d20756ac2929c764b4115 Mon Sep 17 00:00:00 2001
From: Alexander Dahl <ada@thorsis.com>
Date: Fri, 6 Apr 2018 11:00:46 +0200
Subject: [PATCH v2 5/5] nftables: Add bbinit startscript
For loading your packet filter rules on system startup.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
projectroot/etc/init.d/nftables | 103 ++++++++++++++++++++++++++++++++++++++++
rules/nftables-bbinit.in | 9 ++++
rules/nftables.in | 4 ++
rules/nftables.make | 11 +++++
4 files changed, 127 insertions(+)
create mode 100644 projectroot/etc/init.d/nftables
create mode 100644 rules/nftables-bbinit.in
diff --git a/projectroot/etc/init.d/nftables b/projectroot/etc/init.d/nftables
new file mode 100644
index 0000000000..c10db5d901
--- /dev/null
+++ b/projectroot/etc/init.d/nftables
@@ -0,0 +1,103 @@
+#!/bin/sh
+
+# Author: Arturo Borrero Gonzalez <arturo@debian.org>
+# Adapted by: Alexander Dahl <ada@thorsis.com>
+
+# Do NOT "set -e"
+
+CONF=/etc/nftables.conf
+
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="firewall service"
+NAME=nftables
+BIN=/usr/sbin/nft
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$BIN" ] || exit 0
+
+do_start()
+{
+ # Return
+ # 0 if start OK
+ # 2 if start NOK
+
+ # nft v0.4 return 0 if ENOENT $CONF
+ if [ ! -r "$CONF" ] ; then
+ echo "E: No such $NAME $DESC config file $CONF" >&2
+ return 2
+ fi
+
+ $BIN -f $CONF || return 2
+}
+
+do_stop()
+{
+ # Return
+ # 0 if stopped
+ # 1 if already stopped
+ # 2 if could not be stopped
+ if ! do_status ; then
+ $BIN flush ruleset || return 2
+ fi
+}
+
+do_status()
+{
+ # Return
+ # 0 if no rules
+ # 1 if rules
+ if [ "$($BIN list ruleset 2>/dev/null | wc -l)" = "0" ] ; then
+ return 0
+ fi
+
+ return 1
+}
+
+case "$1" in
+ start)
+ echo -n "Starting $DESC ..."
+ do_start
+ ret="$?"
+ case "$ret" in
+ 0|1) echo " Done." ;;
+ 2) echo " Failed." ;;
+ esac
+ exit $ret
+ ;;
+ restart|force-reload)
+ echo -n "Restarting $DESC ..."
+ do_start
+ ret="$?"
+ case "$ret" in
+ 0|1) echo " Done." ;;
+ 2) echo " Failed." ;;
+ esac
+ exit $ret
+ ;;
+ stop)
+ echo -n "Stopping $DESC ..."
+ do_stop
+ ret="$?"
+ case "$ret" in
+ 0|1) echo " Done." ;;
+ 2) echo " Failed." ;;
+ esac
+ exit $ret
+ ;;
+ status)
+ if ! do_status ; then
+ echo "Status of ${DESC}: rules loaded"
+ exit 0
+ else
+ echo "Status of ${DESC}: no rules loaded"
+ exit 1
+ fi
+ ;;
+ *)
+ echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+ exit 3
+ ;;
+esac
+
+:
diff --git a/rules/nftables-bbinit.in b/rules/nftables-bbinit.in
new file mode 100644
index 0000000000..84234c9761
--- /dev/null
+++ b/rules/nftables-bbinit.in
@@ -0,0 +1,9 @@
+## SECTION=initmethod_bbinit
+
+config NFTABLES_BBINIT_LINK
+ depends on NFTABLES_STARTSCRIPT
+ string
+ prompt "nftables"
+ default "S24nftables"
+
+# vim: ft=kconfig noet tw=72
diff --git a/rules/nftables.in b/rules/nftables.in
index be7fca1fa0..2b35741b7d 100644
--- a/rules/nftables.in
+++ b/rules/nftables.in
@@ -31,6 +31,10 @@ config NFTABLES_MGMP
use the nftables build-in mini-GMP instead of linking to the shared
libgmp. (may reduce debugging verbosity on some files)
+config NFTABLES_STARTSCRIPT
+ bool
+ prompt "install /etc/init.d/nftables"
+
endif
# vim: ft=kconfig noet tw=72
diff --git a/rules/nftables.make b/rules/nftables.make
index 6c978aa21c..c7d704612e 100644
--- a/rules/nftables.make
+++ b/rules/nftables.make
@@ -58,6 +58,17 @@ $(STATEDIR)/nftables.targetinstall:
@$(call install_copy, nftables, 0, 0, 0755, -, /usr/sbin/nft)
@$(call install_alternative, nftables, 0, 0, 0755, /etc/nftables.conf)
+ifdef PTXCONF_INITMETHOD_BBINIT
+ifdef PTXCONF_NFTABLES_STARTSCRIPT
+ @$(call install_alternative, nftables, 0, 0, 0755, /etc/init.d/nftables)
+
+ifneq ($(call remove_quotes,$(PTXCONF_NFTABLES_BBINIT_LINK)),)
+ @$(call install_link, nftables, ../init.d/nftables, \
+ /etc/rc.d/$(PTXCONF_NFTABLES_BBINIT_LINK))
+endif
+endif
+endif
+
@$(call install_finish, nftables)
@$(call touch)
--
2.11.0
[-- Attachment #3: Type: text/plain, Size: 91 bytes --]
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
next prev parent reply other threads:[~2018-04-10 6:57 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-06 9:07 [ptxdist] [PATCH v2 0/5] netfilter: Upgrades and autostart Alexander Dahl
2018-04-06 9:07 ` [ptxdist] [PATCH v2 1/5] libnftnl: Upgrade from 1.0.6 to 1.0.9 Alexander Dahl
2018-04-06 9:07 ` [ptxdist] [PATCH v2 2/5] nftables: Upgrade from v0.6 to v0.8.3 Alexander Dahl
2018-04-06 9:48 ` Alexander Dahl
2018-04-06 9:07 ` [ptxdist] [PATCH v2 3/5] nftables: Fix Vim modelines Alexander Dahl
2018-04-10 8:47 ` Michael Olbrich
2018-04-10 9:02 ` Alexander Dahl
2018-04-10 14:03 ` Michael Olbrich
2018-04-06 9:07 ` [ptxdist] [PATCH v2 4/5] nftables: Add example config file Alexander Dahl
2018-04-06 9:07 ` [ptxdist] [PATCH v2 5/5] nftables: Add bbinit startscript Alexander Dahl
2018-04-09 8:30 ` Michael Olbrich
2018-04-09 9:16 ` Alexander Dahl
2018-04-10 6:57 ` Alexander Dahl [this message]
2018-04-10 8:42 ` Michael Olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6513165.U8Eh4E8lWP@ada \
--to=ada@thorsis.com \
--cc=m.olbrich@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox