diff mbox series

[v3] package/iptables: add init script

Message ID 20210915130620.3162787-1-jose.pekkarinen@unikie.com
State Accepted
Headers show
Series [v3] package/iptables: add init script | expand

Commit Message

José Pekkarinen Sept. 15, 2021, 1:06 p.m. UTC 
This patch will add an init script that allows
to set a ruleset in /etc/iptables.conf to be loaded
on boot, or flushed on stop, as well as a saving
command to generate a new file.

Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
---
[v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/
[v2 -> v3] Execute before networking script, handle ro rootfs

 package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++
 package/iptables/iptables.mk |  6 ++++
 2 files changed, 68 insertions(+)
 create mode 100644 package/iptables/S35iptables

Comments

Arnout Vandecappelle Sept. 22, 2021, 9:33 p.m. UTC | #1 
On 15/09/2021 15:06, José Pekkarinen wrote:
> This patch will add an init script that allows
> to set a ruleset in /etc/iptables.conf to be loaded
> on boot, or flushed on stop, as well as a saving
> command to generate a new file.
> 
> Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
> ---
> [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/
> [v2 -> v3] Execute before networking script, handle ro rootfs
> 
>   package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++
>   package/iptables/iptables.mk |  6 ++++
>   2 files changed, 68 insertions(+)
>   create mode 100644 package/iptables/S35iptables
> 
> diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables
> new file mode 100644
> index 0000000000..6023297236
> --- /dev/null
> +++ b/package/iptables/S35iptables
> @@ -0,0 +1,62 @@
> +#!/bin/sh
> +
> +DAEMON="iptables"
> +
> +IPTABLES_ARGS=""
> +
> +start() {
> +	printf 'Starting %s: ' "$DAEMON"
> +	iptables-restore < /etc/iptables.conf
> +	status=$?
> +	if [ "$status" -eq 0 ]; then
> +		echo "OK"
> +	else
> +		echo "FAIL"
> +	fi
> +	return "$status"
> +}
> +
> +stop() {
> +	printf 'Stopping %s: ' "$DAEMON"
> +	iptables -F
> +	status=$?
> +	if [ "$status" -eq 0 ]; then
> +		echo "OK"
> +	else
> +		echo "FAIL"
> +	fi
> +	return "$status"
> +}
> +
> +restart() {
> +	stop
> +	sleep 1
> +	start
> +}
> +
> +save() {
> +	printf 'Saving %s: ' "$DAEMON"
> +	if iptables-save > /etc/iptables.conf; then
> +		status=$?
> +		if [ "$status" -eq 0 ]; then

  This makes no sense - if you enter the if branch, then status is by definition 
0...

  Since it's not terribly important IMHO (I don't think the complexity of the 
S20urandom stuff is really warranted, since 'save' is just a manual operation), 
I fixed it up so it just prints OK in the if branch and SKIP in the else branch.

  Baruch, any objections?


  BTW, I have no problem with this in the default installation, because by 
default it doesn't do anything (iptables.conf is an empty file). Personally I'd 
have implemented it by testing if it exists in the init script, but that's 
really bikeshedding.

  Thus, applied to master, thanks.

  Regards,
  Arnout

> +			echo "OK"
> +		else
> +			echo "FAIL"
> +		fi
> +	else
> +		status=$?
> +		echo "SKIP (read-only file system detected)"
> +	fi
> +	return "$status"
> +}
> +
> +case "$1" in
> +	start|stop|restart|save)
> +		"$1";;
> +	reload)
> +		# Restart, since there is no true "reload" feature.
> +		restart;;
> +	*)
> +		echo "Usage: $0 {start|stop|restart|reload}"
> +		exit 1
> +esac
> diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk
> index dc01466607..f0ddca8f9a 100644
> --- a/package/iptables/iptables.mk
> +++ b/package/iptables/iptables.mk
> @@ -57,4 +57,10 @@ define IPTABLES_LINUX_CONFIG_FIXUPS
>   	$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES)
>   endef
>   
> +define IPTABLES_INSTALL_INIT_SYSV
> +	$(INSTALL) -m 0755 -D package/iptables/S35iptables \
> +		$(TARGET_DIR)/etc/init.d/S35iptables
> +	touch $(TARGET_DIR)/etc/iptables.conf
> +endef
> +
>   $(eval $(autotools-package))
>
Peter Korsgaard Oct. 5, 2021, 1:41 p.m. UTC | #2 
>>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes:

 > This patch will add an init script that allows
 > to set a ruleset in /etc/iptables.conf to be loaded
 > on boot, or flushed on stop, as well as a saving
 > command to generate a new file.

 > Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
 > ---
 > [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/
 > [v2 -> v3] Execute before networking script, handle ro rootfs

 >  package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++
 >  package/iptables/iptables.mk |  6 ++++
 >  2 files changed, 68 insertions(+)
 >  create mode 100644 package/iptables/S35iptables

 > diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables
 > new file mode 100644
 > index 0000000000..6023297236
 > --- /dev/null
 > +++ b/package/iptables/S35iptables
 > @@ -0,0 +1,62 @@
 > +#!/bin/sh
 > +
 > +DAEMON="iptables"
 > +
 > +IPTABLES_ARGS=""
 > +
 > +start() {
 > +	printf 'Starting %s: ' "$DAEMON"
 > +	iptables-restore < /etc/iptables.conf

Any special reason for the redirect? iptables-save / restor accepts a
filename argument.

 > +case "$1" in
 > +	start|stop|restart|save)
 > +		"$1";;
 > +	reload)
 > +		# Restart, since there is no true "reload" feature.
 > +		restart;;
 > +	*)
 > +		echo "Usage: $0 {start|stop|restart|reload}"

NIT: This doesn't document the save argument.
José Pekkarinen Oct. 5, 2021, 4:28 p.m. UTC | #3 
On Tue, Oct 5, 2021 at 4:41 PM Peter Korsgaard <peter@korsgaard.com> wrote:

> >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes:
>
>  > This patch will add an init script that allows
>  > to set a ruleset in /etc/iptables.conf to be loaded
>  > on boot, or flushed on stop, as well as a saving
>  > command to generate a new file.
>
>  > Signed-off-by: José Pekkarinen <jose.pekkarinen@unikie.com>
>  > ---
>  > [v1 -> v2] s/touch $(DESTDIR)/touch $(TARGET_DIR)/
>  > [v2 -> v3] Execute before networking script, handle ro rootfs
>
>  >  package/iptables/S35iptables | 62 ++++++++++++++++++++++++++++++++++++
>  >  package/iptables/iptables.mk |  6 ++++
>  >  2 files changed, 68 insertions(+)
>  >  create mode 100644 package/iptables/S35iptables
>
>  > diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables
>  > new file mode 100644
>  > index 0000000000..6023297236
>  > --- /dev/null
>  > +++ b/package/iptables/S35iptables
>  > @@ -0,0 +1,62 @@
>  > +#!/bin/sh
>  > +
>  > +DAEMON="iptables"
>  > +
>  > +IPTABLES_ARGS=""
>  > +
>  > +start() {
>  > +    printf 'Starting %s: ' "$DAEMON"
>  > +    iptables-restore < /etc/iptables.conf
>
> Any special reason for the redirect? iptables-save / restor accepts a
> filename argument.
>

Not from my side, I just didn't notice. I can

change it for you if you want.




>  > +case "$1" in
>  > +    start|stop|restart|save)
>  > +            "$1";;
>  > +    reload)
>  > +            # Restart, since there is no true "reload" feature.
>  > +            restart;;
>  > +    *)
>  > +            echo "Usage: $0 {start|stop|restart|reload}"
>
> NIT: This doesn't document the save argument.
>

Very true, please let me know and I'm happy to send a v3

tomorrow with those stuff.

Thanks!

José.
Peter Korsgaard Oct. 5, 2021, 4:54 p.m. UTC | #4 
>>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes:

Hi,

 >> Any special reason for the redirect? iptables-save / restor accepts a
 >> filename argument.
 >> 

 > Not from my side, I just didn't notice. I can

 > change it for you if you want.

Yes, please.


 >> > +            echo "Usage: $0 {start|stop|restart|reload}"
 >> 
 >> NIT: This doesn't document the save argument.
 >> 

 > Very true, please let me know and I'm happy to send a v3

 > tomorrow with those stuff.

Ehh, this was already v3 and it was applied, so you will need to send a
followup patch changing the script instead.

Thanks.
José Pekkarinen Oct. 6, 2021, 6:23 a.m. UTC | #5 
On Tue, Oct 5, 2021 at 7:54 PM Peter Korsgaard <peter@korsgaard.com> wrote:

> >>>>> "José" == José Pekkarinen <jose.pekkarinen@unikie.com> writes:
>
> Hi,
>
>  >> Any special reason for the redirect? iptables-save / restor accepts a
>  >> filename argument.
>  >>
>
>  > Not from my side, I just didn't notice. I can
>
>  > change it for you if you want.
>
> Yes, please.
>
>
>  >> > +            echo "Usage: $0 {start|stop|restart|reload}"
>  >>
>  >> NIT: This doesn't document the save argument.
>  >>
>
>  > Very true, please let me know and I'm happy to send a v3
>
>  > tomorrow with those stuff.
>
> Ehh, this was already v3 and it was applied, so you will need to send a
> followup patch changing the script instead.
>

Just sent, thanks!


José.
diff mbox series

Patch

diff --git a/package/iptables/S35iptables b/package/iptables/S35iptables
new file mode 100644
index 0000000000..6023297236
--- /dev/null
+++ b/package/iptables/S35iptables
@@ -0,0 +1,62 @@ 
+#!/bin/sh
+
+DAEMON="iptables"
+
+IPTABLES_ARGS=""
+
+start() {
+	printf 'Starting %s: ' "$DAEMON"
+	iptables-restore < /etc/iptables.conf
+	status=$?
+	if [ "$status" -eq 0 ]; then
+		echo "OK"
+	else
+		echo "FAIL"
+	fi
+	return "$status"
+}
+
+stop() {
+	printf 'Stopping %s: ' "$DAEMON"
+	iptables -F
+	status=$?
+	if [ "$status" -eq 0 ]; then
+		echo "OK"
+	else
+		echo "FAIL"
+	fi
+	return "$status"
+}
+
+restart() {
+	stop
+	sleep 1
+	start
+}
+
+save() {
+	printf 'Saving %s: ' "$DAEMON"
+	if iptables-save > /etc/iptables.conf; then
+		status=$?
+		if [ "$status" -eq 0 ]; then
+			echo "OK"
+		else
+			echo "FAIL"
+		fi
+	else
+		status=$?
+		echo "SKIP (read-only file system detected)"
+	fi
+	return "$status"
+}
+
+case "$1" in
+	start|stop|restart|save)
+		"$1";;
+	reload)
+		# Restart, since there is no true "reload" feature.
+		restart;;
+	*)
+		echo "Usage: $0 {start|stop|restart|reload}"
+		exit 1
+esac
diff --git a/package/iptables/iptables.mk b/package/iptables/iptables.mk
index dc01466607..f0ddca8f9a 100644
--- a/package/iptables/iptables.mk
+++ b/package/iptables/iptables.mk
@@ -57,4 +57,10 @@  define IPTABLES_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES)
 endef
 
+define IPTABLES_INSTALL_INIT_SYSV
+	$(INSTALL) -m 0755 -D package/iptables/S35iptables \
+		$(TARGET_DIR)/etc/init.d/S35iptables
+	touch $(TARGET_DIR)/etc/iptables.conf
+endef
+
 $(eval $(autotools-package))