forked from pool/nftables
Add 0001-tools-add-a-systemd-unit-for-static-rulesets.patch
This commit is contained in:
parent
fcf56aa719
commit
ee8a28dc13
173
0001-tools-add-a-systemd-unit-for-static-rulesets.patch
Normal file
173
0001-tools-add-a-systemd-unit-for-static-rulesets.patch
Normal file
@ -0,0 +1,173 @@
|
|||||||
|
From f08b34c9cba43879259c0b095c50efd3e6e66250 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jan Engelhardt <jengelh@inai.de>
|
||||||
|
Date: Fri, 28 Feb 2025 19:45:01 +0100
|
||||||
|
Subject: [PATCH] tools: add a systemd unit for static rulesets
|
||||||
|
References: https://lore.kernel.org/netfilter-devel/20250228205935.59659-1-jengelh@inai.de/T/#u (v1)
|
||||||
|
Notes-v2: the Documentation= line needed a "man:" infix
|
||||||
|
|
||||||
|
There is a customer request (bugreport) for wanting to trivially load a ruleset
|
||||||
|
from a well-known location on boot, forwarded to me by M. Gerstner. A systemd
|
||||||
|
service unit is hereby added to provide that functionality. This is based on
|
||||||
|
various distributions attempting to do same, cf.
|
||||||
|
|
||||||
|
https://src.fedoraproject.org/rpms/nftables/tree/rawhide
|
||||||
|
https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/main/nftables/nftables.initd
|
||||||
|
https://gitlab.archlinux.org/archlinux/packaging/packages/nftables
|
||||||
|
|
||||||
|
Cc: Matthias Gerstner <matthias.gerstner@suse.com>
|
||||||
|
---
|
||||||
|
.gitignore | 1 +
|
||||||
|
Makefile.am | 16 ++++++++++++----
|
||||||
|
configure.ac | 10 ++++++++++
|
||||||
|
files/nftables/main.nft | 24 ++++++++++++++++++++++++
|
||||||
|
tools/nftables.service.8 | 18 ++++++++++++++++++
|
||||||
|
tools/nftables.service.in | 21 +++++++++++++++++++++
|
||||||
|
6 files changed, 86 insertions(+), 4 deletions(-)
|
||||||
|
create mode 100644 files/nftables/main.nft
|
||||||
|
create mode 100644 tools/nftables.service.8
|
||||||
|
create mode 100644 tools/nftables.service.in
|
||||||
|
|
||||||
|
diff --git a/Makefile.am b/Makefile.am
|
||||||
|
index fb64105d..050991f4 100644
|
||||||
|
--- a/Makefile.am
|
||||||
|
+++ b/Makefile.am
|
||||||
|
@@ -375,18 +375,19 @@ dist_pkgdata_DATA = \
|
||||||
|
files/nftables/netdev-ingress.nft \
|
||||||
|
$(NULL)
|
||||||
|
|
||||||
|
-pkgdocdir = ${docdir}/examples
|
||||||
|
+exampledir = ${docdir}/examples
|
||||||
|
|
||||||
|
-dist_pkgdoc_SCRIPTS = \
|
||||||
|
+dist_example_SCRIPTS = \
|
||||||
|
files/examples/ct_helpers.nft \
|
||||||
|
files/examples/load_balancing.nft \
|
||||||
|
files/examples/secmark.nft \
|
||||||
|
files/examples/sets_and_maps.nft \
|
||||||
|
$(NULL)
|
||||||
|
|
||||||
|
-pkgsysconfdir = ${sysconfdir}/nftables/osf
|
||||||
|
+pkgsysconfdir = ${sysconfdir}/${PACKAGE}
|
||||||
|
+osfdir = ${pkgsysconfdir}/osf
|
||||||
|
|
||||||
|
-dist_pkgsysconf_DATA = \
|
||||||
|
+dist_osf_DATA = \
|
||||||
|
files/osf/pf.os \
|
||||||
|
$(NULL)
|
||||||
|
|
||||||
|
@@ -410,3 +411,10 @@ EXTRA_DIST += \
|
||||||
|
|
||||||
|
pkgconfigdir = $(libdir)/pkgconfig
|
||||||
|
pkgconfig_DATA = libnftables.pc
|
||||||
|
+unit_DATA = tools/nftables.service
|
||||||
|
+man_MANS = tools/nftables.service.8
|
||||||
|
+doc_DATA = files/nftables/main.nft
|
||||||
|
+
|
||||||
|
+tools/nftables.service: tools/nftables.service.in ${top_builddir}/config.status
|
||||||
|
+ ${AM_V_GEN}${MKDIR_P} tools
|
||||||
|
+ ${AM_V_at}sed -e 's|@''sbindir''@|${sbindir}|g;s|@''pkgsysconfdir''@|${pkgsysconfdir}|g' <${srcdir}/tools/nftables.service.in >$@
|
||||||
|
diff --git a/configure.ac b/configure.ac
|
||||||
|
index 80a64813..64a164e5 100644
|
||||||
|
--- a/configure.ac
|
||||||
|
+++ b/configure.ac
|
||||||
|
@@ -114,6 +114,16 @@ AC_CHECK_DECLS([getprotobyname_r, getprotobynumber_r, getservbyport_r], [], [],
|
||||||
|
#include <netdb.h>
|
||||||
|
]])
|
||||||
|
|
||||||
|
+AC_ARG_WITH([unitdir],
|
||||||
|
+ [AS_HELP_STRING([--with-unitdir=PATH], [Path to systemd service unit directory])],
|
||||||
|
+ [unitdir="$withval"],
|
||||||
|
+ [
|
||||||
|
+ unitdir=$("$PKG_CONFIG" systemd --variable systemdsystemunitdir 2>/dev/null)
|
||||||
|
+ AS_IF([test -z "$unitdir"], [unitdir='${prefix}/lib/systemd/system'])
|
||||||
|
+ ])
|
||||||
|
+AC_SUBST([unitdir])
|
||||||
|
+
|
||||||
|
+
|
||||||
|
AC_CONFIG_FILES([ \
|
||||||
|
Makefile \
|
||||||
|
libnftables.pc \
|
||||||
|
diff --git a/files/nftables/main.nft b/files/nftables/main.nft
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..8e62f9bc
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/files/nftables/main.nft
|
||||||
|
@@ -0,0 +1,24 @@
|
||||||
|
+#!/usr/sbin/nft -f
|
||||||
|
+
|
||||||
|
+# template static firewall configuration file
|
||||||
|
+#
|
||||||
|
+# copy this over to /etc/nftables/rules/main.nft as a starting point for
|
||||||
|
+# configuring a rule set which will be loaded by nftables.service.
|
||||||
|
+
|
||||||
|
+flush ruleset
|
||||||
|
+
|
||||||
|
+table inet filter {
|
||||||
|
+ chain input {
|
||||||
|
+ type filter hook input priority filter;
|
||||||
|
+ }
|
||||||
|
+ chain forward {
|
||||||
|
+ type filter hook forward priority filter;
|
||||||
|
+ }
|
||||||
|
+ chain output {
|
||||||
|
+ type filter hook output priority filter;
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+# this can be used to split the rule set into multiple smaller files concerned
|
||||||
|
+# with specific topics, like forwarding rules
|
||||||
|
+#include "/etc/nftables/rules/forwarding.nft"
|
||||||
|
diff --git a/tools/nftables.service.8 b/tools/nftables.service.8
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..4a83b01c
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tools/nftables.service.8
|
||||||
|
@@ -0,0 +1,18 @@
|
||||||
|
+.TH nftables.service 8 "" "nftables" "nftables admin reference"
|
||||||
|
+.SH Name
|
||||||
|
+nftables.service \(em Static Firewall Configuration with nftables.service
|
||||||
|
+.SH Description
|
||||||
|
+An nftables systemd service is provided which allows to setup static firewall
|
||||||
|
+rulesets based on a configuration file.
|
||||||
|
+.PP
|
||||||
|
+To use this service, you need to create the main configuration file in
|
||||||
|
+/etc/nftables/rules/main.nft. A template for this can be copied from
|
||||||
|
+/usr/share/doc/nftables/main.nft. The static firewall configuration can be
|
||||||
|
+split up into multiple files which are included from the main.nft
|
||||||
|
+configuration file.
|
||||||
|
+.PP
|
||||||
|
+Once the desired static firewall configuration is in place, it can be tested by
|
||||||
|
+running `systemctl start nftables.service`. To enable the service at boot time,
|
||||||
|
+run `systemctl enable nftables.service`.
|
||||||
|
+.SH See also
|
||||||
|
+\fBnft\fP(8)
|
||||||
|
diff --git a/tools/nftables.service.in b/tools/nftables.service.in
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..f2f07126
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tools/nftables.service.in
|
||||||
|
@@ -0,0 +1,21 @@
|
||||||
|
+[Unit]
|
||||||
|
+Description=nftables static rule set
|
||||||
|
+Documentation=man:nftables.service(8)
|
||||||
|
+Wants=network-pre.target
|
||||||
|
+Before=network-pre.target shutdown.target
|
||||||
|
+Conflicts=shutdown.target
|
||||||
|
+DefaultDependencies=no
|
||||||
|
+ConditionPathExists=@pkgsysconfdir@/rules/main.nft
|
||||||
|
+
|
||||||
|
+[Service]
|
||||||
|
+Type=oneshot
|
||||||
|
+RemainAfterExit=yes
|
||||||
|
+StandardInput=null
|
||||||
|
+ProtectSystem=full
|
||||||
|
+ProtectHome=true
|
||||||
|
+ExecStart=@sbindir@/nft -f @pkgsysconfdir@/rules/main.nft
|
||||||
|
+ExecReload=@sbindir@/nft -f @pkgsysconfdir@/rules/main.nft
|
||||||
|
+ExecStop=@sbindir@/nft flush ruleset
|
||||||
|
+
|
||||||
|
+[Install]
|
||||||
|
+WantedBy=sysinit.target
|
||||||
|
--
|
||||||
|
2.48.1
|
||||||
|
|
||||||
@ -1,3 +1,9 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Mar 4 08:01:21 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
|
||||||
|
|
||||||
|
- Add 0001-tools-add-a-systemd-unit-for-static-rulesets.patch
|
||||||
|
[boo#1237277]
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Thu Oct 3 07:00:54 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
|
Thu Oct 3 07:00:54 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
|
||||||
|
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
#
|
#
|
||||||
# spec file for package nftables
|
# spec file for package nftables
|
||||||
#
|
#
|
||||||
# Copyright (c) 2024 SUSE LLC
|
# Copyright (c) 2025 SUSE LLC
|
||||||
#
|
#
|
||||||
# All modifications and additions to the file contributed by third parties
|
# All modifications and additions to the file contributed by third parties
|
||||||
# remain the property of their copyright owners, unless otherwise agreed
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
@ -33,6 +33,7 @@ Source: http://ftp.netfilter.org/pub/%name/%name-%version.tar.xz
|
|||||||
Source2: http://ftp.netfilter.org/pub/%name/%name-%version.tar.xz.sig
|
Source2: http://ftp.netfilter.org/pub/%name/%name-%version.tar.xz.sig
|
||||||
Source3: %name.keyring
|
Source3: %name.keyring
|
||||||
Source4: nftables.rpmlintrc
|
Source4: nftables.rpmlintrc
|
||||||
|
Patch1: 0001-tools-add-a-systemd-unit-for-static-rulesets.patch
|
||||||
BuildRequires: %{python_module pip}
|
BuildRequires: %{python_module pip}
|
||||||
BuildRequires: %{python_module setuptools}
|
BuildRequires: %{python_module setuptools}
|
||||||
BuildRequires: %{python_module wheel}
|
BuildRequires: %{python_module wheel}
|
||||||
@ -116,6 +117,7 @@ cd -
|
|||||||
%install
|
%install
|
||||||
b="%buildroot"
|
b="%buildroot"
|
||||||
%make_install -C obj
|
%make_install -C obj
|
||||||
|
perl -i -lpe 's{^(Conflicts=.*)}{$1 firewalld.service}' "$b/%_unitdir/nftables.service"
|
||||||
cd py
|
cd py
|
||||||
%pyproject_install
|
%pyproject_install
|
||||||
%python_expand %fdupes %buildroot/%{$python_sitelib}
|
%python_expand %fdupes %buildroot/%{$python_sitelib}
|
||||||
@ -125,13 +127,27 @@ mv -v "$b/%_datadir/nftables"/*.nft "$b/%_docdir/%name/examples/"
|
|||||||
|
|
||||||
%ldconfig_scriptlets -n libnftables1
|
%ldconfig_scriptlets -n libnftables1
|
||||||
|
|
||||||
|
%pre
|
||||||
|
%service_add_pre nftables.service
|
||||||
|
|
||||||
|
%post
|
||||||
|
%service_add_post nftables.service
|
||||||
|
|
||||||
|
%preun
|
||||||
|
%service_del_preun nftables.service
|
||||||
|
|
||||||
|
%postun
|
||||||
|
%service_del_postun nftables.service
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%license COPYING
|
%license COPYING
|
||||||
%_sysconfdir/nftables/
|
%dir %_sysconfdir/nftables/
|
||||||
|
%_sysconfdir/nftables/osf/
|
||||||
%_sbindir/nft
|
%_sbindir/nft
|
||||||
%_mandir/man5/*.5*
|
%_mandir/man5/*.5*
|
||||||
%_mandir/man8/nft*
|
%_mandir/man8/nft*
|
||||||
%_docdir/%name/
|
%_docdir/%name/
|
||||||
|
%_unitdir/nftables.service
|
||||||
|
|
||||||
%files -n libnftables1
|
%files -n libnftables1
|
||||||
%_libdir/libnftables.so.1*
|
%_libdir/libnftables.so.1*
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user