nils/gluon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

firewall: switch to nftables

Browse Source
This commit is contained in:
Maciej Krüger 2023-02-05 23:58:42 +01:00
parent 918e3ce784
commit 4318048aed
No known key found for this signature in database
GPG Key ID: 0D948CE19CF49C5F
18 changed files with 37 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/gluon-core/Makefile
View File

@ -11,7 +11,7 @@ define Package/gluon-core
TITLE:=Base files of Gluon TITLE:=Base files of Gluon
DEPENDS:= \ DEPENDS:= \
+gluon-site +libgluonutil +libiwinfo-lua +lua-platform-info +lua-simple-uci +lua-hash +lua-jsonc \ +gluon-site +libgluonutil +libiwinfo-lua +lua-platform-info +lua-simple-uci +lua-hash +lua-jsonc \
+luabitop +luaposix +vxlan +odhcp6c +firewall +pretty-hostname +luabitop +luaposix +vxlan +odhcp6c +firewall4 +pretty-hostname
endef endef
define Package/gluon-core/description define Package/gluon-core/description

2
package/gluon-ebtables-limit-arp/src/gluon-arp-limiter.c
View File

@ -14,7 +14,7 @@
#define BATCTL_DC "/usr/sbin/batctl dc -H -n" #define BATCTL_DC "/usr/sbin/batctl dc -H -n"
#define BATCTL_TL "/usr/sbin/batctl tl -H -n" #define BATCTL_TL "/usr/sbin/batctl tl -H -n"
#define EBTABLES "/usr/sbin/ebtables-tiny" #define EBTABLES "/usr/sbin/ebtables"
#define BUILD_BUG_ON(check) ((void)sizeof(int[1-2*!!(check)])) #define BUILD_BUG_ON(check) ((void)sizeof(int[1-2*!!(check)]))

3
package/gluon-ebtables/Makefile
View File

@ -6,8 +6,7 @@ include ../gluon.mk
define Package/gluon-ebtables define Package/gluon-ebtables
TITLE:=Ebtables support TITLE:=Ebtables support
DEPENDS:=+gluon-core +ebtables-tiny \ DEPENDS:=+gluon-core +ebtables-nft
+kmod-ebtables +kmod-ebtables-ipv4 +kmod-ebtables-ipv6
endef endef
define Package/gluon-ebtables/description define Package/gluon-ebtables/description

8
package/gluon-ebtables/files/etc/init.d/gluon-ebtables
View File

@ -51,8 +51,8 @@ exec_all() {
start() { start() {
( (
export EBTABLES_RULE='"ebtables-tiny -t " .. table .. " -A " .. command' export EBTABLES_RULE='"ebtables -t " .. table .. " -A " .. command'
export EBTABLES_CHAIN='"ebtables-tiny -t " .. table .. " -N " .. name .. " -P " .. policy' export EBTABLES_CHAIN='"ebtables -t " .. table .. " -N " .. name .. " -P " .. policy'
# Contains /var/lib/ebtables/lock for '--concurrent' # Contains /var/lib/ebtables/lock for '--concurrent'
[ ! -d "/var/lib/ebtables" ] && \ [ ! -d "/var/lib/ebtables" ] && \
@ -68,8 +68,8 @@ start() {
stop() { stop() {
( (
export EBTABLES_RULE='"ebtables-tiny -t " .. table .. " -D " .. command' export EBTABLES_RULE='"ebtables -t " .. table .. " -D " .. command'
export EBTABLES_CHAIN='"ebtables-tiny -t " .. table .. " -X " .. name' export EBTABLES_CHAIN='"ebtables -t " .. table .. " -X " .. name'
if [ -z "$1" ]; then if [ -z "$1" ]; then
exec_all '-r' exec_all '-r'

1
package/gluon-iptables-clamp-mss-to-pmtu/Makefile
View File

@ -6,7 +6,6 @@ include ../gluon.mk
define Package/$(PKG_NAME) define Package/$(PKG_NAME)
TITLE:=This will establish a firewall rule to clamp the mss to pmtu on the mesh-vpn interface when the connection is towards 64:ff9b::/96 TITLE:=This will establish a firewall rule to clamp the mss to pmtu on the mesh-vpn interface when the connection is towards 64:ff9b::/96
DEPENDS:= +ip6tables-zz-legacy
endef endef
define Package/$(PKG_NAME)/description define Package/$(PKG_NAME)/description

3
package/gluon-iptables-clamp-mss-to-pmtu/files/lib/gluon/mesh-vpn/iptables-mss.rules
View File

@ -1,3 +0,0 @@
*mangle
-A FORWARD -o mesh-vpn+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT

1
package/gluon-iptables-clamp-mss-to-pmtu/files/lib/gluon/mesh-vpn/nftables-mss.rules Normal file
View File

@ -0,0 +1 @@
oifname "mesh-vpn*" tcp flags & (syn|rst) == syn counter tcp option maxseg size set rt mtu

7
package/gluon-iptables-clamp-mss-to-pmtu/luasrc/lib/gluon/upgrade/800-iptables-mesh-vpn-clamp-mss-to-pmtu
View File

@ -2,9 +2,10 @@
local uci = require('simple-uci').cursor() local uci = require('simple-uci').cursor()
uci:section('firewall', 'include', 'vpn_clamp_mss', { uci:section('firewall', 'include', 'vpn_clamp_mss', {
family = 'ipv6', type = 'nftables',
type = 'restore', position = 'chain-prepend',
path = '/lib/gluon/mesh-vpn/iptables-mss.rules' chain = 'mangle_forward',
path = '/lib/gluon/mesh-vpn/nftables-mss.rules',
}) })
uci:save('firewall') uci:save('firewall')

2
package/gluon-mesh-babel/Makefile
View File

@ -9,7 +9,7 @@ include ../gluon.mk
define Package/gluon-mesh-babel define Package/gluon-mesh-babel
TITLE:=Babel mesh TITLE:=Babel mesh
DEPENDS:=+gluon-core +babeld +gluon-mesh-layer3-common +libiwinfo +libgluonutil +firewall +libjson-c +libnl-tiny +libubus +libubox +libblobmsg-json +libbabelhelper +luabitop DEPENDS:=+gluon-core +babeld +gluon-mesh-layer3-common +libiwinfo +libgluonutil +firewall4 +libjson-c +libnl-tiny +libubus +libubox +libblobmsg-json +libbabelhelper +luabitop
PROVIDES:=gluon-mesh-provider PROVIDES:=gluon-mesh-provider
endef endef

2
package/gluon-mesh-batman-adv/Makefile
View File

@ -13,7 +13,7 @@ define Package/gluon-mesh-batman-adv-15
+libgluonutil \ +libgluonutil \
+gluon-client-bridge \ +gluon-client-bridge \
+gluon-ebtables \ +gluon-ebtables \
+firewall \ +firewall4 \
+libiwinfo \ +libiwinfo \
+kmod-dummy \ +kmod-dummy \
+libnl-tiny \ +libnl-tiny \

2
package/gluon-mesh-layer3-common/Makefile
View File

@ -6,7 +6,7 @@ include ../gluon.mk
define Package/gluon-mesh-layer3-common define Package/gluon-mesh-layer3-common
TITLE:=Layer3 common files TITLE:=Layer3 common files
DEPENDS:=+gluon-core +gluon-mmfd +firewall DEPENDS:=+gluon-core +gluon-mmfd +firewall4
endef endef
$(eval $(call BuildPackageGluon,gluon-mesh-layer3-common)) $(eval $(call BuildPackageGluon,gluon-mesh-layer3-common))

2
package/gluon-mesh-vpn-core/Makefile
View File

@ -6,7 +6,7 @@ include ../gluon.mk
define Package/gluon-mesh-vpn-core define Package/gluon-mesh-vpn-core
TITLE:=Basic support for connecting meshes via VPN tunnels TITLE:=Basic support for connecting meshes via VPN tunnels
DEPENDS:=+gluon-core +gluon-wan-dnsmasq +iptables-zz-legacy +iptables-mod-extra +simple-tc DEPENDS:=+gluon-core +gluon-wan-dnsmasq +simple-tc
USERID:=:gluon-mesh-vpn=800 USERID:=:gluon-mesh-vpn=800
endef endef

3
package/gluon-mesh-vpn-core/files/lib/gluon/mesh-vpn/iptables.rules
View File

@ -1,3 +0,0 @@
*nat
-I OUTPUT -m owner --gid-owner gluon-mesh-vpn -o lo -d 127.0.0.1 -p udp --dport 53 -j DNAT --to-destination :54
COMMIT

1
package/gluon-mesh-vpn-core/files/lib/gluon/mesh-vpn/nftables.rules Normal file
View File

@ -0,0 +1 @@
meta skgid gluon-mesh-vpn oifname "lo" ip daddr 127.0.0.1 udp dport 53 redirect to 54

7
package/gluon-mesh-vpn-core/luasrc/lib/gluon/upgrade/500-mesh-vpn
View File

@ -26,9 +26,10 @@ users.remove_user('gluon-fastd')
users.remove_group('gluon-fastd') users.remove_group('gluon-fastd')
uci:section('firewall', 'include', 'mesh_vpn_dns', { uci:section('firewall', 'include', 'mesh_vpn_dns', {
type = 'restore', type = 'nftables',
path = '/lib/gluon/mesh-vpn/iptables.rules', path = '/lib/gluon/mesh-vpn/nftables.rules',
family = 'ipv4', position = 'chain-prepend',
chain = 'dstnat',
}) })
uci:save('firewall') uci:save('firewall')

16
package/gluon-radv-filterd/src/gluon-radv-filterd.c
View File

@ -149,12 +149,12 @@ static void cleanup(void) {
if (G.chain) { if (G.chain) {
/* Reset chain to accept everything again */ /* Reset chain to accept everything again */
if (fork_execvp_timeout(&timeout, "ebtables-tiny", (const char *[]) if (fork_execvp_timeout(&timeout, "ebtables", (const char *[])
{ "ebtables-tiny", "-F", G.chain, NULL })) { "ebtables", "-F", G.chain, NULL }))
DEBUG_MSG("warning: flushing ebtables chain %s failed, not adding a new rule", G.chain); DEBUG_MSG("warning: flushing ebtables chain %s failed, not adding a new rule", G.chain);
if (fork_execvp_timeout(&timeout, "ebtables-tiny", (const char *[]) if (fork_execvp_timeout(&timeout, "ebtables", (const char *[])
{ "ebtables-tiny", "-A", G.chain, "-j", "ACCEPT", NULL })) { "ebtables", "-A", G.chain, "-j", "ACCEPT", NULL }))
DEBUG_MSG("warning: adding new rule to ebtables chain %s failed", G.chain); DEBUG_MSG("warning: adding new rule to ebtables chain %s failed", G.chain);
} }
} }
@ -700,11 +700,11 @@ static void update_ebtables(void) {
G.max_tq); G.max_tq);
G.best_router = router; G.best_router = router;
if (fork_execvp_timeout(&timeout, "ebtables-tiny", (const char *[]) if (fork_execvp_timeout(&timeout, "ebtables", (const char *[])
{ "ebtables-tiny", "-F", G.chain, NULL })) { "ebtables", "-F", G.chain, NULL }))
error_message(0, 0, "warning: flushing ebtables chain %s failed, not adding a new rule", G.chain); error_message(0, 0, "warning: flushing ebtables chain %s failed, not adding a new rule", G.chain);
else if (fork_execvp_timeout(&timeout, "ebtables-tiny", (const char *[]) else if (fork_execvp_timeout(&timeout, "ebtables", (const char *[])
{ "ebtables-tiny", "-A", G.chain, "-s", mac, "-j", "ACCEPT", NULL })) { "ebtables", "-A", G.chain, "-s", mac, "-j", "ACCEPT", NULL }))
error_message(0, 0, "warning: adding new rule to ebtables chain %s failed", G.chain); error_message(0, 0, "warning: adding new rule to ebtables chain %s failed", G.chain);
} }

2
package/gluon-radv-filterd/src/respondd.c
View File

@ -8,7 +8,7 @@
#include "mac.h" #include "mac.h"
static struct json_object * get_radv_filter() { static struct json_object * get_radv_filter() {
FILE *f = popen("exec ebtables-tiny -L RADV_FILTER", "r"); FILE *f = popen("exec ebtables -L RADV_FILTER", "r");
char *line = NULL; char *line = NULL;
size_t len = 0; size_t len = 0;
struct ether_addr mac = {}; struct ether_addr mac = {};

10
targets/generic
View File

@ -97,14 +97,18 @@ packages {
'-kmod-nft-offload', '-kmod-nft-offload',
'-libustream-wolfssl', '-libustream-wolfssl',
'-libwolfssl', '-libwolfssl',
'-nftables',
'-odhcpd-ipv6only', '-odhcpd-ipv6only',
'-ppp', '-ppp',
'-ppp-mod-pppoe', '-ppp-mod-pppoe',
'-wpad-mini', '-wpad-mini',
'-wpad-basic', '-wpad-basic',
'-wpad-basic-wolfssl', '-wpad-basic-wolfssl',
'-firewall4',
'gluon-core', 'gluon-core',
'ip6tables-zz-legacy', '-iptables',
'-nftables',
'nftables-json',
'-xtables-legacy',
'ip6tables-nft',
'iptables-nft',
'-kmod-ipt-core',
} }