diff options
author | Francisco Blas (klondike) Izquierdo Riera <klondike@gentoo.org> | 2019-01-08 03:37:48 +0100 |
---|---|---|
committer | Matthew Thode <prometheanfire@gentoo.org> | 2019-01-07 20:53:52 -0600 |
commit | 4ebf4b667f24cf4384e12413e73307766cec6413 (patch) | |
tree | 63d92ec5151b9115b0f7bde1e7965851d4b7a73b /net-firewall/nftables/files | |
parent | app-office/calligra: Fix build with poppler-0.72 (diff) | |
download | gentoo-4ebf4b667f24cf4384e12413e73307766cec6413.tar.gz gentoo-4ebf4b667f24cf4384e12413e73307766cec6413.tar.bz2 gentoo-4ebf4b667f24cf4384e12413e73307766cec6413.zip |
net-firewall/nftables: Add atomic nftables updates for modern kernels
Signed-off-by: Francisco Blas Izquierdo Riera <klondike@gentoo.org>
Package-Manager: Portage-2.3.51, Repoman-2.3.11
Signed-off-by: Matthew Thode <prometheanfire@gentoo.org>
Diffstat (limited to 'net-firewall/nftables/files')
-rw-r--r-- | net-firewall/nftables/files/libexec/nftables-mk.sh | 59 | ||||
-rw-r--r-- | net-firewall/nftables/files/nftables-mk.confd | 26 | ||||
-rw-r--r-- | net-firewall/nftables/files/nftables-mk.init | 104 |
3 files changed, 189 insertions, 0 deletions
diff --git a/net-firewall/nftables/files/libexec/nftables-mk.sh b/net-firewall/nftables/files/libexec/nftables-mk.sh new file mode 100644 index 000000000000..b6ad37867b6d --- /dev/null +++ b/net-firewall/nftables/files/libexec/nftables-mk.sh @@ -0,0 +1,59 @@ +#!/bin/sh + +main() { + local NFTABLES_SAVE=${2:-'/var/lib/nftables/rules-save'} + case "$1" in + "check") + nft -c -f "${NFTABLES_SAVE}" + ;; + "clear") + nft flush ruleset + ;; + "list") + nft ${SAVE_OPTIONS} list ruleset + ;; + "load") + ( echo "flush ruleset;"; cat "${NFTABLES_SAVE}" ) | nft -f - + ;; + "panic") + panic hard | nft -f - + ;; + "soft_panic") + panic soft | nft -f - + ;; + "store") + local tmp_save="${NFTABLES_SAVE}.tmp" + umask 600; + ( + echo "#!/sbin/nft -f" + echo "flush ruleset;" + nft ${SAVE_OPTIONS} list ruleset + ) > "$tmp_save" && mv ${tmp_save} ${NFTABLES_SAVE} + ;; + esac +} + +panic() { + local erule; + [ "$1" = soft ] && erule="ct state established,related accept;" || erule=""; + cat <<EOF +table inet filter { + chain input { + type filter hook input priority 0; + $erule + drop + } + chain forward { + type filter hook forward priority 0; + drop + } + chain output { + type filter hook output priority 0; + $erule + drop + } +} +EOF +} + +main "$@" diff --git a/net-firewall/nftables/files/nftables-mk.confd b/net-firewall/nftables/files/nftables-mk.confd new file mode 100644 index 000000000000..5cda24030f93 --- /dev/null +++ b/net-firewall/nftables/files/nftables-mk.confd @@ -0,0 +1,26 @@ +# /etc/conf.d/nftables + +# Location in which nftables initscript will save set rules on +# service shutdown +NFTABLES_SAVE="/var/lib/nftables/rules-save" + +# Options to pass to nft on save +SAVE_OPTIONS="-n" + +# Save state on stopping nftables +SAVE_ON_STOP="yes" + +# Only for OpenRC systems. +# Set to "hard" or "soft" to panic when stopping instead of +# clearing the rules +# Soft panic loads a ruleset dropping any new or invalid connections +# Hard panic loads a ruleset dropping all traffic +PANIC_ON_STOP="" + +# If you need to log nftables messages as soon as nftables starts, +# AND your logger does NOT depend on the network, then you may wish +# to uncomment the next line. +# If your logger depends on the network, and you uncomment this line +# you will create an unresolvable circular dependency during startup. +# After commenting or uncommenting this line, you must run 'rc-update -u'. +#rc_use="logger" diff --git a/net-firewall/nftables/files/nftables-mk.init b/net-firewall/nftables/files/nftables-mk.init new file mode 100644 index 000000000000..f7e3dce8ada2 --- /dev/null +++ b/net-firewall/nftables/files/nftables-mk.init @@ -0,0 +1,104 @@ +#!/sbin/openrc-run +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +extra_commands="check clear list panic save soft_panic" +extra_started_commands="reload" + +depend() { + need localmount #434774 + before net +} + +checkkernel() { + if ! /sbin/nft list ruleset >/dev/null 2>/dev/null ; then + eerror "Your kernel lacks nftables support, please load" + eerror "appropriate modules and try again." + return 1 + fi + return 0 +} + +checkconfig() { + if [ -z "${NFTABLES_SAVE}" -o ! -f "${NFTABLES_SAVE}" ] ; then + eerror "Not starting nftables. First create some rules then run:" + eerror "/etc/init.d/${SVCNAME} save" + return 1 + fi + return 0 +} + +start_pre() { + checkconfig || return 1 + checkkernel || return 1 + check || return 1 +} + +start() { + ebegin "Loading ${SVCNAME} state and starting firewall" + /usr/libexec/nftables/nftables.sh load "${NFTABLES_SAVE}" + eend $? +} + +stop() { + if [ "${SAVE_ON_STOP}" = "yes" ] ; then + save || return 1 + fi + + ebegin "Stopping firewall" + if [ "${PANIC_ON_STOP}" = "hard" ]; then + /usr/libexec/nftables/nftables.sh panic + elif [ "${PANIC_ON_STOP}" = "soft" ]; then + /usr/libexec/nftables/nftables.sh soft_panic + else + /usr/libexec/nftables/nftables.sh clear + fi + eend $? +} + +reload() { + start_pre || return 1 + start +} + +clear() { + ebegin "Clearing rules" + /usr/libexec/nftables/nftables.sh clear + eend $? +} + +list() { + /usr/libexec/nftables/nftables.sh list +} + +check() { + ebegin "Checking rules" + /usr/libexec/nftables/nftables.sh check "${NFTABLES_SAVE}" + eend $? +} + +save() { + ebegin "Saving ${SVCNAME} state" + checkpath -q -d "$(dirname "${NFTABLES_SAVE}")" + checkpath -q -m 0600 -f "${NFTABLES_SAVE}" + /usr/libexec/nftables/nftables.sh store "${NFTABLES_SAVE}" + eend $? +} + +panic() { + if service_started ${SVCNAME}; then + rc-service ${SVCNAME} zap + fi + ebegin "Dropping all packets" + /usr/libexec/nftables/nftables.sh panic + eend $? +} + +soft_panic() { + if service_started ${SVCNAME}; then + rc-service ${SVCNAME} zap + fi + ebegin "Dropping new connections" + /usr/libexec/nftables/nftables.sh soft_panic + eend $? +} |