blob: c72639305654f9c07c481857be01d6adbd63bc47 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
#!/sbin/runscript
# Copyright 2014 Nicholas Vinson
# Copyright 1999-2014 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
extra_commands="clear list panic save"
extra_started_commands="reload"
depend() {
need localmount #434774
before net
}
checkkernel() {
if ! nft list tables >/dev/null 2>&1; then
eerror "Your kernel lacks nftables support, please load"
eerror "appropriate modules and try again."
return 1
fi
return 0
}
checkconfig() {
if [ ! -f ${NFTABLES_SAVE} ]; then
eerror "Not starting nftables. First create some rules then run:"
eerror "rc-service nftables save"
return 1
fi
return 0
}
getfamilies() {
local families
for l3f in ip arp ip6 bridge inet; do
if nft list tables ${l3f} > /dev/null 2>&1; then
families="${families}${l3f} "
fi
done
echo ${families}
}
clearNFT() {
local l3f line table chain
for l3f in $(getfamilies); do
nft list tables ${l3f} | while read line; do
table=$(echo ${line} | sed "s/table[ \t]*//")
nft flush table ${l3f} ${table}
nft list table ${l3f} ${table} | while read l; do
chain=$(echo $l | grep -o 'chain [^[:space:]]\+' |\
cut -d ' ' -f2)
if [ -n "${chain}" ]; then
nft flush chain ${l3f} ${table} ${chain}
nft delete chain ${l3f} ${table} ${chain}
fi
done
nft delete table ${l3f} ${table}
done
done
}
addpanictable() {
local l3f=$1
nft add table ${l3f} panic
nft add chain ${l3f} panic input \{ type filter hook input priority 0\; \}
nft add chain ${l3f} panic output \{ type filter hook output priority 0\; \}
nft add chain ${l3f} panic forward \{ type filter hook forward priority 0\; \}
nft add rule ${l3f} panic input drop
nft add rule ${l3f} panic output drop
nft add rule ${l3f} panic forward drop
}
start_pre() {
checkkernel || return 1
checkconfig || return 1
return 0
}
start() {
ebegin "Loading nftables state and starting firewall"
clearNFT
nft -f ${NFTABLES_SAVE}
eend $?
}
stop() {
if yesno ${SAVE_ON_STOP:-yes}; then
save || return 1
fi
ebegin "Stopping firewall"
clearNFT
eend $?
}
reload() {
checkkernel || return 1
# checkrules || return 1
ebegin "Flushing firewall"
clearNFT
start
}
clear() {
clearNFT
}
list() {
local l3f
for l3f in $(getfamilies); do
nft list tables ${l3f} | while read line; do
line=$(echo ${line} | sed "s/table/table ${l3f}/")
echo "$(nft list ${line})"
done
done
}
save() {
ebegin "Saving nftables state"
checkpath -q -d "$(dirname "${NFTABLES_SAVE}")"
checkpath -q -m 0600 -f "${NFTABLES_SAVE}"
local l3f line tmp_save="${NFTABLES_SAVE}.tmp"
touch "${tmp_save}"
for l3f in $(getfamilies); do
nft list tables ${l3f} | while read line; do
line=$(echo ${line} | sed "s/table/table ${l3f}/")
# The below substitution fixes an issue where nft -n output may not
# always be parsable by nft -f. For example, nft -n might print
#
# ip6 saddr ::1 ip6 daddr ::1 counter packets 0 bytes 0 accept
#
# but nft -f refuses to parse that string with error:
#
# In file included from internal:0:0-0:
# /var/lib/nftables/rules-save:1:1-2: Error: Could not process rule:
# Invalid argument
# table ip6 filter {
# ^^
echo "$(nft ${SAVE_OPTIONS} list ${line} |\
sed 's/\(::[0-9a-fA-F]\+\)\([^/]\)/\1\/128\2/g')" >> "${tmp_save}"
done
done
mv "${tmp_save}" "${NFTABLES_SAVE}"
}
panic() {
checkkernel || return 1
if service_started ${RC_SVCNAME}; then
rc-service ${RC_SVCNAME} stop
fi
ebegin "Dropping all packets"
clearNFT
local l3f
for l3f in $(getfamilies); do
case ${l3f} in
ip) addpanictable ${l3f} ;;
ip6) addpanictable ${l3f} ;;
esac
done
}
|
