Update iptables runtime recommends and add default init scripts and configs

PATCH In review Kai Kang 3 participants 18 messages Jun 23, 2014 – Jun 25, 2014

Share & tools

Kai Kang

author

2014-06-23 02:33 UTC #0 lore raw

cover Update iptables runtime recommends and add default init scripts and configs

Update iptables runtime recommends and add default init scripts and configs from redhat. That gives users rudimental configures and users only need to update their own iptables rules.

The following changes since commit 7c1a975a1c2fd884aa9f6f4736656d854a6c5edb:

bitbake: toaster: Fix spacing and layout in no image files notification (2014-06-20 14:03:58 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib kangkai/iptables
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=kangkai/iptables

Kai Kang (5):
iptables: update RRECOMMENDS
iptables: add init script and configure file
iptables: add default rules
iptables: update rules for ip6tables
iptables: update init script and bb file

 .../iptables/iptables/ip6tables.rules              |  31 ++
 .../iptables/iptables/iptables-config              |  54 +++
 .../iptables/iptables/iptables.init                | 445 +++++++++++++++++++++
 .../iptables/iptables/iptables.rules               |  30 ++
 meta/recipes-extended/iptables/iptables_1.4.21.bb  |  27 +-
 5 files changed, 586 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-extended/iptables/iptables/ip6tables.rules
 create mode 100644 meta/recipes-extended/iptables/iptables/iptables-config
 create mode 100755 meta/recipes-extended/iptables/iptables/iptables.init
 create mode 100644 meta/recipes-extended/iptables/iptables/iptables.rules

Signature · 1 line

1.9.1

Kai Kang

author

2014-06-23 02:33 UTC #1 lore raw

PATCH 1/5 iptables: update RRECOMMENDS

Update RRECOMMENDS for iptables that some iptables basic rules need these kernel modules.

Signed-off-by Kai Kang <[email protected]>

---
 meta/recipes-extended/iptables/iptables_1.4.21.bb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

meta/recipes-extended/iptables/iptables_1.4.21.bb +7 -1

index dc17d57..ba4e8e4 100644
@@ -15,7 +15,13 @@ RRECOMMENDS_${PN} = "kernel-module-x-tables \
                      kernel-module-nf-conntrack \
                      kernel-module-nf-conntrack-ipv4 \
                      kernel-module-nf-nat \
-                     kernel-module-ipt-masquerade"
+                     kernel-module-ipt-masquerade \
+                     kernel-module-xt-tcpudp \
+                     kernel-module-xt-conntrack \
+                     kernel-module-ipt-reject \
+                     kernel-module-ip6-tables \
+                     kernel-module-ip6table-filter \
+                    "
 FILES_${PN} =+ "${libdir}/xtables/ ${datadir}/xtables"
 FILES_${PN}-dbg =+ "${libdir}/xtables/.debug"

Signature · 1 line

1.9.1

Kai Kang

author

2014-06-23 02:33 UTC #4 lore raw

PATCH 2/5 iptables: add init script and configure file

In reply to Kai Kang

Add init script and related configure file for iptables from RedHat 6 package iptables version 1.4.7.

Remove trailing white spaces.

Signed-off-by Kai Kang <[email protected]>

---
 .../iptables/iptables/iptables-config              |  54 +++
 .../iptables/iptables/iptables.init                | 445 +++++++++++++++++++++
 2 files changed, 499 insertions(+)
 create mode 100644 meta/recipes-extended/iptables/iptables/iptables-config
 create mode 100755 meta/recipes-extended/iptables/iptables/iptables.init

meta/recipes-extended/iptables/iptables/iptables-config new file +54 -0

new file mode 100644
index 0000000..d9f6c34
@@ -0,0 +1,54 @@
+# Load additional iptables modules (nat helpers)
+#   Default: -none-
+# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
+# are loaded after the firewall rules are applied. Options for the helpers are
+# stored in /etc/modprobe.conf.
+IPTABLES_MODULES=""
+
+# Unload modules on restart and stop
+#   Value: yes|no,  default: yes
+# This option has to be 'yes' to get to a sane state for a firewall
+# restart or stop. Only set to 'no' if there are problems unloading netfilter
+# modules.
+IPTABLES_MODULES_UNLOAD="yes"
+
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
+# (e.g. on system shutdown).
+IPTABLES_SAVE_ON_STOP="no"
+
+# Save current firewall rules on restart.
+#   Value: yes|no,  default: no
+# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
+# restarted.
+IPTABLES_SAVE_ON_RESTART="no"
+
+# Save (and restore) rule and chain counter.
+#   Value: yes|no,  default: no
+# Save counters for rules and chains to /etc/sysconfig/iptables if
+# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
+# SAVE_ON_RESTART is enabled.
+IPTABLES_SAVE_COUNTER="no"
+
+# Numeric status output
+#   Value: yes|no,  default: yes
+# Print IP addresses and port numbers in numeric format in the status output.
+IPTABLES_STATUS_NUMERIC="yes"
+
+# Verbose status output
+#   Value: yes|no,  default: yes
+# Print info about the number of packets and bytes plus the "input-" and
+# "outputdevice" in the status output.
+IPTABLES_STATUS_VERBOSE="no"
+
+# Status output with numbered lines
+#   Value: yes|no,  default: yes
+# Print a counter/number for every rule in the status output.
+IPTABLES_STATUS_LINENUMBERS="yes"
+
+# Reload sysctl settings on start and restart
+#   Default: -none-
+# Space separated list of sysctl items which are to be reloaded on start.
+# List items will be matched by fgrep.
+#IPTABLES_SYSCTL_LOAD_LIST=".nf_conntrack .bridge-nf"

meta/recipes-extended/iptables/iptables/iptables.init new file +445 -0

445 lines not on this page · raw message

Signature · 1 line

1.9.1

Kai Kang

author

2014-06-23 02:33 UTC #5 lore raw

PATCH 3/5 iptables: add default rules

In reply to Kai Kang

Add default rule files for iptable/ip6tables from RHEL 5.8.

Signed-off-by Kai Kang <[email protected]>

---
 .../iptables/iptables/ip6tables.rules              | 31 ++++++++++++++++++++++
 .../iptables/iptables/iptables.rules               | 30 +++++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 meta/recipes-extended/iptables/iptables/ip6tables.rules
 create mode 100644 meta/recipes-extended/iptables/iptables/iptables.rules

meta/recipes-extended/iptables/iptables/ip6tables.rules new file +31 -0

new file mode 100644
index 0000000..bdd52ed
@@ -0,0 +1,31 @@
+# Firewall configuration written by system-config-securitylevel
+# Manual customization of this file is not recommended.
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:RH-Firewall-1-INPUT - [0:0]
+-A INPUT -j RH-Firewall-1-INPUT
+-A FORWARD -j RH-Firewall-1-INPUT
+-A RH-Firewall-1-INPUT -i lo -j ACCEPT
+-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
+-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
+-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
+-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT
+-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 23 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 21 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT
+-A RH-Firewall-1-INPUT -m udp -p udp --dport 137 -j ACCEPT
+-A RH-Firewall-1-INPUT -m udp -p udp --dport 138 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 139 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 445 -j ACCEPT
+-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 2049 -j ACCEPT
+-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
+COMMIT

meta/recipes-extended/iptables/iptables/iptables.rules new file +30 -0

new file mode 100644
index 0000000..3d92ee0
@@ -0,0 +1,30 @@
+# Firewall configuration written by system-config-securitylevel
+# Manual customization of this file is not recommended.
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:RH-Firewall-1-INPUT - [0:0]
+-A INPUT -j RH-Firewall-1-INPUT
+-A FORWARD -j RH-Firewall-1-INPUT
+-A RH-Firewall-1-INPUT -i lo -j ACCEPT
+-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
+-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
+-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
+-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
+-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 23 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT
+-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
+COMMIT

Signature · 1 line

1.9.1

Kai Kang

author

2014-06-23 02:33 UTC #10 lore raw

PATCH 4/5 iptables: update rules for ip6tables

In reply to Kai Kang

ip6tables doesn't recognize target REJECT, then use DROP instead.

Signed-off-by Kai Kang <[email protected]>

---
 meta/recipes-extended/iptables/iptables/ip6tables.rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

meta/recipes-extended/iptables/iptables/ip6tables.rules +1 -1

index bdd52ed..1045e41 100644
@@ -27,5 +27,5 @@
 -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 139 -j ACCEPT
 -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 445 -j ACCEPT
 -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 2049 -j ACCEPT
--A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited
+-A RH-Firewall-1-INPUT -j DROP
 COMMIT

Signature · 1 line

1.9.1

Kai Kang

author

2014-06-23 02:33 UTC #11 lore raw

PATCH 5/5 iptables: update init script and bb file

In reply to Kai Kang

Update path of command iptables in init script that we put it in /usr/sbin rather than /sbin. Then update bb file to install init script, configure and rules files.

Signed-off-by Kai Kang <[email protected]>

---
 meta/recipes-extended/iptables/iptables/iptables.init |  4 ++--
 meta/recipes-extended/iptables/iptables_1.4.21.bb     | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

meta/recipes-extended/iptables/iptables/iptables.init +2 -2

index 01057dd..3f9ce23 100755
@@ -33,8 +33,8 @@ VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
 # only usable for root
 [ $EUID = 0 ] || exit 4
 
-if [ ! -x /sbin/$IPTABLES ]; then
-    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
+if [ ! -x /usr/sbin/$IPTABLES ]; then
+    echo -n $"${IPTABLES}: /usr/sbin/$IPTABLES does not exist."; warning; echo
     exit 5
 fi

meta/recipes-extended/iptables/iptables_1.4.21.bb +19 -0

index ba4e8e4..a6fe55f 100644
@@ -28,6 +28,10 @@ FILES_${PN}-dbg =+ "${libdir}/xtables/.debug"
 SRC_URI = "http://netfilter.org/projects/iptables/files/iptables-${PV}.tar.bz2 \
            file://types.h-add-defines-that-are-required-for-if_packet.patch \
            file://0001-configure-Add-option-to-enable-disable-libnfnetlink.patch \
+           file://iptables.init \
+           file://iptables-config \
+           file://iptables.rules \
+           file://ip6tables.rules \
           "
 
 SRC_URI[md5sum] = "536d048c8e8eeebcd9757d0863ebb0c0"

@@ -50,3 +54,18 @@ do_configure_prepend() {
 	# Keep ax_check_linker_flags.m4 which belongs to autoconf-archive.
 	rm -f libtool.m4 lt~obsolete.m4 ltoptions.m4 ltsugar.m4 ltversion.m4
 }
+
+do_install_append() {
+	install -d -m 755 ${D}${sysconfdir}/init.d
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/iptables
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/ip6tables
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/init.d/ip6tables
+
+	install -d -m 755 ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig/ip6tables-config
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/sysconfig/ip6tables-config
+
+	install -m 755 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/sysconfig/iptables
+	install -m 755 ${WORKDIR}/ip6tables.rules ${D}${sysconfdir}/sysconfig/ip6tables
+}

Signature · 1 line

1.9.1

Burton, Ross

2014-06-23 10:42 UTC #6 lore raw

Re: [PATCH 3/5] iptables: add default rules

In reply to Kai Kang

Review

Quoted 2 lines · Kai Kang

(quoted diff) +2 -0

+# Firewall configuration written by system-config-securitylevel
+# Manual customization of this file is not recommended.

That's just going to be confusing to anyone who doesn't know that this file was copied directly from RedHat.

Also, is it sensible to ship a static firewall configuration? The one thing we're not is one-size-fits-all.

Ross

Burton, Ross

2014-06-23 10:44 UTC #16 lore raw

In reply to Kai Kang

Quoted 4 lines

Kai Kang (5):
iptables: update RRECOMMENDS
iptables: add init script and configure file
iptables: update init script and bb file

Squash these so there's a single commit that adds and integrates a working init script.

Quoted 2 lines

iptables: add default rules
iptables: update rules for ip6tables

Ditto, squash these into a single commit.

Ross

Anders Darander

2014-06-23 11:44 UTC #12 lore raw

Re: [PATCH 5/5] iptables: update init script and bb file

In reply to Kai Kang

Quoted 3 lines · Kai Kang

Update path of command iptables in init script that we put it in /usr/sbin rather than /sbin. Then update bb file to install init script, configure and rules files.

These new files aren't that big, but could you anyway package at least the rules files into a separate package? Using an RRECOMMENDS would be fine, as I can easily add a BAD_RECOMMENDATION for that package.

It might be that I don't need/want both of iptables and ip6tables installed; or even that I don't want either of those installed by default.

Cheers,
Anders

Quoted 14 lines

meta/recipes-extended/iptables/iptables_1.4.21.bb +14 -0

+do_install_append() {
+	install -d -m 755 ${D}${sysconfdir}/init.d
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/iptables
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/ip6tables
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/init.d/ip6tables
+
+	install -d -m 755 ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig/ip6tables-config
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/sysconfig/ip6tables-config
+
+	install -m 755 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/sysconfig/iptables
+	install -m 755 ${WORKDIR}/ip6tables.rules ${D}${sysconfdir}/sysconfig/ip6tables
+}

Signature · 2 lines

Anders Darander
ChargeStorm AB / eStorm AB

Kang Kai

author

2014-06-24 01:38 UTC #7 lore raw

Re: [PATCH 3/5] iptables: add default rules

In reply to Burton, Ross

Quoted 5 lines · Ross

Review
Quoted 2 lines · Kai Kang
(quoted diff) +2 -0
+# Firewall configuration written by system-config-securitylevel
+# Manual customization of this file is not recommended.
That's just going to be confusing to anyone who doesn't know that this file was copied directly from RedHat.

OK, I'll remove them.

Quoted 3 lines

Also, is it sensible to ship a static firewall configuration? The one thing we're not is one-size-fits-all.

I just want users could start iptables without any professional work. And these static firewall rules are common for desktop/server.
Or does the empty rule is better? Anyone who wants to use iptables writes his/her own rules. But it is a little difficult for the people who not familiar with iptables.

Any suggestion?

Thanks,
Kai

Quoted 4 lines

Ross

Signature · 2 lines

Regards,
Neil | Kai Kang

Kang Kai

author

2014-06-24 01:49 UTC #13 lore raw

Re: [PATCH 5/5] iptables: update init script and bb file

In reply to Anders Darander

Quoted 7 lines · Anders Darander

Quoted 3 lines · Kai Kang
Update path of command iptables in init script that we put it in /usr/sbin rather than /sbin. Then update bb file to install init script, configure and rules files.
These new files aren't that big, but could you anyway package at least the rules files into a separate package? Using an RRECOMMENDS would be fine, as I can easily add a BAD_RECOMMENDATION for that package.

Of course.

And as I replied in last main, do you think that an empty rule is better? A little concern is for iptables newbies.

Quoted 4 lines

It might be that I don't need/want both of iptables and ip6tables installed; or even that I don't want either of those installed by default.

iptables and ip6tables are not split into separated packages, so I put them together. And package iptbales is not installed by default indeed.

Regards,
Kai

Quoted 18 lines

Cheers,
Anders

Quoted 14 lines

meta/recipes-extended/iptables/iptables_1.4.21.bb +14 -0

+do_install_append() {
+	install -d -m 755 ${D}${sysconfdir}/init.d
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/iptables
+	install -m 755 ${WORKDIR}/iptables.init ${D}${sysconfdir}/init.d/ip6tables
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/init.d/ip6tables
+
+	install -d -m 755 ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig
+	install -m 755 ${WORKDIR}/iptables-config ${D}${sysconfdir}/sysconfig/ip6tables-config
+	sed -i -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' ${D}${sysconfdir}/sysconfig/ip6tables-config
+
+	install -m 755 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/sysconfig/iptables
+	install -m 755 ${WORKDIR}/ip6tables.rules ${D}${sysconfdir}/sysconfig/ip6tables
+}

Signature · 2 lines

Regards,
Neil | Kai Kang

Kang Kai

author

2014-06-24 01:57 UTC #17 lore raw

In reply to Burton, Ross

Quoted 6 lines · Ross

Quoted 4 lines
Kai Kang (5):
iptables: update RRECOMMENDS
iptables: add init script and configure file
iptables: update init script and bb file
Squash these so there's a single commit that adds and integrates a working init script.

Though there is small change for init script, I still want to keep it that make clear which part is our modification.

I prefer to squash

iptables: update RRECOMMENDS
iptables: update init script and bb file

and keep
iptables: add init script and configure file

Quoted 4 lines

Quoted 3 lines
iptables: add default rules
iptables: update rules for ip6tables
Ditto, squash these into a single commit.

I prefer to keep them too.

Regards,
Kai

Quoted 4 lines

Ross

Signature · 2 lines

Regards,
Neil | Kai Kang

Anders Darander

2014-06-24 06:01 UTC #14 lore raw

Re: [PATCH 5/5] iptables: update init script and bb file

In reply to Kang Kai

Quoted 5 lines · Kang Kai

Quoted 4 lines · Anders Darander
Quoted 3 lines · Kai Kang
Update path of command iptables in init script that we put it in /usr/sbin rather than /sbin. Then update bb file to install init script, configure and rules files.

Quoted 8 lines

Quoted 3 lines
These new files aren't that big, but could you anyway package at least the rules files into a separate package? Using an RRECOMMENDS would be fine, as I can easily add a BAD_RECOMMENDATION for that package.
Of course.
And as I replied in last main, do you think that an empty rule is better? A little concern is for iptables newbies.

Well, I'd be at lest a little bit happier to have the ipv6 rules file obey the ipv6 distro feature, see below.

Besides, most users of OE-Core won't have any benefit of a pre-generated iptable rules file. Remember, we're building embedded devices that have everything but a standard setup.

If you want a static firewall configuration supplied by oe-core, can't we package it in a separate package anyway?

Quoted 6 lines

Quoted 3 lines
It might be that I don't need/want both of iptables and ip6tables installed; or even that I don't want either of those installed by default.
iptables and ip6tables are not split into separated packages, so I put them together. And package iptbales is not installed by default indeed.

No, but at least we're not building IPv6 support into the package if ipv6 is not set in DISTRO_FEATURES. At the very least, the ip6tables rule file should obey that DISTRO_FEATUR also.

Cheers,
Anders

Signature · 2 lines

Naeser's Law:
	You can make it foolproof, but you can't make it damnfoolproof.

Anders Darander

2014-06-24 06:06 UTC #8 lore raw

Re: [PATCH 3/5] iptables: add default rules

In reply to Kang Kai

Quoted 8 lines · Kang Kai

Quoted 3 lines · Ross
On 23 June 2014 03:32, Kai Kang <[email protected]> wrote:
Also, is it sensible to ship a static firewall configuration? The one thing we're not is one-size-fits-all.
I just want users could start iptables without any professional work. And these static firewall rules are common for desktop/server. Or does the empty rule is better?

If these rules are common for a desktop/server, do they make sense here? Or should a simplified rule set be your example configuration in that case?

Cheers,
Anders

Signature · 2 lines

Anders Darander
ChargeStorm AB / eStorm AB

Anders Darander

2014-06-24 06:11 UTC #2 lore raw

Re: [PATCH 1/5] iptables: update RRECOMMENDS

In reply to Kai Kang

meta/recipes-extended/iptables/iptables_1.4.21.bb RRECOMMENDS_${PN} = "kernel-module-x-tables \ · line 24

Quoted 12 lines · Kai Kang

meta/recipes-extended/iptables/iptables_1.4.21.bb +7 -1

@@ -15,7 +15,13 @@ RRECOMMENDS_${PN} = "kernel-module-x-tables \
                      kernel-module-nf-conntrack \
                      kernel-module-nf-conntrack-ipv4 \
                      kernel-module-nf-nat \
-                     kernel-module-ipt-masquerade"
+                     kernel-module-ipt-masquerade \
+                     kernel-module-xt-tcpudp \
+                     kernel-module-xt-conntrack \
+                     kernel-module-ipt-reject \
+                     kernel-module-ip6-tables \
+                     kernel-module-ip6table-filter \
+                    "

As it's for RRECOMMENDS_${PN} your patch will likely work for everyong. Though, you should really only add the ip6* kernel modules if ipv6 is in DISTRO_FEATURES.

Cheers,
Anders

(And as a completely unrelated side note, I wonder if it isn't time to start looking at adding an ipv4 DISTRO_FEATURE to make it easier to build IPv6 only devices...)

Signature · 2 lines

Anders Darander
ChargeStorm AB / eStorm AB

Kang Kai

author

2014-06-25 06:28 UTC #3 lore raw

Re: [PATCH 1/5] iptables: update RRECOMMENDS

Quoted 17 lines · Anders Darander

meta/recipes-extended/iptables/iptables_1.4.21.bb RRECOMMENDS_${PN} = "kernel-module-x-tables \ · line 24
Quoted 12 lines · Kai Kang
meta/recipes-extended/iptables/iptables_1.4.21.bb +7 -1
@@ -15,7 +15,13 @@ RRECOMMENDS_${PN} = "kernel-module-x-tables \
                       kernel-module-nf-conntrack \
                       kernel-module-nf-conntrack-ipv4 \
                       kernel-module-nf-nat \
-                     kernel-module-ipt-masquerade"
+                     kernel-module-ipt-masquerade \
+                     kernel-module-xt-tcpudp \
+                     kernel-module-xt-conntrack \
+                     kernel-module-ipt-reject \
+                     kernel-module-ip6-tables \
+                     kernel-module-ip6table-filter \
+                    "
As it's for RRECOMMENDS_${PN} your patch will likely work for everyong. Though, you should really only add the ip6* kernel modules if ipv6 is in DISTRO_FEATURES.

OK.

Thanks,
Kai

Quoted 8 lines

Cheers,
Anders
(And as a completely unrelated side note, I wonder if it isn't time to start looking at adding an ipv4 DISTRO_FEATURE to make it easier to build IPv6 only devices...)

Signature · 2 lines

Regards,
Neil | Kai Kang

Kang Kai

author

2014-06-25 06:43 UTC #9 lore raw

Re: [PATCH 3/5] iptables: add default rules

In reply to Anders Darander

Quoted 6 lines · Anders Darander

Quoted 4 lines · Kang Kai
Quoted 3 lines · Ross
On 23 June 2014 03:32, Kai Kang <[email protected]> wrote:
Also, is it sensible to ship a static firewall configuration? The one thing we're not is one-size-fits-all.

Quoted 6 lines

Quoted 3 lines
I just want users could start iptables without any professional work. And these static firewall rules are common for desktop/server. Or does the empty rule is better?
If these rules are common for a desktop/server, do they make sense here? Or should a simplified rule set be your example configuration in that case?

I am thinking put a configure file there without any special rule that allows every input and output. Users could update it with their rules.

Regards,
Kai

Quoted 4 lines

Cheers,
Anders

Signature · 2 lines

Regards,
Neil | Kai Kang

Kang Kai

author

2014-06-25 06:46 UTC #15 lore raw

Re: [PATCH 5/5] iptables: update init script and bb file

In reply to Anders Darander

Quoted 16 lines · Anders Darander

Quoted 11 lines · Kang Kai
Quoted 7 lines · Anders Darander
Quoted 3 lines · Kai Kang
Update path of command iptables in init script that we put it in /usr/sbin rather than /sbin. Then update bb file to install init script, configure and rules files.
These new files aren't that big, but could you anyway package at least the rules files into a separate package? Using an RRECOMMENDS would be fine, as I can easily add a BAD_RECOMMENDATION for that package.
Of course.
And as I replied in last main, do you think that an empty rule is better? A little concern is for iptables newbies.
Well, I'd be at lest a little bit happier to have the ipv6 rules file obey the ipv6 distro feature, see below.

Quoted 6 lines

Besides, most users of OE-Core won't have any benefit of a pre-generated iptable rules file. Remember, we're building embedded devices that have everything but a standard setup.
If you want a static firewall configuration supplied by oe-core, can't we package it in a separate package anyway?

OK.

Quoted 9 lines

Quoted 6 lines
Quoted 4 lines
It might be that I don't need/want both of iptables and ip6tables installed; or even that I don't want either of those installed by default.
iptables and ip6tables are not split into separated packages, so I put them together. And package iptbales is not installed by default indeed.
No, but at least we're not building IPv6 support into the package if ipv6 is not set in DISTRO_FEATURES. At the very least, the ip6tables rule file should obey that DISTRO_FEATUR also.

I'll update to check DISTRO_FEATURES for ipv6 supports.

Regards,
Kai

Quoted 4 lines

Cheers,
Anders

Signature · 2 lines

Regards,
Neil | Kai Kang