[arch-commits] Commit in nftables/trunk (4 files)

[Sébastien Luttringer]

    Date: Sunday, July 4, 2021 @ 07:58:30
  Author: seblu
Revision: 418915

upgpkg: nftables 1:0.9.9-2

- Do not flush the (whole) ruleset in systemd service. This prevent service reload/restart to remove tables not defined in the config file (like those by docker, firewalld, sshguard).
- Cleanup table before defining it in default config. This allow the rules to be reloaded. See official examples in /usr/share/nftables or /usr/share/doc/nftables/examples.
- Use names in filter priority in default config.
- Count input dropped packets in default config.
- Add drop policy for forward chain in default config.
- Remove the empty output chain in default config.

Added:
  nftables/trunk/nftables.install
Modified:
  nftables/trunk/PKGBUILD
  nftables/trunk/nftables.conf
  nftables/trunk/nftables.service

------------------+
 PKGBUILD         |    7 ++++---
 nftables.conf    |   19 ++++++++++---------
 nftables.install |   10 ++++++++++
 nftables.service |    3 ---
 4 files changed, 24 insertions(+), 15 deletions(-)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2021-07-03 22:57:35 UTC (rev 418914)
+++ PKGBUILD	2021-07-04 07:58:30 UTC (rev 418915)
@@ -3,7 +3,7 @@
 pkgname=nftables
 epoch=1
 pkgver=0.9.9
-pkgrel=1
+pkgrel=2
 pkgdesc='Netfilter tables userspace tools'
 arch=('x86_64')
 url='https://netfilter.org/projects/nftables/'
@@ -16,10 +16,11 @@
 source=("https://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
         'nftables.conf'
         'nftables.service')
+install=nftables.install
 sha256sums=('76ef2dc7fd0d79031a8369487739a217ca83996b3a746cec5bda79da11e3f1b4'
             'SKIP'
-            '7b00611bb0533ca2f4abce14e22e9de39c344e241d4eae884c5e594d1b1ce8df'
-            '3c6a34a400022450df0b6e97b3f16eea5cab7741a0e5f16858b46a3e6591b5af')
+            '9a387cf2b467cc8c552301bd3da22e7a8a966c2c5bd04e90571c771fca9ffe3e'
+            'deffeef36fe658867dd9203ec13dec85047a6d224ea63334dcf60db97e1809ea')
 
 prepare() {
   cd $pkgname-$pkgver

Modified: nftables.conf
===================================================================
--- nftables.conf	2021-07-03 22:57:35 UTC (rev 418914)
+++ nftables.conf	2021-07-04 07:58:30 UTC (rev 418915)
@@ -1,7 +1,11 @@
 #!/usr/bin/nft -f
-# ipv4/ipv6 Simple & Safe Firewall
-# you can find examples in /usr/share/nftables/
+#vim:set ts=2 sw=2 et:
 
+# IPv4/IPv6 Simple & Safe firewall ruleset.
+# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
+
+table inet filter
+delete table inet filter
 table inet filter {
   chain input {
     type filter hook input priority 0;
@@ -24,15 +28,12 @@
 
     # everything else
     reject with icmpx type port-unreachable
+
+    # count dropped
+    counter
   }
   chain forward {
     type filter hook forward priority 0;
-    drop
+    policy drop
   }
-  chain output {
-    type filter hook output priority 0;
-  }
-
 }
-
-# vim:set ts=2 sw=2 et:

Added: nftables.install
===================================================================
--- nftables.install	                        (rev 0)
+++ nftables.install	2021-07-04 07:58:30 UTC (rev 418915)
@@ -0,0 +1,10 @@
+## arg 1:  the new package version
+## arg 2:  the old package version
+post_upgrade() {
+  (( $(vercmp "$2" '1:0.9.9-1') > 0 )) || cat <<EOF
+==> Stopping/restarting the nftables service does NOT flush the ruleset anymore.
+==> The nftables.conf file requires a delete/flush directive to be restarted.
+==> See examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples.
+==> The nftables service reload has been removed as it is now equivalent to a restart.
+EOF
+}

Modified: nftables.service
===================================================================
--- nftables.service	2021-07-03 22:57:35 UTC (rev 418914)
+++ nftables.service	2021-07-04 07:58:30 UTC (rev 418915)
@@ -7,9 +7,6 @@
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/nft -f /etc/nftables.conf
-ExecReload=/usr/bin/nft flush ruleset ';' include '"/etc/nftables.conf"'
-ExecStop=/usr/bin/nft flush ruleset
-RemainAfterExit=yes
 
 [Install]
 WantedBy=multi-user.target