mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/iptables: optionally default to nftables compat

Browse Source 
For an nftables-based firewall setup it may be desirable to use
iptables-nft as the "iptables" binary, in particular to better
integrate legacy applications that do not support nftables directly
and call iptables. If the BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT option
introduced by this patch is enabled, iptables, iptables-restore, and
iptables-save are symlinked to the -nft version of iptables. The
-legacy options can still be called directly if desired.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Fiona Klute (WIWA)
2025-02-17 16:31:23 +01:00
committed by Julien Olivain
parent a639e31268
commit 2625440614
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
package/iptables/Config.in
View File

@@ -24,6 +24,18 @@ config BR2_PACKAGE_IPTABLES_NFTABLES
help
Build nftables compat utilities.
if BR2_PACKAGE_IPTABLES_NFTABLES
config BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT
bool "use nftables compat by default"
help
Make the nftables compat variant of iptables, iptables-save,
and iptables-restore the default. This only adjusts symlinks
in /usr/sbin, the legacy variants can still be called
directly.
endif
comment "nftables compat needs a toolchain w/ wchar, dynamic library, headers >= 3.12"
depends on !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12 || \
!BR2_USE_WCHAR || BR2_STATIC_LIBS

12
package/iptables/iptables.mk
View File

@@ -62,4 +62,16 @@ define IPTABLES_INSTALL_INIT_SYSV
touch $(TARGET_DIR)/etc/iptables.conf
endef
ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT),y)
define IPTABLES_MAKE_NFTABLES_DEFAULT
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables-restore
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/iptables-save
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables-restore
ln -sf xtables-nft-multi $(TARGET_DIR)/usr/sbin/ip6tables-save
endef
IPTABLES_POST_INSTALL_TARGET_HOOKS += IPTABLES_MAKE_NFTABLES_DEFAULT
endif
$(eval $(autotools-package))