OpenWRT
/
packages
mirror of https://github.com/openwrt/packages.git
1
0
Fork 0
Code Issues Releases Wiki Activity

bcp38: clean up nft rule handling 

Quote interface names when creating nft rules and use destroy table for idempotent cleanup.

Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
pull/30275/head
Dharmik Parmar 2026-06-28 07:30:15 +05:30 committed by Hannu Nyman
parent 7cb0c183a9
commit c11ef37d55
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/bcp38/Makefile
View File

@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=bcp38
PKG_VERSION:=5
PKG_RELEASE:=12
PKG_RELEASE:=13
PKG_LICENSE:=GPL-3.0-or-later
include $(INCLUDE_DIR)/package.mk

8
net/bcp38/files/run.sh
View File

@ -86,8 +86,8 @@ setup_chains()
nft flush chain "$FAMILY" "$TABLE" "$CHAIN" 2>/dev/null
nft add rule "$FAMILY" "$TABLE" "$CHAIN" udp sport . udp dport { 68 . 67, 67 . 68 } counter return comment \"always accept DHCP traffic\"
nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname $interface ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable
nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname $interface ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop
nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname "$interface" ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable
nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname "$interface" ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop
nft add chain "$FAMILY" "$TABLE" input "{ type filter hook input priority $priority; policy accept; comment \"bcp38 filter\"; }"
nft add chain "$FAMILY" "$TABLE" forward "{ type filter hook forward priority $priority; policy accept; comment \"bcp38 filter\"; }"
@ -101,8 +101,8 @@ setup_chains()
destroy_table()
{
if [ "$TABLE" != "fw4" ]; then
#as of kernel 3.18 we can delete a table without need to flush it
nft delete table "$FAMILY" "$TABLE" 2>/dev/null
# Delete the table if it exists.
nft destroy table "$FAMILY" "$TABLE" 2>/dev/null
fi
}