From c11ef37d558291d272ffe6afc857afa4fd538dd4 Mon Sep 17 00:00:00 2001 From: Dharmik Parmar Date: Sun, 28 Jun 2026 07:30:15 +0530 Subject: [PATCH] bcp38: clean up nft rule handling Quote interface names when creating nft rules and use destroy table for idempotent cleanup. Signed-off-by: Dharmik Parmar --- net/bcp38/Makefile | 2 +- net/bcp38/files/run.sh | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/net/bcp38/Makefile b/net/bcp38/Makefile index 099f202f17..499f6fb59a 100644 --- a/net/bcp38/Makefile +++ b/net/bcp38/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=bcp38 PKG_VERSION:=5 -PKG_RELEASE:=12 +PKG_RELEASE:=13 PKG_LICENSE:=GPL-3.0-or-later include $(INCLUDE_DIR)/package.mk diff --git a/net/bcp38/files/run.sh b/net/bcp38/files/run.sh index 4c4f185da2..54acc58c41 100755 --- a/net/bcp38/files/run.sh +++ b/net/bcp38/files/run.sh @@ -86,8 +86,8 @@ setup_chains() nft flush chain "$FAMILY" "$TABLE" "$CHAIN" 2>/dev/null nft add rule "$FAMILY" "$TABLE" "$CHAIN" udp sport . udp dport { 68 . 67, 67 . 68 } counter return comment \"always accept DHCP traffic\" - nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname $interface ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable - nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname $interface ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop + nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname "$interface" ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable + nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname "$interface" ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop nft add chain "$FAMILY" "$TABLE" input "{ type filter hook input priority $priority; policy accept; comment \"bcp38 filter\"; }" nft add chain "$FAMILY" "$TABLE" forward "{ type filter hook forward priority $priority; policy accept; comment \"bcp38 filter\"; }" @@ -101,8 +101,8 @@ setup_chains() destroy_table() { if [ "$TABLE" != "fw4" ]; then - #as of kernel 3.18 we can delete a table without need to flush it - nft delete table "$FAMILY" "$TABLE" 2>/dev/null + # Delete the table if it exists. + nft destroy table "$FAMILY" "$TABLE" 2>/dev/null fi }