diff options
| author | Toke Høiland-Jørgensen <toke@toke.dk> | 2022-03-30 12:54:51 +0200 |
|---|---|---|
| committer | Rosen Penev <rosenp@gmail.com> | 2022-05-20 13:16:59 -0700 |
| commit | d926da5182a4547e5248dad3e3e59abcd41d126f (patch) | |
| tree | 3f4d78e4a3fe431502d2fbdc2968b39702381525 /net/acme | |
| parent | 1d54defb0fe7a964a19e3aa36e35a8159bcc2262 (diff) | |
acme: switch from iptables to nft
Use nft instead of iptables to open port 80 in the firewall when getting a
cert. Since nft doesn't allow deleting a rule by its contents, capture and
save the handle when creating the rule, and use that to delete.
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Diffstat (limited to 'net/acme')
| -rw-r--r-- | net/acme/files/run.sh | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/net/acme/files/run.sh b/net/acme/files/run.sh index 252276fef..615cbf22a 100644 --- a/net/acme/files/run.sh +++ b/net/acme/files/run.sh @@ -21,6 +21,7 @@ NGINX_WEBSERVER=0 UPDATE_NGINX=0 UPDATE_UHTTPD=0 UPDATE_HAPROXY=0 +NFT_HANDLE= USER_CLEANUP= . /lib/functions.sh @@ -126,19 +127,17 @@ pre_checks() { esac done - iptables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1 - ip6tables -I input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" || return 1 - debug "v4 input_rule: $(iptables -nvL input_rule)" - debug "v6 input_rule: $(ip6tables -nvL input_rule)" + NFT_HANDLE=$(nft -a -e insert rule inet fw4 input tcp dport 80 counter accept comment ACME | grep -o 'handle [0-9]\+') + ret=$? + [ "$ret" -eq "0" ] || return 1 + debug "added nft rule: $NFT_HANDLE" return 0 } post_checks() { log "Running post checks (cleanup)." - # The comment ensures we only touch our own rules. If no rules exist, that - # is fine, so hide any errors - iptables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2> /dev/null - ip6tables -D input_rule -p tcp --dport 80 -j ACCEPT -m comment --comment "ACME" 2> /dev/null + # $NFT_HANDLE contains the string 'handle XX' so pass it unquoted to nft + [ -n "$NFT_HANDLE" ] && nft delete rule inet fw4 input $NFT_HANDLE if [ -e /etc/init.d/uhttpd ] && { [ -n "$UHTTPD_LISTEN_HTTP" ] || [ "$UPDATE_UHTTPD" -eq 1 ]; }; then if [ -n "$UHTTPD_LISTEN_HTTP" ]; then |