Author: baggins Date: Tue Dec 29 21:09:51 2009 GMT
Module: firewall-init Tag: HEAD
---- Log message:
- reality check
- added generic_(un)load_modules
- updated ipv(4|5)_(un)load_modules for current kernels
---- Files affected:
firewall-init/firewall.d:
functions (1.15 -> 1.16)
---- Diffs:
================================================================
Index: firewall-init/firewall.d/functions
diff -u firewall-init/firewall.d/functions:1.15
firewall-init/firewall.d/functions:1.16
--- firewall-init/firewall.d/functions:1.15 Tue Dec 29 20:33:07 2009
+++ firewall-init/firewall.d/functions Tue Dec 29 22:09:46 2009
@@ -1,15 +1,59 @@
+generic_load_modules()
+{
+ typeset i conn b
+
+ _modprobe die -a x_tables
+ _modprobe die -a nf_conntrack \
+ `[ -z "$CONNTRACK_HASHSIZE" ] || echo
"expect_hashsize=$CONNTRACK_HASHSIZE"`
+
+ if [ "$CONNTRACK_MODULES" = "all" -o -z "$CONNTRACK_MODULES" ] ; then
+ conn=""
+ for i in /lib/modules/`uname
-r`/kernel/net/netfilter/nf_conntrack_*.ko{.gz,} ; do
+ if [ -f "$i" ]; then
+ for b in $CONNTRACK_MODULES_BLACKLIST ; do
+ if [[ "$i" = */nf_conntrack_$b.ko* ]];
then
+ i=
+ break
+ fi
+ done
+ if [ -n "$i" ]; then
+ i=${i%.ko(.gz|)}
+ conn="$conn ${i##*/}"
+ fi
+ fi
+ done
+ _modprobe die -a $conn
+ elif [ "$CONNTRACK_MODULES" != "none" ] ; then
+ conn=""
+ for i in $CONNTRACK_MODULES ; do
+ conn="$conn nf_conntrack_$i"
+ done
+ _modprobe die -a $conn
+ fi
+}
+
ipv4_load_modules()
{
typeset i conn
_modprobe die -a ip_tables
- _modprobe die -a ip_conntrack \
- `[ -z "$CONNTRACK_HASHSIZE" ] || echo
"hashsize=$CONNTRACK_HASHSIZE"`
+ _modprobe die -a nf_conntrack_ipv4
if [ "$CONNTRACK_MODULES" = "all" -o -z "$CONNTRACK_MODULES" ] ; then
conn=""
- for i in /lib/modules/`uname
-r`/kernel/net/ipv4/netfilter/ip_conntrack_*.{k,}o{.gz,} ; do
- [ -f "$i" ] && conn="$conn `echo $i | awk '!/ftp|irc|egg/ {
gsub(/.*\//,"") ; gsub(/\.[k]o(\.gz)$/,"") ; print $1 }'`"
+ for i in /lib/modules/`uname
-r`/kernel/net/ipv4/netfilter/ip_conntrack_*.ko{.gz,} ; do
+ if [ -f "$i" ]; then
+ for b in $CONNTRACK_MODULES_BLACKLIST ; do
+ if [[ "$i" = */ip_conntrack_$b.ko* ]]; then
+ i=
+ break
+ fi
+ done
+ if [ -n "$i" ]; then
+ i=${i%.ko(.gz|)}
+ conn="$conn ${i##*/}"
+ fi
+ fi
done
_modprobe die -a $conn
elif [ "$CONNTRACK_MODULES" != "none" ] ; then
@@ -23,8 +67,19 @@
if echo "$ipv4_TABLES" | awk '!/nat/ {exit 1}' ; then
if [ "$NAT_MODULES" = "all" -o -z "$NAT_MODULES" ] ; then
conn=""
- for i in /lib/modules/`uname
-r`/kernel/net/ipv4/netfilter/ip_nat_*.{k,}o{.gz,} ; do
- [ -f "$i" ] && conn="$conn `echo $i | awk '!/ftp|irc/ {
gsub(/.*\//,"") ; gsub(/\.[k]o(\.gz)$/,"") ; print $1 }'`"
+ for i in /lib/modules/`uname
-r`/kernel/net/ipv4/netfilter/nf_nat_*.ko{.gz,} ; do
+ if [ -f "$i" ]; then
+ for b in $NAT_MODULES_BLACKLIST ; do
+ if [[ "$i" = */nf_nat_$b.ko* ]]; then
+ i=
+ break
+ fi
+ done
+ if [ -n "$i" ]; then
+ i=${i%.ko(.gz|)}
+ conn="$conn ${i##*/}"
+ fi
+ fi
done
_modprobe die -a $conn
elif [ "$NAT_MODULES" != "none" ] ; then
@@ -40,6 +95,20 @@
ipv6_load_modules()
{
_modprobe die -a ip6_tables
+ _modprobe die -a nf_conntrack_ipv6
+}
+
+generic_remove_modules()
+{
+ typeset modules
+
+ modules="`lsmod | grep "^xt_" | cut -f 1 -d ' '`"
+ [ -n "$modules" ] && rmmod $modules
+ modules="`lsmod | grep "^nf_" | cut -f 1 -d ' '`"
+ [ -n "$modules" ] && rmmod $modules
+ modules="`lsmod | grep "^nfnetlink" | cut -f 1 -d ' '`"
+ [ -n "$modules" ] && rmmod $modules
+ rmmod x_tables
}
ipv4_remove_modules()
@@ -48,7 +117,7 @@
modules="`lsmod | grep "^ipt_" | cut -f 1 -d ' '`"
[ -n "$modules" ] && rmmod $modules
- modules="`lsmod | grep "^ip_nat_" | cut -f 1 -d ' '`"
+ modules="`lsmod | grep "^nf_nat_" | cut -f 1 -d ' '`"
[ -n "$modules" ] && rmmod $modules
modules="`lsmod | grep "^iptable_" | cut -f 1 -d ' '`"
[ -n "$modules" ] && rmmod $modules
@@ -231,4 +300,4 @@
}
# This must be last line !
-# vi:syntax=sh:ts=8:sw=4
+# vi:syntax=sh
================================================================
---- CVS-web:
http://cvs.pld-linux.org/cgi-bin/cvsweb.cgi/firewall-init/firewall.d/functions?r1=1.15&r2=1.16&f=u
_______________________________________________
pld-cvs-commit mailing list
[email protected]
http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit
