From 445682c07d0669984f2cc8acb1fba5e1a5e3bc27 Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Thu, 12 Apr 2018 17:57:44 +0200 Subject: [PATCH] base-files: move netfilter sysctl defaults to specific kmod packages Avoid warnings when applying settings for uninstalled kmods. See also FS#1073. Signed-off-by: Matthias Schiffer --- package/base-files/Makefile | 2 +- .../base-files/files/etc/sysctl.d/10-default.conf | 12 ------------ package/kernel/linux/files/sysctl-br-netfilter.conf | 7 +++++++ package/kernel/linux/files/sysctl-nf-conntrack.conf | 9 +++++++++ package/kernel/linux/modules/netfilter.mk | 10 ++++++++++ 5 files changed, 27 insertions(+), 13 deletions(-) create mode 100644 package/kernel/linux/files/sysctl-br-netfilter.conf create mode 100644 package/kernel/linux/files/sysctl-nf-conntrack.conf diff --git a/package/base-files/Makefile b/package/base-files/Makefile index 37f0e1e2fd..f35b4db79b 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk include $(INCLUDE_DIR)/feeds.mk PKG_NAME:=base-files -PKG_RELEASE:=186 +PKG_RELEASE:=187 PKG_FLAGS:=nonshared PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/ diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf index 7c3344dba3..98867b7c7b 100644 --- a/package/base-files/files/etc/sysctl.d/10-default.conf +++ b/package/base-files/files/etc/sysctl.d/10-default.conf @@ -20,15 +20,3 @@ net.ipv4.tcp_dsack=1 net.ipv6.conf.default.forwarding=1 net.ipv6.conf.all.forwarding=1 - -net.netfilter.nf_conntrack_acct=1 -net.netfilter.nf_conntrack_checksum=0 -net.netfilter.nf_conntrack_max=16384 -net.netfilter.nf_conntrack_tcp_timeout_established=7440 -net.netfilter.nf_conntrack_udp_timeout=60 -net.netfilter.nf_conntrack_udp_timeout_stream=180 - -# disable bridge firewalling by default -net.bridge.bridge-nf-call-arptables=0 -net.bridge.bridge-nf-call-ip6tables=0 -net.bridge.bridge-nf-call-iptables=0 diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf new file mode 100644 index 0000000000..b10ddc0874 --- /dev/null +++ b/package/kernel/linux/files/sysctl-br-netfilter.conf @@ -0,0 +1,7 @@ +# Do not edit, changes to this file will be lost on upgrades +# /etc/sysctl.conf can be used to customize sysctl settings + +# disable bridge firewalling by default +net.bridge.bridge-nf-call-arptables=0 +net.bridge.bridge-nf-call-ip6tables=0 +net.bridge.bridge-nf-call-iptables=0 diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf new file mode 100644 index 0000000000..37baf5fd6f --- /dev/null +++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf @@ -0,0 +1,9 @@ +# Do not edit, changes to this file will be lost on upgrades +# /etc/sysctl.conf can be used to customize sysctl settings + +net.netfilter.nf_conntrack_acct=1 +net.netfilter.nf_conntrack_checksum=0 +net.netfilter.nf_conntrack_max=16384 +net.netfilter.nf_conntrack_tcp_timeout_established=7440 +net.netfilter.nf_conntrack_udp_timeout=60 +net.netfilter.nf_conntrack_udp_timeout_stream=180 diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk index 99c24cc042..51f3544ed6 100644 --- a/package/kernel/linux/modules/netfilter.mk +++ b/package/kernel/linux/modules/netfilter.mk @@ -101,6 +101,11 @@ define KernelPackage/nf-conntrack AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m))) endef +define KernelPackage/nf-conntrack/install + $(INSTALL_DIR) $(1)/etc/sysctl.d + $(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf +endef + $(eval $(call KernelPackage,nf-conntrack)) @@ -774,6 +779,11 @@ define KernelPackage/br-netfilter AUTOLOAD:=$(call AutoProbe,br_netfilter) endef +define KernelPackage/br-netfilter/install + $(INSTALL_DIR) $(1)/etc/sysctl.d + $(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf +endef + $(eval $(call KernelPackage,br-netfilter)) -- 2.25.1