meta-google: nftables-systemd: Parse rules in a useful order
We want to make sure rules get parsed in a sensible order, following a
sorting order similar to systemd units.
Change-Id: Ica06c953dba793d89d50c6b4cfc8e8a2eb1f58de
Signed-off-by: William A. Kennington III <wak@google.com>
diff --git a/meta-google/recipes-google/nftables/files/nft-configure.sh b/meta-google/recipes-google/nftables/files/nft-configure.sh
new file mode 100644
index 0000000..a82c282
--- /dev/null
+++ b/meta-google/recipes-google/nftables/files/nft-configure.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+shopt -s nullglob
+declare -A basemap=()
+i=0
+for dir in /run/nftables /etc/nftables /usr/share/nftables; do
+ for file in "$dir"/*.rules; do
+ basemap["${file##*/}$i"]="$file"
+ done
+ let i+=1
+done
+rc=0
+for key in $(printf "%s\n" "${!basemap[@]}" | sort -r); do
+ echo "Executing ${basemap[$key]}" >&2
+ nft -f "${basemap[$key]}" || rc=$?
+done
+exit $rc
diff --git a/meta-google/recipes-google/nftables/files/nftables.service b/meta-google/recipes-google/nftables/files/nftables.service
index 3830988..79f0bb5 100644
--- a/meta-google/recipes-google/nftables/files/nftables.service
+++ b/meta-google/recipes-google/nftables/files/nftables.service
@@ -4,7 +4,7 @@
[Service]
Type=oneshot
RemainAfterExit=yes
-ExecStart=/bin/bash -c 'shopt -s nullglob; echo /etc/nftables/*.rules | xargs -r -n 1 nft -f'
+ExecStart=/usr/libexec/nft-configure.sh
ExecStop=/bin/bash -c 'nft flush ruleset'
[Install]
diff --git a/meta-google/recipes-google/nftables/nftables-systemd.bb b/meta-google/recipes-google/nftables/nftables-systemd.bb
index 03694c8..f4109dd 100644
--- a/meta-google/recipes-google/nftables/nftables-systemd.bb
+++ b/meta-google/recipes-google/nftables/nftables-systemd.bb
@@ -8,7 +8,11 @@
inherit systemd
-SRC_URI += "file://nftables.service"
+SRC_URI += " \
+ file://nft-configure.sh \
+ file://nftables.service \
+ "
+
SYSTEMD_SERVICE_${PN} += "nftables.service"
RDEPENDS_${PN} += " \
@@ -17,6 +21,9 @@
"
do_install() {
- install -d ${D}${systemd_system_unitdir}
- install -m 0644 ${WORKDIR}/nftables.service ${D}${systemd_system_unitdir}
+ install -d ${D}${libexecdir}
+ install -m0755 ${WORKDIR}/nft-configure.sh ${D}${libexecdir}/
+
+ install -d ${D}${systemd_system_unitdir}
+ install -m0644 ${WORKDIR}/nftables.service ${D}${systemd_system_unitdir}/
}