bcp38: clean up nft rule handling

Quote interface names when creating nft rules and use destroy table for idempotent cleanup.

Signed-off-by: Dharmik Parmar <redacted>

diff --git a/net/bcp38/Makefile b/net/bcp38/Makefile
index 099f202f17c2224beff9019fbbe73803b8fecfc6..499f6fb59a83d4e26a4ad3ebf949d8a66612d419 100644 (file)
--- a/net/bcp38/Makefile
+++ b/net/bcp38/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bcp38
 PKG_VERSION:=5
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 PKG_LICENSE:=GPL-3.0-or-later
 
 include $(INCLUDE_DIR)/package.mk

diff --git a/net/bcp38/files/run.sh b/net/bcp38/files/run.sh
index 4c4f185da2076ab89af149ad472669dc17db0d73..54acc58c4111d0d6d6e4e1e8b2280d81b49c2704 100755 (executable)
--- a/net/bcp38/files/run.sh
+++ b/net/bcp38/files/run.sh
@@ -86,8 +86,8 @@ setup_chains()
        nft flush chain "$FAMILY" "$TABLE" "$CHAIN" 2>/dev/null
 
        nft add rule "$FAMILY" "$TABLE" "$CHAIN" udp sport . udp dport { 68 . 67, 67 . 68 } counter return comment \"always accept DHCP traffic\"
-       nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname $interface ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable
-       nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname $interface ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop
+       nft add rule "$FAMILY" "$TABLE" "$CHAIN" oifname "$interface" ip daddr @"$MATCHSET" ip daddr != @"$NOMATCHSET" counter reject with icmp type host-unreachable
+       nft add rule "$FAMILY" "$TABLE" "$CHAIN" iifname "$interface" ip saddr @"$MATCHSET" ip saddr != @"$NOMATCHSET" counter drop
 
        nft add chain "$FAMILY" "$TABLE" input "{ type filter hook input priority $priority; policy accept; comment \"bcp38 filter\"; }"
        nft add chain "$FAMILY" "$TABLE" forward "{ type filter hook forward priority $priority; policy accept; comment \"bcp38 filter\"; }"
@@ -101,8 +101,8 @@ setup_chains()
 destroy_table()
 {
        if [ "$TABLE" != "fw4" ]; then
-               #as of kernel 3.18 we can delete a table without need to flush it
-               nft delete table "$FAMILY" "$TABLE" 2>/dev/null
+               # Delete the table if it exists.
+               nft destroy table "$FAMILY" "$TABLE" 2>/dev/null
        fi
 }