From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Thu, 12 Apr 2018 15:57:44 +0000 (+0200)
Subject: base-files: move netfilter sysctl defaults to specific kmod packages
X-Git-Tag: v18.06.0-rc1~406
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=445682c07d0669984f2cc8acb1fba5e1a5e3bc27;p=openwrt%2Fstaging%2Fchunkeey.git

base-files: move netfilter sysctl defaults to specific kmod packages

Avoid warnings when applying settings for uninstalled kmods. See also
FS#1073.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
---

diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 37f0e1e2fd..f35b4db79b 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=186
+PKG_RELEASE:=187
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf
index 7c3344dba3..98867b7c7b 100644
--- a/package/base-files/files/etc/sysctl.d/10-default.conf
+++ b/package/base-files/files/etc/sysctl.d/10-default.conf
@@ -20,15 +20,3 @@ net.ipv4.tcp_dsack=1
 
 net.ipv6.conf.default.forwarding=1
 net.ipv6.conf.all.forwarding=1
-
-net.netfilter.nf_conntrack_acct=1
-net.netfilter.nf_conntrack_checksum=0
-net.netfilter.nf_conntrack_max=16384
-net.netfilter.nf_conntrack_tcp_timeout_established=7440
-net.netfilter.nf_conntrack_udp_timeout=60
-net.netfilter.nf_conntrack_udp_timeout_stream=180
-
-# disable bridge firewalling by default
-net.bridge.bridge-nf-call-arptables=0
-net.bridge.bridge-nf-call-ip6tables=0
-net.bridge.bridge-nf-call-iptables=0
diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
new file mode 100644
index 0000000000..b10ddc0874
--- /dev/null
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
@@ -0,0 +1,7 @@
+# Do not edit, changes to this file will be lost on upgrades
+# /etc/sysctl.conf can be used to customize sysctl settings
+
+# disable bridge firewalling by default
+net.bridge.bridge-nf-call-arptables=0
+net.bridge.bridge-nf-call-ip6tables=0
+net.bridge.bridge-nf-call-iptables=0
diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf
new file mode 100644
index 0000000000..37baf5fd6f
--- /dev/null
+++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf
@@ -0,0 +1,9 @@
+# Do not edit, changes to this file will be lost on upgrades
+# /etc/sysctl.conf can be used to customize sysctl settings
+
+net.netfilter.nf_conntrack_acct=1
+net.netfilter.nf_conntrack_checksum=0
+net.netfilter.nf_conntrack_max=16384
+net.netfilter.nf_conntrack_tcp_timeout_established=7440
+net.netfilter.nf_conntrack_udp_timeout=60
+net.netfilter.nf_conntrack_udp_timeout_stream=180
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index 99c24cc042..51f3544ed6 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -101,6 +101,11 @@ define KernelPackage/nf-conntrack
   AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
 endef
 
+define KernelPackage/nf-conntrack/install
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
+endef
+
 $(eval $(call KernelPackage,nf-conntrack))
 
 
@@ -774,6 +779,11 @@ define KernelPackage/br-netfilter
   AUTOLOAD:=$(call AutoProbe,br_netfilter)
 endef
 
+define KernelPackage/br-netfilter/install
+	$(INSTALL_DIR) $(1)/etc/sysctl.d
+	$(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
+endef
+
 $(eval $(call KernelPackage,br-netfilter))