6a582bf1e4
The ip6tables frameworks has been deprecated for quite a while now, as it has been replaced by nftables. On modern distributions, rules added with ip6tables are just converted to nftables rules and are added to an ip6tables compatibility table there. This changed the name of the kernel modules, breaking ip6tables auto-detection (cf. issues #42 and #44). Unfortunately, due to the way nftables works, these rules can no longer be relied upon to ensure the CLAT traffic is allowed. This is due to the fact that in nftables, *all* chains that hook into a packet's path must return an «accept» verdict in order for the packet to be ultimately accepted, while it is enough for a single chain to return a «drop» verdict in order for the packet to be dropped. That means that the rules that accepts CLAT traffic might be overridden by a «default drop» rule added to another chain in another table, e.g., by firewalld or similar local firewall frameworks. See #23 for an example of this. On the other hand, if there is no drop rule anywhere, the rules added by clatd are superfluous to begin with, as the default kernel behaviour is to accept the packages. Therefore just remove support for ip6tables entirely. Users of firewalld, ufw, or similar local firewall frameworks will need to make sure that rules are added in those frameworks that permit the CLAT traffic, e.g., by using `script-up`, like so for ufw: ``` script-up=ufw route allow in on $clat_dev out on $plat_dev ``` Native support for adding rules to the most common local firewall frameworks might be added in the future. Closes #44 (no longer applicable).
31 lines
2.3 KiB
Makefile
31 lines
2.3 KiB
Makefile
DESTDIR=
|
|
PREFIX=/usr
|
|
SYSCONFDIR=/etc
|
|
|
|
APT_GET:=$(shell which apt-get)
|
|
DNF_OR_YUM:=$(shell which dnf || which yum)
|
|
INITCTL:=$(shell which initctl)
|
|
SYSTEMCTL:=$(shell which systemctl)
|
|
TAYGA:=$(shell which tayga)
|
|
|
|
install:
|
|
# Install the main script
|
|
install -m0755 clatd $(DESTDIR)$(PREFIX)/sbin/clatd
|
|
# Install manual page if pod2man is installed
|
|
pod2man --name clatd --center "clatd - a CLAT implementation for Linux" --section 8 README.pod $(DESTDIR)$(PREFIX)/share/man/man8/clatd.8 && gzip -f9 $(DESTDIR)$(PREFIX)/share/man/man8/clatd.8 || echo "pod2man is required to generate manual page"
|
|
# Install systemd service file if applicable for this system
|
|
if test -x "$(SYSTEMCTL)" && test -d "$(DESTDIR)$(SYSCONFDIR)/systemd/system"; then install -m0644 scripts/clatd.systemd $(DESTDIR)$(SYSCONFDIR)/systemd/system/clatd.service && $(SYSTEMCTL) daemon-reload; fi
|
|
if test -e "$(DESTDIR)$(SYSCONFDIR)/systemd/system/clatd.service" && test ! -e "$(DESTDIR)$(SYSCONFDIR)/systemd/system/multi-user.target.wants/clatd.service"; then $(SYSTEMCTL) enable clatd.service; fi
|
|
# Install upstart service file if applicable for this system
|
|
if test -x "$(INITCTL)" && test -d "$(DESTDIR)$(SYSCONFDIR)/init"; then install -m0644 scripts/clatd.upstart $(DESTDIR)$(SYSCONFDIR)/init/clatd.conf; fi
|
|
# Install NetworkManager dispatcher script if applicable
|
|
if test -d $(DESTDIR)$(SYSCONFDIR)/NetworkManager/dispatcher.d; then install -m0755 scripts/clatd.networkmanager $(DESTDIR)$(SYSCONFDIR)/NetworkManager/dispatcher.d/50-clatd; fi
|
|
|
|
installdeps:
|
|
# .deb/apt-get based distros
|
|
if test -x "$(APT_GET)"; then $(APT_GET) -y install perl-base perl-modules libnet-ip-perl libnet-dns-perl libio-socket-ip-perl iproute2 tayga; fi
|
|
# .rpm/DNF/YUM-based distros
|
|
if test -x "$(DNF_OR_YUM)"; then $(DNF_OR_YUM) -y install perl perl-Net-IP perl-Net-DNS perl-IO-Socket-IP perl-File-Temp iproute; fi
|
|
# If necessary, try to install the TAYGA .rpm using dnf/yum. It is unfortunately not available in all .rpm based distros (in particular CentOS/RHEL).
|
|
if test -x "$(DNF_OR_YUM)" && test ! -x "$(TAYGA)"; then $(DNF_OR_YUM) -y install tayga || echo "ERROR: Failed to install TAYGA using dnf/yum, the package is probably not included in your distro. Try enabling the EPEL repo <URL: https://fedoraproject.org/wiki/EPEL> and try again, or install TAYGA <URL: http://www.litech.org/tayga> directly from source."; exit 1; fi
|