Re: Notes on upgrading to version 7.3.0

Hi;

Am Freitag, 8. März 2024, 11:21:12 CET schrieb John Sager:
> KP,
> 
> Ok I'll commit nftables to the git repository but it will be a week or two
> before I can do so. Which branch should I use for the commit?

I think best would be to branch from master and create a new repository which 
can be merged after a bit of testing builds.

kp


> regards,
> 
> John
> 
> On 6 March 2024 16:20:36 GMT, "KP.Kirchdoerfer" <[email protected]> 
wrote:
> >H John;
> >
> >sorry for late reply.
> >
> >Am Dienstag, 6. Februar 2024, 11:45:27 CET schrieb John Sager:
> >> I've been using version 7.0.2 on a PC Engines APU2C2 as my border
> >> router/firewall for a couple of years and I decided to upgrade to version
> >> 7.3.0, it being the latest release. I don't use the 'upgrade' tool but
> >> instead I have three partitions on the SD card - a vfat boot partition
> >> and
> >> two ext4 partitions for old and new versions. This makes it easy to just
> >> reboot the old version if the new one misbehaves.
> >
> >Honestly, ido the same - having three versions on my router - old and
> >ultrastable, if everything goes wrong, stable with a current version having
> >usual updates and testing for cutting edge.
> >
> >> Additionally I had moved to using nftables on 7.0.2 to create the
> >> firewall
> >> rules and packet marking rules for traffic control. I wanted to try it
> >> out
> >> in a real environment. Previously I used hand-crafted iptables rules
> >> rather
> >> than shorewall anyway for more flexibility.
> >> 
> >> I like nftables so I am sticking with it. For this release I cloned the
> >> bering development git repository on sourceforge to build nftables. I had
> >> to use version 1.0.6 of nftables rather than the latest version (1.0.9)
> >> as it has to work with the release version (1.2.5) of libnftnl. Besides
> >> libnftnl it also needs libmnl (already in initrd, as I eventually
> >> realised), libedit, libgmp and libjansson. Those libraries and all the
> >> other packages are from
> >> Bering-uClibc_7.3.0_x86_64_syslinux_serial115200.tar.gz.
> >> 
> >> On first booting into the new version I got errors. nftables didn't work
> >> as
> >> I had made a small build error but that was easily fixed. However a
> >> couple
> >> of other applications also failed:
> >> 
> >> ntpd requires libcap though it isn't listed in ntpd.deplrp, so libcap
> >> needs
> >> to go in the list of packages to load in leaf.cfg. This was also raised
> >> by
> >> Robert K Coffman jr on leaf-user in August 2023.
> >
> >Yeap, for got to commit the fix previously, done.
> >
> >> tc requires libxtables. When using iptables, that library would normally
> >> get loaded automatically but I don't use iptables, so libiptbl (where
> >> libxtables lives) goes in the package list in leaf.cfg.
> >
> >It most probably won't  do any harm if libiptbl would be added to tc.lrp as
> >requirement.
> >
> >> So far the new version has been working for over 24 hours with no obvious
> >> issues.
> >> 
> >> If there is a demand for nftables perhaps it could be added to the
> >> distro? I can supply the config and the repo that I have used
> >> successfully now in two versions of Bering-uClibc as a template.
> >
> >Please do - it will be welcome.
> >As nothing has changed in the git permissions since you've committed the
> >first wireguard packages years ago, you should be able to do so for
> >nftables as well.
> >
> >regards kp
> >
> >> regards,
> >> 
> >> John Sager
> >> 
> >> 
> >> 
> >> 
> >> 
> >> ------------------------------------------------------------------------
> >> leaf-user mailing list: [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/leaf-user
> >> Support Request -- http://leaf-project.org/
> >
> >------------------------------------------------------------------------
> >leaf-user mailing list: [email protected]
> >https://lists.sourceforge.net/lists/listinfo/leaf-user
> >Support Request -- http://leaf-project.org/






------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/