Re: Notes on upgrading to version 7.3.0

kp,

I have just  pushed a new branch 'nftables-test' to the repository. This has 
the commit for the nftables stuff - conf/sources.d/nftables.cfg and 
repo/nftables/.

Sorry it has taken so long to do but I have been busy with other things. I 
have only tested it on x86-64 as that is my only test environment.

regards,

John

On 08/03/2024 23:02, KP.Kirchdoerfer wrote:
> Hi;
> 
> Am Freitag, 8. März 2024, 11:21:12 CET schrieb John Sager:
>> KP,
>>
>> Ok I'll commit nftables to the git repository but it will be a week or two
>> before I can do so. Which branch should I use for the commit?
> 
> I think best would be to branch from master and create a new repository which
> can be merged after a bit of testing builds.
> 
> kp
> 
> 
>> regards,
>>
>> John
>>
>> On 6 March 2024 16:20:36 GMT, "KP.Kirchdoerfer" <[email protected]>
> wrote:
>>> H John;
>>>
>>> sorry for late reply.
>>>
>>> Am Dienstag, 6. Februar 2024, 11:45:27 CET schrieb John Sager:
>>>> I've been using version 7.0.2 on a PC Engines APU2C2 as my border
>>>> router/firewall for a couple of years and I decided to upgrade to version
>>>> 7.3.0, it being the latest release. I don't use the 'upgrade' tool but
>>>> instead I have three partitions on the SD card - a vfat boot partition
>>>> and
>>>> two ext4 partitions for old and new versions. This makes it easy to just
>>>> reboot the old version if the new one misbehaves.
>>>
>>> Honestly, ido the same - having three versions on my router - old and
>>> ultrastable, if everything goes wrong, stable with a current version having
>>> usual updates and testing for cutting edge.
>>>
>>>> Additionally I had moved to using nftables on 7.0.2 to create the
>>>> firewall
>>>> rules and packet marking rules for traffic control. I wanted to try it
>>>> out
>>>> in a real environment. Previously I used hand-crafted iptables rules
>>>> rather
>>>> than shorewall anyway for more flexibility.
>>>>
>>>> I like nftables so I am sticking with it. For this release I cloned the
>>>> bering development git repository on sourceforge to build nftables. I had
>>>> to use version 1.0.6 of nftables rather than the latest version (1.0.9)
>>>> as it has to work with the release version (1.2.5) of libnftnl. Besides
>>>> libnftnl it also needs libmnl (already in initrd, as I eventually
>>>> realised), libedit, libgmp and libjansson. Those libraries and all the
>>>> other packages are from
>>>> Bering-uClibc_7.3.0_x86_64_syslinux_serial115200.tar.gz.
>>>>
>>>> On first booting into the new version I got errors. nftables didn't work
>>>> as
>>>> I had made a small build error but that was easily fixed. However a
>>>> couple
>>>> of other applications also failed:
>>>>
>>>> ntpd requires libcap though it isn't listed in ntpd.deplrp, so libcap
>>>> needs
>>>> to go in the list of packages to load in leaf.cfg. This was also raised
>>>> by
>>>> Robert K Coffman jr on leaf-user in August 2023.
>>>
>>> Yeap, for got to commit the fix previously, done.
>>>
>>>> tc requires libxtables. When using iptables, that library would normally
>>>> get loaded automatically but I don't use iptables, so libiptbl (where
>>>> libxtables lives) goes in the package list in leaf.cfg.
>>>
>>> It most probably won't  do any harm if libiptbl would be added to tc.lrp as
>>> requirement.
>>>
>>>> So far the new version has been working for over 24 hours with no obvious
>>>> issues.
>>>>
>>>> If there is a demand for nftables perhaps it could be added to the
>>>> distro? I can supply the config and the repo that I have used
>>>> successfully now in two versions of Bering-uClibc as a template.
>>>
>>> Please do - it will be welcome.
>>> As nothing has changed in the git permissions since you've committed the
>>> first wireguard packages years ago, you should be able to do so for
>>> nftables as well.
>>>
>>> regards kp
>>>
>>>> regards,
>>>>
>>>> John Sager
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> ------------------------------------------------------------------------
>>>> leaf-user mailing list: [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/leaf-user
>>>> Support Request -- http://leaf-project.org/
>>>
>>> ------------------------------------------------------------------------
>>> leaf-user mailing list: [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/leaf-user
>>> Support Request -- http://leaf-project.org/
> 
> 
> 
> 
> 
> 
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/