From a4a878d04045b46fa9783664e3643a890b356790 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 11 Jun 2014 11:33:02 +0200
Subject: [PATCH] units: introduce network-pre.target as place to hook in
 firewalls

network-pre.target is a passive target that should be pulled in by
services that want to be executed before any network is configured (for
example: firewall scrips).

network-pre.target should be ordered before all network managemet
services (but not be pulled in by them).

network-pre.target should be order after all services that want to be
executed before any network is configured (and be pulled in by them).
---
 Makefile.am                       |  1 +
 man/systemd.special.xml           | 15 +++++++++++++++
 units/local-fs.target             |  2 --
 units/network-pre.target          | 12 ++++++++++++
 units/network.target              |  2 ++
 units/systemd-networkd.service.in |  2 +-
 6 files changed, 31 insertions(+), 3 deletions(-)
 create mode 100644 units/network-pre.target

diff --git a/Makefile.am b/Makefile.am
index 3ea95e948..8514ec957 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -413,6 +413,7 @@ dist_systemunit_DATA = \
 	units/remote-fs.target \
 	units/remote-fs-pre.target \
 	units/network.target \
+	units/network-pre.target \
 	units/network-online.target \
 	units/nss-lookup.target \
 	units/nss-user-lookup.target \
diff --git a/man/systemd.special.xml b/man/systemd.special.xml
index 38b94a765..cda6edd42 100644
--- a/man/systemd.special.xml
+++ b/man/systemd.special.xml
@@ -72,6 +72,7 @@
                 <filename>multi-user.target</filename>,
                 <filename>network.target</filename>,
                 <filename>network-online.target</filename>,
+                <filename>network-pre.target</filename>,
                 <filename>nss-lookup.target</filename>,
                 <filename>nss-user-lookup.target</filename>,
                 <filename>paths.target</filename>,
@@ -890,6 +891,20 @@
                                         facility.</para>
                                 </listitem>
                         </varlistentry>
+                        <varlistentry>
+                                <term><filename>network-pre.target</filename></term>
+                                <listitem>
+                                        <para>This passive target unit
+                                        may be pulled in by services
+                                        that want to run before any
+                                        network is set up, for example
+                                        for the purpose of setting up a
+                                        firewall. All network
+                                        management software orders
+                                        itself after this target, but
+                                        does not pull it in.</para>
+                                </listitem>
+                        </varlistentry>
                         <varlistentry>
                                 <term><filename>nss-lookup.target</filename></term>
                                 <listitem>
diff --git a/units/local-fs.target b/units/local-fs.target
index ae3cedcb6..70cb13f25 100644
--- a/units/local-fs.target
+++ b/units/local-fs.target
@@ -9,7 +9,5 @@
 Description=Local File Systems
 Documentation=man:systemd.special(7)
 After=local-fs-pre.target
-DefaultDependencies=no
-Conflicts=shutdown.target
 OnFailure=emergency.target
 OnFailureJobMode=replace-irreversibly
diff --git a/units/network-pre.target b/units/network-pre.target
new file mode 100644
index 000000000..0ea4bc739
--- /dev/null
+++ b/units/network-pre.target
@@ -0,0 +1,12 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Network (Pre)
+Documentation=man:systemd.special(7)
+Documentation=http://www.freedesktop.org/wiki/Software/systemd/NetworkTarget
+RefuseManualStart=yes
diff --git a/units/network.target b/units/network.target
index 65fc64b02..61ebdcadd 100644
--- a/units/network.target
+++ b/units/network.target
@@ -9,3 +9,5 @@
 Description=Network
 Documentation=man:systemd.special(7)
 Documentation=http://www.freedesktop.org/wiki/Software/systemd/NetworkTarget
+After=network-pre.target
+RefuseManualStart=yes
diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in
index 373ac4e0f..48f4d63a8 100644
--- a/units/systemd-networkd.service.in
+++ b/units/systemd-networkd.service.in
@@ -9,7 +9,7 @@
 Description=Network Service
 Documentation=man:systemd-networkd.service(8)
 DefaultDependencies=no
-After=dbus.service
+After=dbus.service network-pre.target
 Before=network.target
 Wants=network.target
 ConditionCapability=CAP_NET_ADMIN
-- 
2.30.2