[package] firewall (#7355)

	- partially revert r21486, start firewall on init again
	- skip iface hotplug events if base fw is not up yet
	- get ifname and up state with uci_get_state() in iface setup
	  since the values gathered by scan_interfaces() may be outdated
	  when iface coldplugging happens (observed with pptp)
	- ignore up state when bringing down interfaces because ifdown
	  reverts state vars before dispatching the iface event
	- bump package revision

SVN-Revision: 21502

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index 3b37c873572f15e38b09ace391f7b3431e169c3b..1a7216ce175ce9efc15e9aa054d4b8970dfe4796 100644 (file)
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 include $(INCLUDE_DIR)/package.mk
 

diff --git a/package/firewall/files/firewall.hotplug b/package/firewall/files/firewall.hotplug
index bc75e42d1d3fd1b36c10d0b6f63330c82e213545..ac8469524b290fd7ce5a45d276ae59dc353f3f49 100644 (file)
--- a/package/firewall/files/firewall.hotplug
+++ b/package/firewall/files/firewall.hotplug
@@ -3,26 +3,20 @@
 # HOTPLUG_TYPE=iface, triggered by various scripts when an interface
 # is configured (ACTION=ifup) or deconfigured (ACTION=ifdown).  The
 # interface is available as INTERFACE, the real device as DEVICE.
-. /etc/functions.sh
 
 [ "$DEVICE" == "lo" ] && exit 0
 
+. /etc/functions.sh
 . /lib/firewall/core.sh
-fw_init
 
-# Wait for firewall if startup is in progress
-lock -w /var/lock/firewall.start
+fw_init
+fw_is_loaded || exit 0
 
 case "$ACTION" in
        ifup)
-               fw_is_loaded && {
-                       fw_configure_interface "$INTERFACE" add "$DEVICE" &
-               } || {
-                       /etc/init.d/firewall enabled && fw_start &
-               }
+               fw_configure_interface "$INTERFACE" add "$DEVICE" &
        ;;
        ifdown)
-               fw_is_loaded && fw_configure_interface "$INTERFACE" del "$DEVICE" &
+               fw_configure_interface "$INTERFACE" del "$DEVICE" &
        ;;
 esac
-

diff --git a/package/firewall/files/firewall.init b/package/firewall/files/firewall.init
index d04804d756cfbc9a966791d0bc022188dd6ab335..a2fd0a0e94b0c3e1a02ebcca5d7a934db87b8942 100755 (executable)
--- a/package/firewall/files/firewall.init
+++ b/package/firewall/files/firewall.init
@@ -1,5 +1,5 @@
 #!/bin/sh /etc/rc.common
-# Copyright (C) 2008 OpenWrt.org
+# Copyright (C) 2008-2010 OpenWrt.org
 
 START=45
 
@@ -10,8 +10,6 @@ fw() {
        fw_$1
 }
 
-boot() { :; }
-
 start() {
        fw start
 }

diff --git a/package/firewall/files/lib/core.sh b/package/firewall/files/lib/core.sh
index 5f06ffe3fbe899a0764c28e8be4978442644f14a..5880cd3acc291aea24469eee5b7c46190ac0a3f9 100644 (file)
--- a/package/firewall/files/lib/core.sh
+++ b/package/firewall/files/lib/core.sh
@@ -15,8 +15,6 @@ fw_start() {
                exit 1
        }
 
-       lock /var/lock/firewall.start
-
        uci_set_state firewall core "" firewall_state
 
        fw_clear DROP
@@ -52,8 +50,6 @@ fw_start() {
        fw_callback post core
 
        uci_set_state firewall core loaded 1
-
-       lock -u /var/lock/firewall.start
 }
 
 fw_stop() {
@@ -94,7 +90,6 @@ fw_die() {
        echo "Error:" "$@" >&2
        fw_log error "$@"
        fw_stop
-       lock -u /var/lock/firewall.start
        exit 1
 }
 

diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 9da6739f0e8de948c2d93e89539899beceab8f29..9b35c8b2bcc61b01fe22003ae611a44936d8c820 100644 (file)
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -5,14 +5,12 @@ fw_configure_interface() {
        local action=$2
        local ifname=$3
 
-       local status;
-       config_get_bool status "$iface" up "0"
-       [ "$status" == 1 ] || return 0
-
-       [ -n "$ifname" ] || {
-               config_get ifname "$iface" ifname
-               ifname=${ifname:-$iface}
+       [ "$action" == "add" ] && {
+               local status=$(uci_get_state network "$iface" up 0)
+               [ "$status" == 1 ] || return 0
        }
+
+       [ -n "$ifname" ] || ifname=$(uci_get_state network "$iface" ifname "$iface")
        [ "$ifname" == "lo" ] && return 0
 
        fw_callback pre interface