projects
/
openwrt
/
svn-archive
/
archive.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
c83976e
)
[package] firewall: relocate TCPMSS rules into mangle table, add code to selectively...
author
Jo-Philipp Wich
<jow@openwrt.org>
Sat, 29 Oct 2011 18:02:45 +0000
(18:02 +0000)
committer
Jo-Philipp Wich
<jow@openwrt.org>
Sat, 29 Oct 2011 18:02:45 +0000
(18:02 +0000)
SVN-Revision: 28669
package/firewall/Makefile
patch
|
blob
|
history
package/firewall/files/lib/core.sh
patch
|
blob
|
history
package/firewall/files/lib/core_init.sh
patch
|
blob
|
history
package/firewall/files/lib/core_interface.sh
patch
|
blob
|
history
diff --git
a/package/firewall/Makefile
b/package/firewall/Makefile
index 57a6e016ab682367b8bd6459844fdcfac9a3b96d..f95f73b4ad5eaf3370050692efc3f27e1d78fb9b 100644
(file)
--- a/
package/firewall/Makefile
+++ b/
package/firewall/Makefile
@@
-9,7
+9,7
@@
include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=4
0
+PKG_RELEASE:=4
1
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/package.mk
diff --git
a/package/firewall/files/lib/core.sh
b/package/firewall/files/lib/core.sh
index c383597810e38703c7e4ebe95eb1ed4610708df2..0297518a5d620d07782786f59c22c84c03271b8f 100644
(file)
--- a/
package/firewall/files/lib/core.sh
+++ b/
package/firewall/files/lib/core.sh
@@
-67,6
+67,12
@@
fw_stop() {
[ -n "$i" ] && env -i ACTION=remove ZONE="$z" \
INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall
done
[ -n "$i" ] && env -i ACTION=remove ZONE="$z" \
INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall
done
+
+ config_get i core "${z}_tcpmss"
+ [ "$i" == 1 ] && {
+ fw del i m FORWARD zone_${z}_MSSFIX
+ fw del i m zone_${z}_MSSFIX
+ }
done
fw_clear ACCEPT
done
fw_clear ACCEPT
diff --git
a/package/firewall/files/lib/core_init.sh
b/package/firewall/files/lib/core_init.sh
index a0b095865ef7e4bbc19c71100772913871700b51..e93de1613ff091f9236eecea61ad07b0016584bc 100644
(file)
--- a/
package/firewall/files/lib/core_init.sh
+++ b/
package/firewall/files/lib/core_init.sh
@@
-195,7
+195,6
@@
fw_load_zone() {
fw add $mode f ${chain}_ACCEPT
fw add $mode f ${chain}_DROP
fw add $mode f ${chain}_REJECT
fw add $mode f ${chain}_ACCEPT
fw add $mode f ${chain}_DROP
fw add $mode f ${chain}_REJECT
- fw add $mode f ${chain}_MSSFIX
# TODO: Rename to ${chain}_input
fw add $mode f ${chain}
# TODO: Rename to ${chain}_input
fw add $mode f ${chain}
@@
-213,8
+212,11
@@
fw_load_zone() {
fw add $mode r ${chain}_notrack
fw add $mode r ${chain}_notrack
- [ $zone_mtu_fix == 1 ] && \
- fw add $mode f FORWARD ${chain}_MSSFIX ^
+ [ $zone_mtu_fix == 1 ] && {
+ fw add $mode m ${chain}_MSSFIX
+ fw add $mode m FORWARD ${chain}_MSSFIX ^
+ uci_set_state firewall core ${zone_name}_tcpmss 1
+ }
[ $zone_custom_chains == 1 ] && {
[ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
[ $zone_custom_chains == 1 ] && {
[ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
@@
-235,10
+237,14
@@
fw_load_zone() {
zone_log_limit="$zone_log_limit/minute"
local t
zone_log_limit="$zone_log_limit/minute"
local t
- for t in REJECT DROP
MSSFIX
; do
+ for t in REJECT DROP; do
fw add $mode f ${chain}_${t} LOG ^ \
fw add $mode f ${chain}_${t} LOG ^ \
- { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): "
}
+ { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
done
done
+
+ [ $zone_mtu_fix == 1 ] && \
+ fw add $mode m ${chain}_MSSFIX LOG ^ \
+ { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
}
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
}
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
diff --git
a/package/firewall/files/lib/core_interface.sh
b/package/firewall/files/lib/core_interface.sh
index 84e07e0e25d69d7a07c0107374e9b9fa46b95c8b..8023e7fb8d0bb6c15693de1c2ef7e72c619550ae 100644
(file)
--- a/
package/firewall/files/lib/core_interface.sh
+++ b/
package/firewall/files/lib/core_interface.sh
@@
-96,7
+96,9
@@
fw_configure_interface() {
fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
- fw $action $mode f ${chain}_MSSFIX TCPMSS $ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
+ [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
+ fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
+ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }
fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }