[backfire] firewall: merge r29577