svn-archive/archive/package/network/config/firewall, branch master

firewall: drop invalid by default, remove chain indirection, fix invert flags (#21738)

2016-01-29T17:26:41Z

* Enable drop_invalid by default to catch unnatted packets (#21738) * Fix processing of inversions for -i, -o, -s, -d and -p flags * Remove delegate_* chain indirection but rely on xt_id to identify own rules Signed-off-by: Jo-Philipp Wich SVN-Revision: 48551

firewall: add CONFIG_IPV6 to PKG_CONFIG_DEPENDS to fix a rebuild error

2016-01-18T13:21:37Z

Signed-off-by: Felix Fietkau SVN-Revision: 48315

firewall: move to git.openwrt.org

2016-01-04T15:13:10Z

Signed-off-by: Felix Fietkau SVN-Revision: 48128

firewall: allow DHCPv6 traffic to/from fc00::/6 instead of fe80::/10

2015-09-25T08:41:12Z

There is no RFC requirement that DHCPv6 servers must reply with a link local address and some ISP servers in the wild appear to using addresses in the ULA range to send DHCPv6 offers. Signed-off-by: Jo-Philipp Wich SVN-Revision: 47048

firewall: depend on kmod-ipt-conntrack (#20542)

2015-09-17T15:31:45Z

Our ruleset requires kernel support for conntrack state matching, therfore depend on the require kmod. Fixes #20542. Signed-off-by: Jo-Philipp Wich SVN-Revision: 46990

firewall: Remove src_port from firewall.config to receive dhcpv6 replies

2015-09-11T06:46:35Z

Seems like my second try was again whitespace broken. Sorry for the noise. Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295. Signed-off-by: Anselm Eberhardt SVN-Revision: 46842

firewall: fix typo in ESP rule

2015-07-27T11:47:20Z

Signed-off-by: Steven Barth SVN-Revision: 46506

firewall: comply with REC-22, REC-24 of RFC 6092

2015-07-24T10:00:45Z

Signed-off-by: Steven Barth SVN-Revision: 46478

firewall: link iptables extensions dynamically

2015-05-26T11:11:48Z

Use shared libipt{,4,6}ext.so libraries instead of statically linking the userspace matches into the fw3 executable. As a side effect the match initialization is extremely simplified compared to the weak function pointer juggling performed before. This also fixes the initialization of the multiport match. Signed-off-by: Jo-Philipp Wich SVN-Revision: 45764

firewall: Allow IGMP and MLD input on WAN

2015-05-05T13:22:41Z

The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing SVN-Revision: 45613