diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2011-10-29 18:02:45 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2011-10-29 18:02:45 +0000 |
| commit | 50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d (patch) | |
| tree | 56fc2738798df78d8b8575ea5236a3f04b3d2d64 /package/firewall/files/lib/core_init.sh | |
| parent | 0a84f6a74e3e4edabf28ac15199f9b7e8ba6de19 (diff) | |
| download | upstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.tar.gz upstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.tar.bz2 upstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.zip | |
firewall: relocate TCPMSS rules into mangle table, add code to selectively clear them out again
SVN-Revision: 28669
Diffstat (limited to 'package/firewall/files/lib/core_init.sh')
| -rw-r--r-- | package/firewall/files/lib/core_init.sh | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh index a0b095865e..e93de1613f 100644 --- a/package/firewall/files/lib/core_init.sh +++ b/package/firewall/files/lib/core_init.sh @@ -195,7 +195,6 @@ fw_load_zone() { fw add $mode f ${chain}_ACCEPT fw add $mode f ${chain}_DROP fw add $mode f ${chain}_REJECT - fw add $mode f ${chain}_MSSFIX # TODO: Rename to ${chain}_input fw add $mode f ${chain} @@ -213,8 +212,11 @@ fw_load_zone() { fw add $mode r ${chain}_notrack - [ $zone_mtu_fix == 1 ] && \ - fw add $mode f FORWARD ${chain}_MSSFIX ^ + [ $zone_mtu_fix == 1 ] && { + fw add $mode m ${chain}_MSSFIX + fw add $mode m FORWARD ${chain}_MSSFIX ^ + uci_set_state firewall core ${zone_name}_tcpmss 1 + } [ $zone_custom_chains == 1 ] && { [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \ @@ -235,10 +237,14 @@ fw_load_zone() { zone_log_limit="$zone_log_limit/minute" local t - for t in REJECT DROP MSSFIX; do + for t in REJECT DROP; do fw add $mode f ${chain}_${t} LOG ^ \ - { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " } + { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " } done + + [ $zone_mtu_fix == 1 ] && \ + fw add $mode m ${chain}_MSSFIX LOG ^ \ + { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " } } # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here |