diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2011-10-29 18:02:45 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2011-10-29 18:02:45 +0000 |
| commit | c3b8a2419cfc6e3106f70cf7e3b0f1a647503856 (patch) | |
| tree | 6f2121a1e8a4df6c222c03086e0ab52369fd33fd /package/firewall | |
| parent | 0817f041877704400449b359ee5d3c00f24da6c3 (diff) | |
| download | upstream-c3b8a2419cfc6e3106f70cf7e3b0f1a647503856.tar.gz upstream-c3b8a2419cfc6e3106f70cf7e3b0f1a647503856.tar.bz2 upstream-c3b8a2419cfc6e3106f70cf7e3b0f1a647503856.zip | |
[package] firewall: relocate TCPMSS rules into mangle table, add code to selectively clear them out again
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28669 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/firewall')
| -rw-r--r-- | package/firewall/Makefile | 2 | ||||
| -rw-r--r-- | package/firewall/files/lib/core.sh | 6 | ||||
| -rw-r--r-- | package/firewall/files/lib/core_init.sh | 16 | ||||
| -rw-r--r-- | package/firewall/files/lib/core_interface.sh | 4 |
4 files changed, 21 insertions, 7 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile index 57a6e016ab..f95f73b4ad 100644 --- a/package/firewall/Makefile +++ b/package/firewall/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall PKG_VERSION:=2 -PKG_RELEASE:=40 +PKG_RELEASE:=41 include $(INCLUDE_DIR)/package.mk diff --git a/package/firewall/files/lib/core.sh b/package/firewall/files/lib/core.sh index c383597810..0297518a5d 100644 --- a/package/firewall/files/lib/core.sh +++ b/package/firewall/files/lib/core.sh @@ -67,6 +67,12 @@ fw_stop() { [ -n "$i" ] && env -i ACTION=remove ZONE="$z" \ INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall done + + config_get i core "${z}_tcpmss" + [ "$i" == 1 ] && { + fw del i m FORWARD zone_${z}_MSSFIX + fw del i m zone_${z}_MSSFIX + } done fw_clear ACCEPT diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh index a0b095865e..e93de1613f 100644 --- a/package/firewall/files/lib/core_init.sh +++ b/package/firewall/files/lib/core_init.sh @@ -195,7 +195,6 @@ fw_load_zone() { fw add $mode f ${chain}_ACCEPT fw add $mode f ${chain}_DROP fw add $mode f ${chain}_REJECT - fw add $mode f ${chain}_MSSFIX # TODO: Rename to ${chain}_input fw add $mode f ${chain} @@ -213,8 +212,11 @@ fw_load_zone() { fw add $mode r ${chain}_notrack - [ $zone_mtu_fix == 1 ] && \ - fw add $mode f FORWARD ${chain}_MSSFIX ^ + [ $zone_mtu_fix == 1 ] && { + fw add $mode m ${chain}_MSSFIX + fw add $mode m FORWARD ${chain}_MSSFIX ^ + uci_set_state firewall core ${zone_name}_tcpmss 1 + } [ $zone_custom_chains == 1 ] && { [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \ @@ -235,10 +237,14 @@ fw_load_zone() { zone_log_limit="$zone_log_limit/minute" local t - for t in REJECT DROP MSSFIX; do + for t in REJECT DROP; do fw add $mode f ${chain}_${t} LOG ^ \ - { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " } + { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " } done + + [ $zone_mtu_fix == 1 ] && \ + fw add $mode m ${chain}_MSSFIX LOG ^ \ + { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " } } # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh index 84e07e0e25..8023e7fb8d 100644 --- a/package/firewall/files/lib/core_interface.sh +++ b/package/firewall/files/lib/core_interface.sh @@ -96,7 +96,9 @@ fw_configure_interface() { fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet } fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet } - fw $action $mode f ${chain}_MSSFIX TCPMSS $ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet } + [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \ + fw $action $mode m ${chain}_MSSFIX TCPMSS $ \ + { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet } fw $action $mode f input ${chain} $ { -i "$ifname" $inet } fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet } |