aboutsummaryrefslogtreecommitdiffstats
path: root/package/firewall
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2011-10-29 18:02:45 +0000
committerJo-Philipp Wich <jow@openwrt.org>2011-10-29 18:02:45 +0000
commit50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d (patch)
tree56fc2738798df78d8b8575ea5236a3f04b3d2d64 /package/firewall
parent0a84f6a74e3e4edabf28ac15199f9b7e8ba6de19 (diff)
downloadupstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.tar.gz
upstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.tar.bz2
upstream-50a22f4f9e981c910c9559c1ee6fc0dab2b52c3d.zip
firewall: relocate TCPMSS rules into mangle table, add code to selectively clear them out again
SVN-Revision: 28669
Diffstat (limited to 'package/firewall')
-rw-r--r--package/firewall/Makefile2
-rw-r--r--package/firewall/files/lib/core.sh6
-rw-r--r--package/firewall/files/lib/core_init.sh16
-rw-r--r--package/firewall/files/lib/core_interface.sh4
4 files changed, 21 insertions, 7 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index 57a6e016ab..f95f73b4ad 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=40
+PKG_RELEASE:=41
include $(INCLUDE_DIR)/package.mk
diff --git a/package/firewall/files/lib/core.sh b/package/firewall/files/lib/core.sh
index c383597810..0297518a5d 100644
--- a/package/firewall/files/lib/core.sh
+++ b/package/firewall/files/lib/core.sh
@@ -67,6 +67,12 @@ fw_stop() {
[ -n "$i" ] && env -i ACTION=remove ZONE="$z" \
INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall
done
+
+ config_get i core "${z}_tcpmss"
+ [ "$i" == 1 ] && {
+ fw del i m FORWARD zone_${z}_MSSFIX
+ fw del i m zone_${z}_MSSFIX
+ }
done
fw_clear ACCEPT
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index a0b095865e..e93de1613f 100644
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -195,7 +195,6 @@ fw_load_zone() {
fw add $mode f ${chain}_ACCEPT
fw add $mode f ${chain}_DROP
fw add $mode f ${chain}_REJECT
- fw add $mode f ${chain}_MSSFIX
# TODO: Rename to ${chain}_input
fw add $mode f ${chain}
@@ -213,8 +212,11 @@ fw_load_zone() {
fw add $mode r ${chain}_notrack
- [ $zone_mtu_fix == 1 ] && \
- fw add $mode f FORWARD ${chain}_MSSFIX ^
+ [ $zone_mtu_fix == 1 ] && {
+ fw add $mode m ${chain}_MSSFIX
+ fw add $mode m FORWARD ${chain}_MSSFIX ^
+ uci_set_state firewall core ${zone_name}_tcpmss 1
+ }
[ $zone_custom_chains == 1 ] && {
[ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
@@ -235,10 +237,14 @@ fw_load_zone() {
zone_log_limit="$zone_log_limit/minute"
local t
- for t in REJECT DROP MSSFIX; do
+ for t in REJECT DROP; do
fw add $mode f ${chain}_${t} LOG ^ \
- { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
+ { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
done
+
+ [ $zone_mtu_fix == 1 ] && \
+ fw add $mode m ${chain}_MSSFIX LOG ^ \
+ { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
}
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 84e07e0e25..8023e7fb8d 100644
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -96,7 +96,9 @@ fw_configure_interface() {
fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
- fw $action $mode f ${chain}_MSSFIX TCPMSS $ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
+ [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
+ fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
+ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }