mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-02 03:53:56 +08:00
💐 Sync 2026-09-30 01:19:34
This commit is contained in:
github-actions[bot] committed
1 parent
67427d9030
commit
a64d55f7c5
50 files changed
+2837
-589
No files matched your search
@@ -0,0 +1,67 @@
|
||||
#
|
||||
# Copyright (C) 2013-2016 OpenWrt.org
|
||||
# Copyright (C) 2016 LEDE project
|
||||
#
|
||||
# This is free software, licensed under the GNU General Public License v2.
|
||||
# See /LICENSE for more information.
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=firewall
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE_PROTO:=git
|
||||
PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall3.git
|
||||
PKG_SOURCE_DATE:=2025-10-03
|
||||
PKG_SOURCE_VERSION:=3a65fde5a3e675fdf2a24cb3f5d12d0a426be36e
|
||||
PKG_MIRROR_HASH:=skip
|
||||
PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
|
||||
PKG_LICENSE:=ISC
|
||||
|
||||
PKG_CONFIG_DEPENDS := CONFIG_IPV6
|
||||
|
||||
PKG_BUILD_FLAGS:=gc-sections lto
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
include $(INCLUDE_DIR)/cmake.mk
|
||||
|
||||
define Package/firewall
|
||||
SECTION:=net
|
||||
CATEGORY:=Base system
|
||||
TITLE:=OpenWrt C Firewall
|
||||
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 \
|
||||
+libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat \
|
||||
+iptables-mod-fullconenat \
|
||||
+iptables-mod-fullconenat +ip6tables-mod-fullconenat +iptables-legacy +ip6tables-legacy +kmod-ipt-nat6 +kmod-ipt-offload \
|
||||
+ipset +iptables-mod-conntrack-extra +iptables-mod-iprange +iptables-mod-socket +iptables-mod-tproxy
|
||||
PROVIDES:=uci-firewall
|
||||
endef
|
||||
|
||||
define Package/firewall/description
|
||||
This package provides a config-compatible C implementation of the UCI firewall.
|
||||
endef
|
||||
|
||||
define Package/firewall/conffiles
|
||||
/etc/config/firewall
|
||||
/etc/firewall.user
|
||||
endef
|
||||
|
||||
CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1)
|
||||
|
||||
define Package/firewall/install
|
||||
$(INSTALL_DIR) $(1)/sbin
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/firewall3 $(1)/sbin/fw3
|
||||
$(INSTALL_DIR) $(1)/etc/init.d
|
||||
$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall
|
||||
$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
|
||||
$(INSTALL_CONF) ./files/firewall.hotplug $(1)/etc/hotplug.d/iface/20-firewall
|
||||
$(INSTALL_DIR) $(1)/etc/config/
|
||||
$(INSTALL_CONF) ./files/firewall.config $(1)/etc/config/firewall
|
||||
$(INSTALL_DIR) $(1)/etc/
|
||||
$(INSTALL_CONF) ./files/firewall.user $(1)/etc/firewall.user
|
||||
$(INSTALL_DIR) $(1)/usr/share/fw3
|
||||
$(INSTALL_CONF) $(PKG_BUILD_DIR)/helpers.conf $(1)/usr/share/fw3
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,firewall))
|
||||
@@ -0,0 +1,209 @@
|
||||
config defaults
|
||||
option synflood_protect 1
|
||||
option input REJECT
|
||||
option output ACCEPT
|
||||
option forward REJECT
|
||||
option flow_offloading 1
|
||||
option fullcone 1
|
||||
# Uncomment this line to disable ipv6 rules
|
||||
# option disable_ipv6 1
|
||||
|
||||
config zone
|
||||
option name lan
|
||||
list network 'lan'
|
||||
option input ACCEPT
|
||||
option output ACCEPT
|
||||
option forward ACCEPT
|
||||
|
||||
config zone
|
||||
option name wan
|
||||
list network 'wan'
|
||||
list network 'wan6'
|
||||
option input REJECT
|
||||
option output ACCEPT
|
||||
option forward REJECT
|
||||
option masq 1
|
||||
option mtu_fix 1
|
||||
|
||||
config forwarding
|
||||
option src lan
|
||||
option dest wan
|
||||
|
||||
# We need to accept udp packets on port 68,
|
||||
# see https://dev.openwrt.org/ticket/4108
|
||||
config rule
|
||||
option name Allow-DHCP-Renew
|
||||
option src wan
|
||||
option proto udp
|
||||
option dest_port 68
|
||||
option target ACCEPT
|
||||
option family ipv4
|
||||
|
||||
# Allow IPv4 ping
|
||||
config rule
|
||||
option name Allow-Ping
|
||||
option src wan
|
||||
option proto icmp
|
||||
option icmp_type echo-request
|
||||
option family ipv4
|
||||
option target ACCEPT
|
||||
|
||||
config rule
|
||||
option name Allow-IGMP
|
||||
option src wan
|
||||
option proto igmp
|
||||
option family ipv4
|
||||
option target ACCEPT
|
||||
|
||||
# Allow DHCPv6 replies
|
||||
# see https://github.com/openwrt/openwrt/issues/5066
|
||||
config rule
|
||||
option name Allow-DHCPv6
|
||||
option src wan
|
||||
option proto udp
|
||||
option dest_ip fe80::/10
|
||||
option dest_port 546
|
||||
option family ipv6
|
||||
option target ACCEPT
|
||||
|
||||
config rule
|
||||
option name Allow-MLD
|
||||
option src wan
|
||||
option proto icmp
|
||||
option src_ip fe80::/10
|
||||
list icmp_type '130/0'
|
||||
list icmp_type '131/0'
|
||||
list icmp_type '132/0'
|
||||
list icmp_type '143/0'
|
||||
option family ipv6
|
||||
option target ACCEPT
|
||||
|
||||
# Allow essential incoming IPv6 ICMP traffic
|
||||
config rule
|
||||
option name Allow-ICMPv6-Input
|
||||
option src wan
|
||||
option proto icmp
|
||||
list icmp_type echo-request
|
||||
list icmp_type echo-reply
|
||||
list icmp_type destination-unreachable
|
||||
list icmp_type packet-too-big
|
||||
list icmp_type time-exceeded
|
||||
list icmp_type bad-header
|
||||
list icmp_type unknown-header-type
|
||||
list icmp_type router-solicitation
|
||||
list icmp_type neighbour-solicitation
|
||||
list icmp_type router-advertisement
|
||||
list icmp_type neighbour-advertisement
|
||||
option limit 1000/sec
|
||||
option family ipv6
|
||||
option target ACCEPT
|
||||
|
||||
# Allow essential forwarded IPv6 ICMP traffic
|
||||
config rule
|
||||
option name Allow-ICMPv6-Forward
|
||||
option src wan
|
||||
option dest *
|
||||
option proto icmp
|
||||
list icmp_type echo-request
|
||||
list icmp_type echo-reply
|
||||
list icmp_type destination-unreachable
|
||||
list icmp_type packet-too-big
|
||||
list icmp_type time-exceeded
|
||||
list icmp_type bad-header
|
||||
list icmp_type unknown-header-type
|
||||
option limit 1000/sec
|
||||
option family ipv6
|
||||
option target ACCEPT
|
||||
|
||||
config rule
|
||||
option name Allow-IPSec-ESP
|
||||
option src wan
|
||||
option dest lan
|
||||
option proto esp
|
||||
option target ACCEPT
|
||||
|
||||
config rule
|
||||
option name Allow-ISAKMP
|
||||
option src wan
|
||||
option dest lan
|
||||
option dest_port 500
|
||||
option proto udp
|
||||
option target ACCEPT
|
||||
|
||||
# allow interoperability with traceroute classic
|
||||
# note that traceroute uses a fixed port range, and depends on getting
|
||||
# back ICMP Unreachables. if we're operating in DROP mode, it won't
|
||||
# work so we explicitly REJECT packets on these ports.
|
||||
config rule
|
||||
option name Support-UDP-Traceroute
|
||||
option src wan
|
||||
option dest_port 33434:33689
|
||||
option proto udp
|
||||
option family ipv4
|
||||
option target REJECT
|
||||
option enabled 0
|
||||
|
||||
# include a file with users custom iptables rules
|
||||
config include
|
||||
option path /etc/firewall.user
|
||||
|
||||
|
||||
### EXAMPLE CONFIG SECTIONS
|
||||
# do not allow a specific ip to access wan
|
||||
#config rule
|
||||
# option src lan
|
||||
# option src_ip 192.168.45.2
|
||||
# option dest wan
|
||||
# option proto tcp
|
||||
# option target REJECT
|
||||
|
||||
# block a specific mac on wan
|
||||
#config rule
|
||||
# option dest wan
|
||||
# option src_mac 00:11:22:33:44:66
|
||||
# option target REJECT
|
||||
|
||||
# block incoming ICMP traffic on a zone
|
||||
#config rule
|
||||
# option src lan
|
||||
# option proto ICMP
|
||||
# option target DROP
|
||||
|
||||
# port redirect port coming in on wan to lan
|
||||
#config redirect
|
||||
# option src wan
|
||||
# option src_dport 80
|
||||
# option dest lan
|
||||
# option dest_ip 192.168.16.235
|
||||
# option dest_port 80
|
||||
# option proto tcp
|
||||
|
||||
# port redirect of remapped ssh port (22001) on wan
|
||||
#config redirect
|
||||
# option src wan
|
||||
# option src_dport 22001
|
||||
# option dest lan
|
||||
# option dest_port 22
|
||||
# option proto tcp
|
||||
|
||||
### FULL CONFIG SECTIONS
|
||||
#config rule
|
||||
# option src lan
|
||||
# option src_ip 192.168.45.2
|
||||
# option src_mac 00:11:22:33:44:55
|
||||
# option src_port 80
|
||||
# option dest wan
|
||||
# option dest_ip 194.25.2.129
|
||||
# option dest_port 120
|
||||
# option proto tcp
|
||||
# option target REJECT
|
||||
|
||||
#config redirect
|
||||
# option src lan
|
||||
# option src_ip 192.168.45.2
|
||||
# option src_mac 00:11:22:33:44:55
|
||||
# option src_port 1024
|
||||
# option src_dport 80
|
||||
# option dest_ip 194.25.2.129
|
||||
# option dest_port 120
|
||||
# option proto tcp
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/sh
|
||||
|
||||
[ "$ACTION" = ifup -o "$ACTION" = ifupdate ] || exit 0
|
||||
[ "$ACTION" = ifupdate -a -z "$IFUPDATE_ADDRESSES" -a -z "$IFUPDATE_DATA" ] && exit 0
|
||||
|
||||
/etc/init.d/firewall enabled || exit 0
|
||||
|
||||
fw3 -q network "$INTERFACE" >/dev/null || exit 0
|
||||
|
||||
logger -t firewall "Reloading firewall due to $ACTION of $INTERFACE ($DEVICE)"
|
||||
fw3 -q reload
|
||||
Executable
+61
@@ -0,0 +1,61 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
START=19
|
||||
USE_PROCD=1
|
||||
QUIET=""
|
||||
|
||||
validate_firewall_redirect()
|
||||
{
|
||||
uci_validate_section firewall redirect "${1}" \
|
||||
'proto:or(uinteger, string)' \
|
||||
'src:string' \
|
||||
'src_ip:cidr' \
|
||||
'src_dport:or(port, portrange)' \
|
||||
'dest:string' \
|
||||
'dest_ip:cidr' \
|
||||
'dest_port:or(port, portrange)' \
|
||||
'target:or("SNAT", "DNAT")'
|
||||
}
|
||||
|
||||
validate_firewall_rule()
|
||||
{
|
||||
uci_validate_section firewall rule "${1}" \
|
||||
'proto:or(uinteger, string)' \
|
||||
'src:string' \
|
||||
'dest:string' \
|
||||
'src_port:or(port, portrange)' \
|
||||
'dest_port:or(port, portrange)' \
|
||||
'target:string'
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger firewall
|
||||
|
||||
procd_open_validate
|
||||
validate_firewall_redirect
|
||||
validate_firewall_rule
|
||||
procd_close_validate
|
||||
}
|
||||
|
||||
restart() {
|
||||
fw3 restart
|
||||
}
|
||||
|
||||
start_service() {
|
||||
fw3 ${QUIET} start
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
fw3 flush
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
fw3 reload
|
||||
}
|
||||
|
||||
boot() {
|
||||
# Be silent on boot, firewall might be started by hotplug already,
|
||||
# so don't complain in syslog.
|
||||
QUIET=-q
|
||||
start
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
# This file is interpreted as shell script.
|
||||
# Put your custom iptables rules here, they will
|
||||
# be executed with each firewall (re-)start.
|
||||
|
||||
# Internal uci firewall chains are flushed and recreated on reload, so
|
||||
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
|
||||
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
|
||||
@@ -0,0 +1,62 @@
|
||||
--- a/defaults.c
|
||||
+++ b/defaults.c
|
||||
@@ -49,7 +49,7 @@
|
||||
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
|
||||
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
|
||||
|
||||
- FW3_OPT("fullcone", bool, defaults, fullcone),
|
||||
+ FW3_OPT("fullcone", int, defaults, fullcone),
|
||||
|
||||
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
|
||||
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
|
||||
|
||||
--- a/options.h
|
||||
+++ b/options.h
|
||||
@@ -98,6 +98,13 @@
|
||||
__FW3_REJECT_CODE_MAX
|
||||
};
|
||||
|
||||
+enum fullcone_code
|
||||
+{
|
||||
+ FULLCONE_DISABLED = 0,
|
||||
+ FULLCONE_CHION = 1,
|
||||
+ FULLCONE_BCM = 2,
|
||||
+};
|
||||
+
|
||||
extern const char *fw3_flag_names[__FW3_FLAG_MAX];
|
||||
|
||||
|
||||
@@ -297,7 +304,7 @@
|
||||
enum fw3_reject_code any_reject_code;
|
||||
|
||||
bool syn_flood;
|
||||
- bool fullcone;
|
||||
+ int fullcone;
|
||||
struct fw3_limit syn_flood_rate;
|
||||
|
||||
bool tcp_syncookies;
|
||||
|
||||
--- a/zones.c
|
||||
+++ b/zones.c
|
||||
@@ -756,7 +756,7 @@
|
||||
r = fw3_ipt_rule_new(handle);
|
||||
fw3_ipt_rule_src_dest(r, msrc, mdest);
|
||||
/*FIXME: Workaround for FULLCONE-NAT*/
|
||||
- if(defs->fullcone)
|
||||
+ if(defs->fullcone == FULLCONE_CHION)
|
||||
{
|
||||
warn("%s will enable FULLCONE-NAT", zone->name);
|
||||
fw3_ipt_rule_target(r, "FULLCONENAT");
|
||||
@@ -766,6 +766,12 @@
|
||||
fw3_ipt_rule_target(r, "FULLCONENAT");
|
||||
fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
|
||||
}
|
||||
+ else if (defs->fullcone == FULLCONE_BCM)
|
||||
+ {
|
||||
+ fw3_ipt_rule_target(r, "MASQUERADE");
|
||||
+ fw3_ipt_rule_extra(r, "--mode fullcone");
|
||||
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
|
||||
+ }
|
||||
else
|
||||
{
|
||||
fw3_ipt_rule_target(r, "MASQUERADE");
|
||||
@@ -0,0 +1,63 @@
|
||||
index 85a3750..9fac9b1 100644
|
||||
--- a/defaults.c
|
||||
+++ b/defaults.c
|
||||
@@ -46,7 +46,9 @@ const struct fw3_option fw3_flag_opts[] = {
|
||||
FW3_OPT("synflood_protect", bool, defaults, syn_flood),
|
||||
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
|
||||
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
|
||||
-
|
||||
+
|
||||
+ FW3_OPT("fullcone", bool, defaults, fullcone),
|
||||
+
|
||||
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
|
||||
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
|
||||
FW3_OPT("tcp_window_scaling", bool, defaults, tcp_window_scaling),
|
||||
diff --git a/options.h b/options.h
|
||||
index 6edd174..c02eb97 100644
|
||||
--- a/options.h
|
||||
+++ b/options.h
|
||||
@@ -267,6 +267,7 @@ struct fw3_defaults
|
||||
bool drop_invalid;
|
||||
|
||||
bool syn_flood;
|
||||
+ bool fullcone;
|
||||
struct fw3_limit syn_flood_rate;
|
||||
|
||||
bool tcp_syncookies;
|
||||
diff --git a/zones.c b/zones.c
|
||||
index 2aa7473..57eead0 100644
|
||||
--- a/zones.c
|
||||
+++ b/zones.c
|
||||
@@ -627,6 +627,7 @@ print_zone_rule(struct fw3_ipt_handle *h
|
||||
struct fw3_address *msrc;
|
||||
struct fw3_address *mdest;
|
||||
struct fw3_ipt_rule *r;
|
||||
+ struct fw3_defaults *defs = &state->defaults;
|
||||
|
||||
if (!fw3_is_family(zone, handle->family))
|
||||
return;
|
||||
@@ -712,8 +713,22 @@ print_zone_rule(struct fw3_ipt_handle *h
|
||||
{
|
||||
r = fw3_ipt_rule_new(handle);
|
||||
fw3_ipt_rule_src_dest(r, msrc, mdest);
|
||||
- fw3_ipt_rule_target(r, "MASQUERADE");
|
||||
- fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
|
||||
+ /*FIXME: Workaround for FULLCONE-NAT*/
|
||||
+ if(defs->fullcone)
|
||||
+ {
|
||||
+ warn("%s will enable FULLCONE-NAT", zone->name);
|
||||
+ fw3_ipt_rule_target(r, "FULLCONENAT");
|
||||
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
|
||||
+ r = fw3_ipt_rule_new(handle);
|
||||
+ fw3_ipt_rule_src_dest(r, msrc, mdest);
|
||||
+ fw3_ipt_rule_target(r, "FULLCONENAT");
|
||||
+ fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ fw3_ipt_rule_target(r, "MASQUERADE");
|
||||
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user