cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-10-27 22:13:11 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
kiddin9 authored and GitHub committed 2026-09-30 01:01:54 +08:00
1 parent b9430ce692
commit b3ce3087db
1 file changed
+62
Download Patch File Download Diff File Expand all files Collapse all files
.github/diy/packages/firewall/patches/101-bcm-fullconenat.patch
+62
View File
@@ -0,0 +1,62 @@
--- a/defaults.c
+++ b/defaults.c
@@ -49,7 +49,7 @@
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
- FW3_OPT("fullcone", bool, defaults, fullcone),
+ FW3_OPT("fullcone", int, defaults, fullcone),
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
--- a/options.h
+++ b/options.h
@@ -98,6 +98,13 @@
__FW3_REJECT_CODE_MAX
};
+enum fullcone_code
+{
+ FULLCONE_DISABLED = 0,
+ FULLCONE_CHION = 1,
+ FULLCONE_BCM = 2,
+};
+
extern const char *fw3_flag_names[__FW3_FLAG_MAX];
@@ -297,7 +304,7 @@
enum fw3_reject_code any_reject_code;
bool syn_flood;
- bool fullcone;
+ int fullcone;
struct fw3_limit syn_flood_rate;
bool tcp_syncookies;
--- a/zones.c
+++ b/zones.c
@@ -756,7 +756,7 @@
r = fw3_ipt_rule_new(handle);
fw3_ipt_rule_src_dest(r, msrc, mdest);
/*FIXME: Workaround for FULLCONE-NAT*/
- if(defs->fullcone)
+ if(defs->fullcone == FULLCONE_CHION)
{
warn("%s will enable FULLCONE-NAT", zone->name);
fw3_ipt_rule_target(r, "FULLCONENAT");
@@ -766,6 +766,12 @@
fw3_ipt_rule_target(r, "FULLCONENAT");
fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
}
+ else if (defs->fullcone == FULLCONE_BCM)
+ {
+ fw3_ipt_rule_target(r, "MASQUERADE");
+ fw3_ipt_rule_extra(r, "--mode fullcone");
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+ }
else
{
fw3_ipt_rule_target(r, "MASQUERADE");