diff --git a/firewall/Makefile b/firewall/Makefile index f7ce62d9e..45c524813 100644 --- a/firewall/Makefile +++ b/firewall/Makefile @@ -9,20 +9,18 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall3.git -PKG_SOURCE_DATE:=2025-10-03 -PKG_SOURCE_VERSION:=3a65fde5a3e675fdf2a24cb3f5d12d0a426be36e +PKG_SOURCE_DATE:=2022-02-17 +PKG_SOURCE_VERSION:=4cd7d4f36bea731bf901cb067456f1d460294926 PKG_MIRROR_HASH:=skip PKG_MAINTAINER:=Jo-Philipp Wich PKG_LICENSE:=ISC PKG_CONFIG_DEPENDS := CONFIG_IPV6 -PKG_BUILD_FLAGS:=gc-sections lto - include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/cmake.mk @@ -30,11 +28,8 @@ define Package/firewall SECTION:=net CATEGORY:=Base system TITLE:=OpenWrt C Firewall - DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 \ - +libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat \ - +iptables-mod-fullconenat \ - +iptables-mod-fullconenat +ip6tables-mod-fullconenat +iptables-legacy +ip6tables-legacy +kmod-ipt-nat6 +kmod-ipt-offload \ - +ipset +iptables-mod-conntrack-extra +iptables-mod-iprange +iptables-mod-socket +iptables-mod-tproxy + DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libiptext +IPV6:libiptext6 +libxtables +kmod-ipt-core +kmod-ipt-conntrack +iptables-mod-conntrack-extra +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat +iptables-mod-fullconenat \ + +ipset +iptables-mod-conntrack-extra +iptables-mod-iprange +iptables-mod-socket +iptables-mod-tproxy PROVIDES:=uci-firewall endef @@ -47,6 +42,8 @@ define Package/firewall/conffiles /etc/firewall.user endef +TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto +TARGET_LDFLAGS += -Wl,--gc-sections -flto CMAKE_OPTIONS += $(if $(CONFIG_IPV6),,-DDISABLE_IPV6=1) define Package/firewall/install diff --git a/firewall/files/firewall.config b/firewall/files/firewall.config index 652cca090..a96030bf3 100644 --- a/firewall/files/firewall.config +++ b/firewall/files/firewall.config @@ -1,10 +1,9 @@ config defaults option synflood_protect 1 - option input REJECT + option input ACCEPT option output ACCEPT option forward REJECT - option flow_offloading 1 - option fullcone 1 + option fullcone 0 # Uncomment this line to disable ipv6 rules # option disable_ipv6 1 @@ -56,12 +55,13 @@ config rule option target ACCEPT # Allow DHCPv6 replies -# see https://github.com/openwrt/openwrt/issues/5066 +# see https://dev.openwrt.org/ticket/10381 config rule option name Allow-DHCPv6 option src wan option proto udp - option dest_ip fe80::/10 + option src_ip fc00::/6 + option dest_ip fc00::/6 option dest_port 546 option family ipv6 option target ACCEPT @@ -82,7 +82,7 @@ config rule config rule option name Allow-ICMPv6-Input option src wan - option proto icmp + option proto icmp list icmp_type echo-request list icmp_type echo-reply list icmp_type destination-unreachable @@ -141,7 +141,7 @@ config rule option proto udp option family ipv4 option target REJECT - option enabled 0 + option enabled false # include a file with users custom iptables rules config include diff --git a/firewall/files/firewall.init b/firewall/files/firewall.init index ee3ed1a28..2d641d049 100755 --- a/firewall/files/firewall.init +++ b/firewall/files/firewall.init @@ -4,6 +4,17 @@ START=19 USE_PROCD=1 QUIET="" +LOCK_FILE="/var/lock/procd_firewall.lock" +set_lock() { + exec 1000>"$LOCK_FILE" + flock -xn 1000 +} + +unset_lock() { + flock -u 1000 + rm -rf "$LOCK_FILE" +} + validate_firewall_redirect() { uci_validate_section firewall redirect "${1}" \ @@ -30,27 +41,39 @@ validate_firewall_rule() service_triggers() { procd_add_reload_trigger firewall + set_lock procd_open_validate validate_firewall_redirect validate_firewall_rule procd_close_validate + unset_lock } restart() { + unset_lock + set_lock fw3 restart + unset_lock } start_service() { + set_lock fw3 ${QUIET} start + unset_lock } stop_service() { fw3 flush + unset_lock } reload_service() { + unset_lock + set_lock + reload_config firewall fw3 reload + unset_lock } boot() { diff --git a/firewall/patches/fullconenat.patch b/firewall/patches/100-fullconenat.patch similarity index 100% rename from firewall/patches/fullconenat.patch rename to firewall/patches/100-fullconenat.patch diff --git a/firewall/patches/z-bcm-fullconenat.patch b/firewall/patches/101-bcm-fullconenat.patch similarity index 85% rename from firewall/patches/z-bcm-fullconenat.patch rename to firewall/patches/101-bcm-fullconenat.patch index 8c429387f..9cea4a57b 100644 --- a/firewall/patches/z-bcm-fullconenat.patch +++ b/firewall/patches/101-bcm-fullconenat.patch @@ -1,18 +1,17 @@ --- a/defaults.c +++ b/defaults.c -@@ -49,7 +49,7 @@ +@@ -49,7 +49,7 @@ const struct fw3_option fw3_flag_opts[] FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate), FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst), - + - FW3_OPT("fullcone", bool, defaults, fullcone), + FW3_OPT("fullcone", int, defaults, fullcone), - + FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies), FW3_OPT("tcp_ecn", int, defaults, tcp_ecn), - --- a/options.h +++ b/options.h -@@ -98,6 +98,13 @@ +@@ -98,6 +98,13 @@ enum fw3_reject_code __FW3_REJECT_CODE_MAX }; @@ -26,7 +25,7 @@ extern const char *fw3_flag_names[__FW3_FLAG_MAX]; -@@ -297,7 +304,7 @@ +@@ -297,7 +304,7 @@ struct fw3_defaults enum fw3_reject_code any_reject_code; bool syn_flood; @@ -35,10 +34,9 @@ struct fw3_limit syn_flood_rate; bool tcp_syncookies; - --- a/zones.c +++ b/zones.c -@@ -756,7 +756,7 @@ +@@ -757,7 +757,7 @@ print_zone_rule(struct fw3_ipt_handle *h r = fw3_ipt_rule_new(handle); fw3_ipt_rule_src_dest(r, msrc, mdest); /*FIXME: Workaround for FULLCONE-NAT*/ @@ -47,7 +45,7 @@ { warn("%s will enable FULLCONE-NAT", zone->name); fw3_ipt_rule_target(r, "FULLCONENAT"); -@@ -766,6 +766,12 @@ +@@ -767,6 +767,12 @@ print_zone_rule(struct fw3_ipt_handle *h fw3_ipt_rule_target(r, "FULLCONENAT"); fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name); }