mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-26 21:12:51 +08:00
63 lines
1.6 KiB
Diff
63 lines
1.6 KiB
Diff
--- a/defaults.c
|
|
+++ b/defaults.c
|
|
@@ -49,7 +49,7 @@
|
|
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
|
|
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
|
|
|
|
- FW3_OPT("fullcone", bool, defaults, fullcone),
|
|
+ FW3_OPT("fullcone", int, defaults, fullcone),
|
|
|
|
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
|
|
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
|
|
|
|
--- a/options.h
|
|
+++ b/options.h
|
|
@@ -98,6 +98,13 @@
|
|
__FW3_REJECT_CODE_MAX
|
|
};
|
|
|
|
+enum fullcone_code
|
|
+{
|
|
+ FULLCONE_DISABLED = 0,
|
|
+ FULLCONE_CHION = 1,
|
|
+ FULLCONE_BCM = 2,
|
|
+};
|
|
+
|
|
extern const char *fw3_flag_names[__FW3_FLAG_MAX];
|
|
|
|
|
|
@@ -297,7 +304,7 @@
|
|
enum fw3_reject_code any_reject_code;
|
|
|
|
bool syn_flood;
|
|
- bool fullcone;
|
|
+ int fullcone;
|
|
struct fw3_limit syn_flood_rate;
|
|
|
|
bool tcp_syncookies;
|
|
|
|
--- a/zones.c
|
|
+++ b/zones.c
|
|
@@ -756,7 +756,7 @@
|
|
r = fw3_ipt_rule_new(handle);
|
|
fw3_ipt_rule_src_dest(r, msrc, mdest);
|
|
/*FIXME: Workaround for FULLCONE-NAT*/
|
|
- if(defs->fullcone)
|
|
+ if(defs->fullcone == FULLCONE_CHION)
|
|
{
|
|
warn("%s will enable FULLCONE-NAT", zone->name);
|
|
fw3_ipt_rule_target(r, "FULLCONENAT");
|
|
@@ -766,6 +766,12 @@
|
|
fw3_ipt_rule_target(r, "FULLCONENAT");
|
|
fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
|
|
}
|
|
+ else if (defs->fullcone == FULLCONE_BCM)
|
|
+ {
|
|
+ fw3_ipt_rule_target(r, "MASQUERADE");
|
|
+ fw3_ipt_rule_extra(r, "--mode fullcone");
|
|
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
|
|
+ }
|
|
else
|
|
{
|
|
fw3_ipt_rule_target(r, "MASQUERADE");
|