Changeset 28671

Timestamp:

2011-10-29T20:09:25+02:00 (6 years ago)

Author:

jow

Message:

[backfire] firewall: merge r28669

Location:

branches/backfire/package/firewall

Files:

• Makefile (modified) (1 diff)
• files/lib/core.sh (modified) (1 diff)
• files/lib/core_init.sh (modified) (3 diffs)
• files/lib/core_interface.sh (modified) (1 diff)

branches/backfire/package/firewall/Makefile

@@ -10 +10 @@
 
 PKG_VERSION:=2
-PKG_RELEASE:=34.5
+PKG_RELEASE:=34.6
 
 include $(INCLUDE_DIR)/package.mk

branches/backfire/package/firewall/files/lib/core.sh

@@ -68 +68 @@
                                 INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall
                 done
+
+                config_get i core "${z}_tcpmss"
+                [ "$i" == 1 ] && {
+                        fw del i m FORWARD zone_${z}_MSSFIX
+                        fw del i m zone_${z}_MSSFIX
+                }
         done
 

branches/backfire/package/firewall/files/lib/core_init.sh

@@ -196 +196 @@
         fw add $mode f ${chain}_DROP
         fw add $mode f ${chain}_REJECT
-        fw add $mode f ${chain}_MSSFIX
 
         # TODO: Rename to ${chain}_input
@@ -214 +213 @@
         fw add $mode r ${chain}_notrack
 
-        [ $zone_mtu_fix == 1 ] && \
-                fw add $mode f FORWARD ${chain}_MSSFIX ^
+        [ $zone_mtu_fix == 1 ] && {
+                fw add $mode m ${chain}_MSSFIX
+                fw add $mode m FORWARD ${chain}_MSSFIX ^
+                uci_set_state firewall core ${zone_name}_tcpmss 1
+        }
 
         [ $zone_custom_chains == 1 ] && {
@@ -236 +238 @@
 
                 local t
-                for t in REJECT DROP MSSFIX; do
+                for t in REJECT DROP; do
                         fw add $mode f ${chain}_${t} LOG ^ \
-                                { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): "  }
+                                { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
                 done
+
+                [ $zone_mtu_fix == 1 ] && \
+                        fw add $mode m ${chain}_MSSFIX LOG ^ \
+                                { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
         }
 

branches/backfire/package/firewall/files/lib/core_interface.sh

@@ -97 +97 @@
                 fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
 
-                fw $action $mode f ${chain}_MSSFIX TCPMSS  $ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
+                [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
+                        fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
+                                { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
 
                 fw $action $mode f input   ${chain}         $ { -i "$ifname" $inet }