summaryrefslogtreecommitdiff
path: root/package/network/config/firewall
Commit message (Collapse)AuthorAgeFilesLines
* package/*: update git urls for project reposJohn Crispin2016-06-131-1/+1
| | | | Signed-off-by: John Crispin <john@phrozen.org>
* firewall3: fix mark rules for local traffic, fix race conditionJo-Philipp Wich2016-05-021-3/+4
| | | | | | | Update to latest HEAD in order to fix MARK rule generation for local traffic, also fix a possible race condition during firewall start. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* firewall: drop invalid by default, remove chain indirection, fix invert ↵Jo-Philipp Wich2016-01-291-3/+3
| | | | | | | | | | | | flags (#21738) * Enable drop_invalid by default to catch unnatted packets (#21738) * Fix processing of inversions for -i, -o, -s, -d and -p flags * Remove delegate_* chain indirection but rely on xt_id to identify own rules Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48551
* firewall: add CONFIG_IPV6 to PKG_CONFIG_DEPENDS to fix a rebuild errorFelix Fietkau2016-01-181-0/+1
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48315
* firewall: move to git.openwrt.orgFelix Fietkau2016-01-041-1/+1
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48128
* firewall: allow DHCPv6 traffic to/from fc00::/6 instead of fe80::/10Jo-Philipp Wich2015-09-251-2/+2
| | | | | | | | | | There is no RFC requirement that DHCPv6 servers must reply with a link local address and some ISP servers in the wild appear to using addresses in the ULA range to send DHCPv6 offers. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 47048
* firewall: depend on kmod-ipt-conntrack (#20542)Jo-Philipp Wich2015-09-171-1/+1
| | | | | | | | | Our ruleset requires kernel support for conntrack state matching, therfore depend on the require kmod. Fixes #20542. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 46990
* firewall: Remove src_port from firewall.config to receive dhcpv6 repliesSteven Barth2015-09-111-1/+0
| | | | | | | | | | Seems like my second try was again whitespace broken. Sorry for the noise. Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295. Signed-off-by: Anselm Eberhardt <a.eberhardt@cygnusnetworks.de> SVN-Revision: 46842
* firewall: fix typo in ESP ruleSteven Barth2015-07-272-2/+2
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46506
* firewall: comply with REC-22, REC-24 of RFC 6092Steven Barth2015-07-242-13/+12
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46478
* firewall: link iptables extensions dynamicallyJo-Philipp Wich2015-05-261-7/+2
| | | | | | | | | | | | | | Use shared libipt{,4,6}ext.so libraries instead of statically linking the userspace matches into the fw3 executable. As a side effect the match initialization is extremely simplified compared to the weak function pointer juggling performed before. This also fixes the initialization of the multiport match. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 45764
* firewall: Allow IGMP and MLD input on WANSteven Barth2015-05-051-0/+19
| | | | | | | | | | | | The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> SVN-Revision: 45613
* firewall: fix some more null-pointer accessesSteven Barth2015-02-261-2/+2
| | | | | | | | thanks to Hans Dedecker Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 44540
* firewall: respect src_dip option for reflection (#18544)Jo-Philipp Wich2015-01-081-3/+3
| | | | | | | | Also fix wrong IPv4 netmask calculation on x86-64, thanks Ulrich Weber. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 43874
* license info - revert r43155John Crispin2014-11-031-2/+0
| | | | | | | | turns out that r43155 adds duplicate info. Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 43167
* Add more license tags with SPDX identifiersJohn Crispin2014-11-031-0/+2
| | | | | | | | | | | | | | | | | | Note, that licensing stuff is a nightmare: many packages does not clearly state their licenses, and often multiple source files are simply copied together - each with different licensing information in the file headers. I tried hard to ensure, that the license information extracted into the OpenWRT's makefiles fit the "spirit" of the packages, e.g. such small packages which come without a dedicated source archive "inherites" the OpenWRT's own license in my opinion. However, I can not garantee that I always picked the correct information and/or did not miss license information. Signed-off-by: Michael Heimpold <mhei@heimpold.de> SVN-Revision: 43155
* Add a few SPDX tagsSteven Barth2014-11-021-0/+1
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 43151
* firewall: allow '*' as synonym for any / all in family and proto optionsJo-Philipp Wich2014-09-191-2/+2
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 42620
* firewall: fix heap corruption in fw3_bitlen2netmask() with IPv6 addressesJo-Philipp Wich2014-09-181-2/+2
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 42610
* firewall: fix invalid memory access when processing /128 IPv6 addresses from ↵Jo-Philipp Wich2014-09-171-2/+2
| | | | | | | | ubus, properly emit REDIRECT rules for local port forwards Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 42604
* package/*: remove useless explicit set of function returncodeJohn Crispin2014-08-251-4/+0
| | | | | | | | | | | | | | | | | | | | | | somebody started to set a function returncode in the validation stuff and everybody copies it, e.g. myfunction() { fire_command return $? } a function automatically returns with the last returncode, so we can safely remove the command 'return $?'. reference: http://tldp.org/LDP/abs/html/exit-status.html "The last command executed in the function or script determines the exit status." Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com> SVN-Revision: 42278
* firewall: the firewall did not start properly on bootJohn Crispin2014-08-211-1/+1
| | | | | | | | https://dev.openwrt.org/ticket/17593 Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 42233
* firewall: fix potential NULL pointer accessJo-Philipp Wich2014-08-111-2/+2
| | | | | | | | Properly skip struct ifaddr entries with NULL ifa_addr, thanks Kostas Papadopoulos for reporting. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 42138
* firewall: implement selective conntrack flushing (#10225)Jo-Philipp Wich2014-08-111-2/+2
| | | | | | | | | | Utilize the new selective conntrack flushing facility to clear out active conntrack entries referring to old IP addresses after a firewall reload. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 42114
* firewall: implement support for abritary netmasksJo-Philipp Wich2014-07-191-2/+2
| | | | | | | | | | | Properly parse and pass arbritary netmasks to iptables, this allows specifying ranges like '::c23f:eff:fe7a:a094/::ffff:ffff:ffff:ffff' to match the host part of an IPv6 address regardless of the currently active IPv6 prefix. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 41760
* firewall: fix segfault introduced by latest updateJo-Philipp Wich2014-07-101-2/+2
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 41558
* firewall: fix regressions introduced after latest ubus reworkJo-Philipp Wich2014-07-101-2/+2
| | | | | | | | | | The commit 92281eb747b56e748b7c3d754055919c23befdd4 broke fw3_ubus_addresses() so that no addresses where returned at all, this caused fw3 to not emit NAT reflection rules anymore. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 41556
* firewall: fix issue with parsing network optionsJo-Philipp Wich2014-07-031-2/+2
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 41491
* firewall: update to the latest version, adds support for fetching firewall ↵Felix Fietkau2014-07-021-2/+2
| | | | | | | | rules from procd Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 41480
* firewall3: add fw3 zone function to enumerate devicesSteven Barth2014-06-261-2/+2
| | | | SVN-Revision: 41349
* firewall: add support for nat-rules and netifd-proto-originating rulesSteven Barth2014-04-141-2/+2
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 40510
* firewall: update to latest version, fixes a musl build errorFelix Fietkau2014-03-201-2/+2
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 39965
* firewall: fix validation constraintsJo-Philipp Wich2014-02-211-8/+8
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 39649
* firewall: fix several ipset integration issues (#15016)Jo-Philipp Wich2014-02-201-3/+3
| | | | | | | | | | | - Do not consider bitmap storage for IPv6 family sets - Move ipset family parameter before any additional option - Only emit family parameter for hash sets - Do not allow IPv6 iprange for IPv4 sets and vice versa Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 39647
* firewall3: update init.d script to make use of procdJohn Crispin2014-02-181-9/+49
| | | | | | | | add validation data Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 39617
* firewall: don't reload if there were no address or data changesSteven Barth2014-01-191-0/+1
| | | | | | | This fixes packet loss due to reloading firewall every minute with IPv6 implementation of certain ISPs. SVN-Revision: 39332
* firewall: improve logging in hotplug scriptJohn Crispin2014-01-151-1/+1
| | | | | | Signed-off-by: Nathan Hintz <nlhintz@hotmail.com> SVN-Revision: 39300
* firewall: fix handling of tcp_ecn parameterJo-Philipp Wich2013-12-171-2/+2
| | | | | | | | | | | The firewall3 implementation as well as the shell implementation predating it used to process the tcp_ecnoption as boolean while it actually is an integer. Change the code to parse tcp_ecn as integer. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 39122
* firewall: optimize DNAT rules and skip invalid rules and redirects (#14485)Jo-Philipp Wich2013-11-181-2/+2
| | | | | | | | | | - instead of writing one (or more) ACCEPT rules in the filter table for each redirect install a global ctstate DNAT accept rule per zone - discard rules and redirects which have invalid options set instead of silently skipping the invalid values SVN-Revision: 38849
* firewall: Improve ubus supportSteven Barth2013-10-232-3/+3
| | | | | | | | | | * Use network.interface dump call instead of individual status calls to reduce overall netifd lookups and invokes to 1 per fw3 process. * Allow protocol handlers to assign a firewall zone for an interface in the data section to allow for dynamic firewall zone assignment. SVN-Revision: 38504
* firewall: small improvements in nat reflectionJo-Philipp Wich2013-10-101-2/+2
| | | | | | | - do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces - set up reflection for any protocol, not just TCP and UDP SVN-Revision: 38361
* firewall: update to git headJo-Philipp Wich2013-08-141-2/+2
| | | | | | | - uses "-j CT --notrack" instead of deprecated "-j NOTRACK" - fixes support for rule sections with target "NOTRACK" SVN-Revision: 37777
* firewall: update to git headJo-Philipp Wich2013-07-161-2/+2
| | | | | | - handles redirects as port relocations if the dest_ip points to the router itself SVN-Revision: 37374
* firewall: add missing dependenciesFelix Fietkau2013-07-101-1/+1
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 37224
* firewall: allow routed lan<->lan traffic by defaultJo-Philipp Wich2013-07-042-2/+2
| | | | SVN-Revision: 37171
* firewall: update to git headJo-Philipp Wich2013-06-291-2/+2
| | | | | | - uses custom formatting for mac addresses to ensure leading zeroes, required for older iptables mac match parser SVN-Revision: 37082
* firewall: update to git headJo-Philipp Wich2013-06-181-2/+2
| | | | | | - fixes misprocessing of unknown symbolic protocol names SVN-Revision: 36963
* firewall: update to git headJo-Philipp Wich2013-06-181-2/+2
| | | | | | - fixes calculation of IPv4 netmasks derived from 0.0.0.0/0 CIDRs SVN-Revision: 36960
* firewall: update to git headJo-Philipp Wich2013-06-131-2/+2
| | | | | | - properly process intermediate "!" options in argument list (fixes negated ipsets) SVN-Revision: 36935
* firewall: update to git headJo-Philipp Wich2013-06-131-2/+2
| | | | | | - fixes handling of reject target for rule sections with specific destination zone SVN-Revision: 36933
generated by cgit v1.1 at 2024-11-09 20:26:17 +0000