mtk-20170518/package/network/config/firewall, branch reboot MTK 20170518 : Mediatek SDK based on OpenWRT Barrier Breaker firewall: drop invalid by default, remove chain indirection, fix invert flags (#21738) 2016-01-29T17:26:41+00:00 Jo-Philipp Wich jow@openwrt.org 2016-01-29T17:26:41+00:00 6064710b90b6138c3471129090ab4192710be42c * Enable drop_invalid by default to catch unnatted packets (#21738) * Fix processing of inversions for -i, -o, -s, -d and -p flags * Remove delegate_* chain indirection but rely on xt_id to identify own rules Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 48551 
* Enable drop_invalid by default to catch unnatted packets (#21738)
* Fix processing of inversions for -i, -o, -s, -d and -p flags
* Remove delegate_* chain indirection but rely on xt_id to identify own rules

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 48551
firewall: add CONFIG_IPV6 to PKG_CONFIG_DEPENDS to fix a rebuild error 2016-01-18T13:21:37+00:00 Felix Fietkau nbd@openwrt.org 2016-01-18T13:21:37+00:00 614ebec4d2d8da12a062b3d96c22058fdd584d9f Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48315 
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 48315
firewall: move to git.openwrt.org 2016-01-04T15:13:10+00:00 Felix Fietkau nbd@openwrt.org 2016-01-04T15:13:10+00:00 9632c0043510666467398e6dc455ccbfed81248e Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 48128 
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 48128
firewall: allow DHCPv6 traffic to/from fc00::/6 instead of fe80::/10 2015-09-25T08:41:12+00:00 Jo-Philipp Wich jow@openwrt.org 2015-09-25T08:41:12+00:00 f30ccc899143f8752096c8797add417cd56e6559 There is no RFC requirement that DHCPv6 servers must reply with a link local address and some ISP servers in the wild appear to using addresses in the ULA range to send DHCPv6 offers. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 47048 
There is no RFC requirement that DHCPv6 servers must reply with a link local
address and some ISP servers in the wild appear to using addresses in the ULA
range to send DHCPv6 offers.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 47048
firewall: depend on kmod-ipt-conntrack (#20542) 2015-09-17T15:31:45+00:00 Jo-Philipp Wich jow@openwrt.org 2015-09-17T15:31:45+00:00 f2a19350fd45d1e15deef90846f9f4a0005d4497 Our ruleset requires kernel support for conntrack state matching, therfore depend on the require kmod. Fixes #20542. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 46990 
Our ruleset requires kernel support for conntrack state matching, therfore
depend on the require kmod. Fixes #20542.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 46990
firewall: Remove src_port from firewall.config to receive dhcpv6 replies 2015-09-11T06:46:35+00:00 Steven Barth cyrus@openwrt.org 2015-09-11T06:46:35+00:00 eb866e413f45d3a742e3f9965f263d2c056072b4 Seems like my second try was again whitespace broken. Sorry for the noise. Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295. Signed-off-by: Anselm Eberhardt <a.eberhardt@cygnusnetworks.de> SVN-Revision: 46842 
Seems like my second try was again whitespace broken. Sorry for the noise.

Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295.

Signed-off-by: Anselm Eberhardt <a.eberhardt@cygnusnetworks.de>

SVN-Revision: 46842
firewall: fix typo in ESP rule 2015-07-27T11:47:20+00:00 Steven Barth cyrus@openwrt.org 2015-07-27T11:47:20+00:00 683188310003b330e6d7303f3da6be717680f59b Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46506 
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 46506
firewall: comply with REC-22, REC-24 of RFC 6092 2015-07-24T10:00:45+00:00 Steven Barth cyrus@openwrt.org 2015-07-24T10:00:45+00:00 f6abd042c29f5a69d56151f884fbf4f4e834e674 Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46478 
Signed-off-by: Steven Barth <steven@midlink.org>

SVN-Revision: 46478
firewall: link iptables extensions dynamically 2015-05-26T11:11:48+00:00 Jo-Philipp Wich jow@openwrt.org 2015-05-26T11:11:48+00:00 35497a04001210a9288b70e9d05afab62ce84c76 Use shared libipt{,4,6}ext.so libraries instead of statically linking the userspace matches into the fw3 executable. As a side effect the match initialization is extremely simplified compared to the weak function pointer juggling performed before. This also fixes the initialization of the multiport match. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 45764 
Use shared libipt{,4,6}ext.so libraries instead of statically linking
the userspace matches into the fw3 executable.

As a side effect the match initialization is extremely simplified
compared to the weak function pointer juggling performed before.

This also fixes the initialization of the multiport match.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 45764
firewall: Allow IGMP and MLD input on WAN 2015-05-05T13:22:41+00:00 Steven Barth cyrus@openwrt.org 2015-05-05T13:22:41+00:00 d534883a52925f39c2579e8da45fab7ca57ad84b The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> SVN-Revision: 45613 
The WAN port should at least respond to IGMP and MLD queries as
otherwise a snooping bridge/switch might drop traffic.

RFC4890 recommends to leave IGMP and MLD unfiltered as they are always
link-scoped anyways.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

SVN-Revision: 45613