qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-11-24 03:58:35 +02:00
Code

[package] firewall:

Browse Source 
- introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them
	- annotate default traffic rules with names
	- bump version


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@29577 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
jow 2011-12-20 01:10:15 +00:00
parent 84d175a3f2
commit 15a81dae2a
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/firewall/Makefile
View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall PKG_NAME:=firewall
PKG_VERSION:=2 PKG_VERSION:=2
PKG_RELEASE:=42 PKG_RELEASE:=43
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk

5
package/firewall/files/firewall.config
View File

@ -29,6 +29,7 @@ config forwarding
# We need to accept udp packets on port 68, # We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108 # see https://dev.openwrt.org/ticket/4108
config rule config rule
option name Allow-DHCP-Renew
option src wan option src wan
option proto udp option proto udp
option dest_port 68 option dest_port 68
@ -37,6 +38,7 @@ config rule
# Allow IPv4 ping # Allow IPv4 ping
config rule config rule
option name Allow-Ping
option src wan option src wan
option proto icmp option proto icmp
option icmp_type echo-request option icmp_type echo-request
@ -46,6 +48,7 @@ config rule
# Allow DHCPv6 replies # Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381 # see https://dev.openwrt.org/ticket/10381
config rule config rule
option name Allow-DHCPv6
option src wan option src wan
option proto udp option proto udp
option src_ip fe80::/10 option src_ip fe80::/10
@ -57,6 +60,7 @@ config rule
# Allow essential incoming IPv6 ICMP traffic # Allow essential incoming IPv6 ICMP traffic
config rule config rule
option name Allow-ICMPv6-Input
option src wan option src wan
option proto icmp option proto icmp
list icmp_type echo-request list icmp_type echo-request
@ -73,6 +77,7 @@ config rule
# Allow essential forwarded IPv6 ICMP traffic # Allow essential forwarded IPv6 ICMP traffic
config rule config rule
option name Allow-ICMPv6-Forward
option src wan option src wan
option dest * option dest *
option proto icmp option proto icmp

4
package/firewall/files/lib/config.sh
View File

@ -35,6 +35,10 @@ fw_config_get_section() { # <config> <prefix> <type> <name> <default> ...
config_get "${prefix}TYPE" "$config" TYPE config_get "${prefix}TYPE" "$config" TYPE
} }
local enabled
config_get_bool enabled "$config" enabled 1
[ $enabled -eq 1 ] || return 1
[ "$1" == '{' ] && shift [ "$1" == '{' ] && shift
while [ $# -ge 3 ]; do while [ $# -ge 3 ]; do
local type=$1 local type=$1