Skip to content

Commit 0f05bb9

Browse files
nicholas-opensourceQiuSimonsmsylgj
committed
Fix firewall4 fullcone-nat
Refresh patches Co-authored-by: QiuSimons <45143996+QiuSimons@users.noreply.github.com> Co-authored-by: SiYao Mo <1388852+msylgj@users.noreply.github.com> Signed-off-by: Nicholas Sun <nicholas-sun@outlook.com>
1 parent 52e0329 commit 0f05bb9

4 files changed

Lines changed: 92 additions & 152 deletions

File tree

‎PATCH/firewall/999-01-firewall4-add-fullcone-support.patch‎

Lines changed: 47 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
From d4081c498ddca184578903fe5199d390bbc0707b Mon Sep 17 00:00:00 2001
1+
From aa3b56e289fba7425e649a608c333622ffd9c367 Mon Sep 17 00:00:00 2001
22
From: Syrone Wong <wong.syrone@gmail.com>
33
Date: Sat, 9 Apr 2022 13:24:19 +0800
44
Subject: [PATCH] firewall4: add fullcone support
@@ -8,96 +8,82 @@ fullcone is drop-in replacement of masq for non-udp traffic
88
add runtime fullcone rule check, disable it globally if fullcone expr is
99
invalid
1010

11-
defaults.fullcone is the global switch, while zone.fullcone4 and
12-
zone.fullcone6 are switches for IPv4 and IPv6 respectively, most
13-
IPv6 traffic do NOT need this FullCone NAT functionality.
11+
defaults.fullcone and defaults.fullcone6 are switches for IPv4 and IPv6
12+
respectively, most IPv6 traffic do NOT need this FullCone NAT functionality.
13+
14+
Renew: ZiMing Mo <msylgj@immortalwrt.org>
1415
---
15-
root/etc/config/firewall | 3 +
16-
root/usr/share/firewall4/templates/ruleset.uc | 16 +++-
17-
.../firewall4/templates/zone-fullcone.uc | 4 +
18-
root/usr/share/ucode/fw4.uc | 76 ++++++++++++++++++-
19-
4 files changed, 96 insertions(+), 3 deletions(-)
16+
root/etc/config/firewall | 2 ++
17+
root/usr/share/firewall4/templates/ruleset.uc | 16 ++++++++++++++--
18+
.../firewall4/templates/zone-fullcone.uc | 4 ++++
19+
root/usr/share/ucode/fw4.uc | 69 ++++++++++++++++++-
20+
4 files changed, 89 insertions(+), 4 deletions(-)
2021
create mode 100644 root/usr/share/firewall4/templates/zone-fullcone.uc
2122

22-
diff --git a/root/etc/config/firewall b/root/etc/config/firewall
23-
index b9a4647..7187723 100644
2423
--- a/root/etc/config/firewall
2524
+++ b/root/etc/config/firewall
26-
@@ -5,6 +5,7 @@ config defaults
25+
@@ -5,6 +5,10 @@ config defaults
2726
option forward REJECT
2827
# Uncomment this line to disable ipv6 rules
2928
# option disable_ipv6 1
30-
+ option fullcone '1'
29+
+ option flow_offloading 0
30+
+ option flow_offloading_hw 0
31+
+ option fullcone 1
32+
+ option fullcone6 0
3133

3234
config zone
3335
option name lan
34-
@@ -20,6 +21,8 @@ config zone
35-
option input REJECT
36-
option output ACCEPT
37-
option forward REJECT
38-
+ option fullcone4 '1'
39-
+ option fullcone6 '0'
40-
option masq 1
41-
option mtu_fix 1
42-
43-
diff --git a/root/usr/share/firewall4/templates/ruleset.uc b/root/usr/share/firewall4/templates/ruleset.uc
44-
index eaa1f04..e29eae6 100644
4536
--- a/root/usr/share/firewall4/templates/ruleset.uc
4637
+++ b/root/usr/share/firewall4/templates/ruleset.uc
47-
@@ -310,6 +310,12 @@ table inet fw4 {
38+
@@ -320,6 +320,12 @@ table inet fw4 {
4839
{% for (let redirect in fw4.redirects(`dstnat_${zone.name}`)): %}
4940
{%+ include("redirect.uc", { fw4, redirect }) %}
5041
{% endfor %}
51-
+{% if (zone.fullcone4): %}
42+
+{% if (zone.masq && fw4.default_option("fullcone")): %}
5243
+ {%+ include("zone-fullcone.uc", { fw4, zone, family: 4, direction: "dstnat" }) %}
5344
+{% endif %}
54-
+{% if (zone.fullcone6): %}
45+
+{% if (zone.masq6 && fw4.default_option("fullcone6")): %}
5546
+ {%+ include("zone-fullcone.uc", { fw4, zone, family: 6, direction: "dstnat" }) %}
5647
+{% endif %}
5748
{% fw4.includes('chain-append', `dstnat_${zone.name}`) %}
5849
}
5950

60-
@@ -320,20 +326,26 @@ table inet fw4 {
51+
@@ -330,20 +336,26 @@ table inet fw4 {
6152
{% for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
6253
{%+ include("redirect.uc", { fw4, redirect }) %}
6354
{% endfor %}
6455
-{% if (zone.masq): %}
65-
+{% if (zone.masq && !zone.fullcone4): %}
56+
+{% if (zone.masq && !fw4.default_option("fullcone")): %}
6657
{% for (let saddrs in zone.masq4_src_subnets): %}
6758
{% for (let daddrs in zone.masq4_dest_subnets): %}
6859
{%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %}
6960
{% endfor %}
7061
{% endfor %}
7162
{% endif %}
7263
-{% if (zone.masq6): %}
73-
+{% if (zone.masq6 && !zone.fullcone6): %}
64+
+{% if (zone.masq6 && !fw4.default_option("fullcone6")): %}
7465
{% for (let saddrs in zone.masq6_src_subnets): %}
7566
{% for (let daddrs in zone.masq6_dest_subnets): %}
7667
{%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
7768
{% endfor %}
7869
{% endfor %}
7970
{% endif %}
80-
+{% if (zone.fullcone4): %}
71+
+{% if (zone.masq && fw4.default_option("fullcone")): %}
8172
+ {%+ include("zone-fullcone.uc", { fw4, zone, family: 4, direction: "srcnat" }) %}
8273
+{% endif %}
83-
+{% if (zone.fullcone6): %}
74+
+{% if (zone.masq6 && fw4.default_option("fullcone6")): %}
8475
+ {%+ include("zone-fullcone.uc", { fw4, zone, family: 6, direction: "srcnat" }) %}
8576
+{% endif %}
8677
{% fw4.includes('chain-append', `srcnat_${zone.name}`) %}
8778
}
8879

89-
diff --git a/root/usr/share/firewall4/templates/zone-fullcone.uc b/root/usr/share/firewall4/templates/zone-fullcone.uc
90-
new file mode 100644
91-
index 0000000..77d9806
9280
--- /dev/null
9381
+++ b/root/usr/share/firewall4/templates/zone-fullcone.uc
9482
@@ -0,0 +1,4 @@
9583
+{# /usr/share/firewall4/templates/zone-fullcone.uc #}
9684
+ meta nfproto {{ fw4.nfproto(family) }} fullcone comment "!fw4: Handle {{
9785
+ zone.name
9886
+}} {{ fw4.nfproto(family, true) }} fullcone NAT {{ direction }} traffic"
99-
diff --git a/root/usr/share/ucode/fw4.uc b/root/usr/share/ucode/fw4.uc
100-
index 1b4764c..c5716da 100644
10187
--- a/root/usr/share/ucode/fw4.uc
10288
+++ b/root/usr/share/ucode/fw4.uc
10389
@@ -1,3 +1,5 @@
@@ -106,7 +92,7 @@ index 1b4764c..c5716da 100644
10692
const fs = require("fs");
10793
const uci = require("uci");
10894
const ubus = require("ubus");
109-
@@ -428,6 +430,25 @@ function nft_try_hw_offload(devices) {
95+
@@ -490,6 +492,25 @@ function nft_try_hw_offload(devices) {
11096
return (rc == 0);
11197
}
11298

@@ -132,7 +118,7 @@ index 1b4764c..c5716da 100644
132118

133119
return {
134120
read_kernel_version: function() {
135-
@@ -765,6 +786,18 @@ return {
121+
@@ -840,6 +861,18 @@ return {
136122
warn(`[!] ${msg}\n`);
137123
},
138124

@@ -151,7 +137,7 @@ index 1b4764c..c5716da 100644
151137
get: function(sid, opt) {
152138
return this.cursor.get("firewall", sid, opt);
153139
},
154-
@@ -946,6 +979,21 @@ return {
140+
@@ -1021,6 +1054,21 @@ return {
155141
}
156142
},
157143

@@ -173,23 +159,24 @@ index 1b4764c..c5716da 100644
173159
parse_policy: function(val) {
174160
return this.parse_enum(val, [
175161
"accept",
176-
@@ -1385,6 +1433,7 @@ return {
162+
@@ -1460,6 +1508,7 @@ return {
177163
"dnat",
178164
"snat",
179165
"masquerade",
180166
+ "fullcone",
181167
"accept",
182168
"reject",
183169
"drop"
184-
@@ -1852,6 +1901,7 @@ return {
170+
@@ -1927,6 +1976,8 @@ return {
185171
}
186172

187173
let defs = this.parse_options(data, {
188174
+ fullcone: [ "bool", "0" ],
175+
+ fullcone6: [ "bool", "0" ],
189176
input: [ "policy", "drop" ],
190177
output: [ "policy", "drop" ],
191178
forward: [ "policy", "drop" ],
192-
@@ -1884,6 +1934,11 @@ return {
179+
@@ -1961,6 +2012,11 @@ return {
193180

194181
delete defs.syn_flood;
195182

@@ -201,48 +188,29 @@ index 1b4764c..c5716da 100644
201188
this.state.defaults = defs;
202189
},
203190

204-
@@ -1908,6 +1963,8 @@ return {
205-
masq_dest: [ "network", null, PARSE_LIST ],
206-
207-
masq6: [ "bool" ],
208-
+ fullcone4: [ "bool", "0" ],
209-
+ fullcone6: [ "bool", "0" ],
210-
211-
extra: [ "string", null, UNSUPPORTED ],
212-
extra_src: [ "string", null, UNSUPPORTED ],
213-
@@ -1940,6 +1997,18 @@ return {
214-
}
215-
}
216-
217-
+ if (this.state.defaults && !this.state.defaults.fullcone) {
218-
+ this.warn_section(data, "fullcone in defaults not enabled, ignore zone fullcone settings");
219-
+ zone.fullcone4 = false;
220-
+ zone.fullcone6 = false;
221-
+ }
222-
+ if (zone.fullcone4) {
223-
+ this.myinfo_section(data, "IPv4 fullcone enabled for zone '" + zone.name + "'");
224-
+ }
225-
+ if (zone.fullcone6) {
226-
+ this.myinfo_section(data, "IPv6 fullcone enabled for zone '" + zone.name + "'");
227-
+ }
228-
+
229-
if (zone.mtu_fix && this.kernel < 0x040a0000) {
230-
this.warn_section(data, "option 'mtu_fix' requires kernel 4.10 or later");
231-
return;
232-
@@ -2110,10 +2179,15 @@ return {
191+
@@ -2186,10 +2242,23 @@ return {
233192
zone.related_subnets = related_subnets;
234193
zone.related_physdevs = related_physdevs;
235194

236-
+ if (zone.fullcone4 || zone.fullcone6) {
237-
+ zone.dflags.snat = true;
238-
+ zone.dflags.dnat = true;
195+
- if (zone.masq || zone.masq6)
196+
+ if (zone.masq) {
197+
zone.dflags.snat = true;
198+
+ if (this.state.defaults.fullcone) {
199+
+ zone.dflags.dnat = true;
200+
+ this.myinfo_section(data, "IPv4 fullcone enabled for zone '" + zone.name + "'");
201+
+ }
239202
+ }
240203
+
241-
if (zone.masq || zone.masq6)
242-
zone.dflags.snat = true;
204+
+ if (zone.masq6) {
205+
+ zone.dflags.snat = true;
206+
+ if (this.state.defaults.fullcone6) {
207+
+ zone.dflags.dnat = true;
208+
+ this.myinfo_section(data, "IPv6 fullcone enabled for zone '" + zone.name + "'");
209+
+ }
210+
+ }
243211

244212
- if ((zone.auto_helper && !(zone.masq || zone.masq6)) || length(zone.helper)) {
245-
+ if ((zone.auto_helper && !(zone.masq || zone.masq6 || zone.fullcone4 || zone.fullcone6)) || length(zone.helper)) {
213+
+ if ((zone.auto_helper && !(zone.masq || zone.masq6 || this.state.defaults.fullcone || this.state.defaults.fullcone6)) || length(zone.helper)) {
246214
zone.dflags.helper = true;
247215

248-
for (let helper in (length(zone.helper) ? zone.helper : this.state.helpers)) {
216+
for (let helper in (length(zone.helper) ? zone.helper : this.state.helpers)) {

‎PATCH/firewall/libnftnl/001-libnftnl-add-fullcone-expression-support.patch‎

Lines changed: 12 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,32 +13,27 @@ Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
1313
5 files changed, 192 insertions(+)
1414
create mode 100644 src/expr/fullcone.c
1515

16-
diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
17-
index 00c63ab..7dcf403 100644
1816
--- a/include/libnftnl/expr.h
1917
+++ b/include/libnftnl/expr.h
20-
@@ -244,6 +244,12 @@ enum {
21-
NFTNL_EXPR_MASQ_REG_PROTO_MAX,
18+
@@ -245,6 +245,12 @@ enum {
2219
};
2320

24-
+enum {
21+
enum {
2522
+ NFTNL_EXPR_FULLCONE_FLAGS = NFTNL_EXPR_BASE,
2623
+ NFTNL_EXPR_FULLCONE_REG_PROTO_MIN,
2724
+ NFTNL_EXPR_FULLCONE_REG_PROTO_MAX,
2825
+};
2926
+
30-
enum {
27+
+enum {
3128
NFTNL_EXPR_REDIR_REG_PROTO_MIN = NFTNL_EXPR_BASE,
3229
NFTNL_EXPR_REDIR_REG_PROTO_MAX,
33-
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
34-
index 0ae9120..8b8ae38 100644
30+
NFTNL_EXPR_REDIR_FLAGS,
3531
--- a/include/linux/netfilter/nf_tables.h
3632
+++ b/include/linux/netfilter/nf_tables.h
37-
@@ -1433,6 +1433,22 @@ enum nft_masq_attributes {
38-
};
33+
@@ -1464,6 +1464,22 @@ enum nft_masq_attributes {
3934
#define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1)
4035

41-
+/**
36+
/**
4237
+ * enum nft_fullcone_attributes - nf_tables fullcone expression attributes
4338
+ *
4439
+ * @NFTA_FULLCONE_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
@@ -54,24 +49,20 @@ index 0ae9120..8b8ae38 100644
5449
+};
5550
+#define NFTA_FULLCONE_MAX (__NFTA_FULLCONE_MAX - 1)
5651
+
57-
/**
52+
+/**
5853
* enum nft_redir_attributes - nf_tables redirect expression netlink attributes
5954
*
60-
diff --git a/src/Makefile.am b/src/Makefile.am
61-
index c3b0ab9..2718218 100644
55+
* @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
6256
--- a/src/Makefile.am
6357
+++ b/src/Makefile.am
64-
@@ -54,6 +54,7 @@ libnftnl_la_SOURCES = utils.c \
58+
@@ -55,6 +55,7 @@ libnftnl_la_SOURCES = utils.c \
6559
expr/target.c \
6660
expr/tunnel.c \
6761
expr/masq.c \
6862
+ expr/fullcone.c \
6963
expr/redir.c \
7064
expr/hash.c \
7165
expr/socket.c \
72-
diff --git a/src/expr/fullcone.c b/src/expr/fullcone.c
73-
new file mode 100644
74-
index 0000000..aaedd83
7566
--- /dev/null
7667
+++ b/src/expr/fullcone.c
7768
@@ -0,0 +1,167 @@
@@ -242,26 +233,21 @@ index 0000000..aaedd83
242233
+ .build = nftnl_expr_fullcone_build,
243234
+ .output = nftnl_expr_fullcone_snprintf,
244235
+};
245-
diff --git a/src/expr_ops.c b/src/expr_ops.c
246-
index 7248e4f..9dee9f8 100644
247236
--- a/src/expr_ops.c
248237
+++ b/src/expr_ops.c
249-
@@ -19,6 +19,7 @@ extern struct expr_ops expr_ops_limit;
238+
@@ -20,6 +20,7 @@ extern struct expr_ops expr_ops_limit;
250239
extern struct expr_ops expr_ops_log;
251240
extern struct expr_ops expr_ops_lookup;
252241
extern struct expr_ops expr_ops_masq;
253242
+extern struct expr_ops expr_ops_fullcone;
254243
extern struct expr_ops expr_ops_match;
255244
extern struct expr_ops expr_ops_meta;
256245
extern struct expr_ops expr_ops_ng;
257-
@@ -63,6 +64,7 @@ static struct expr_ops *expr_ops[] = {
246+
@@ -65,6 +66,7 @@ static struct expr_ops *expr_ops[] = {
258247
&expr_ops_log,
259248
&expr_ops_lookup,
260249
&expr_ops_masq,
261250
+ &expr_ops_fullcone,
262251
&expr_ops_match,
263252
&expr_ops_meta,
264-
&expr_ops_ng,
265-
--
266-
2.35.1
267-
253+
&expr_ops_ng,

0 commit comments

Comments
 (0)