maple/istoreos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package: support fullcone nat

Browse Source
This commit is contained in:
jjm2473 2022-01-14 11:41:18 +08:00
parent 702307b528
commit be64134fea
7 changed files with 167 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/network/config/firewall/Makefile
View File

@ -28,7 +28,7 @@ define Package/firewall
SECTION:=net
CATEGORY:=Base system
TITLE:=OpenWrt C Firewall
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat +iptables-mod-fullconenat
endef
define Package/firewall/description

1
package/network/config/firewall/files/firewall.config
View File

@ -3,6 +3,7 @@ config defaults
option input ACCEPT
option output ACCEPT
option forward REJECT
option fullcone 0
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1

58
package/network/config/firewall/patches/fullconenat.patch Normal file
View File

@ -0,0 +1,58 @@
--- a/defaults.c
+++ b/defaults.c
@@ -48,6 +48,8 @@
FW3_OPT("synflood_protect", bool, defaults, syn_flood),
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
+
+ FW3_OPT("fullcone", bool, defaults, fullcone),
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
diff --git a/options.h b/options.h
--- a/options.h
+++ b/options.h
@@ -297,6 +297,7 @@
enum fw3_reject_code any_reject_code;
bool syn_flood;
+ bool fullcone;
struct fw3_limit syn_flood_rate;
bool tcp_syncookies;
diff --git a/zones.c b/zones.c
--- a/zones.c
+++ b/zones.c
@@ -627,6 +627,7 @@
struct fw3_address *msrc;
struct fw3_address *mdest;
struct fw3_ipt_rule *r;
+ struct fw3_defaults *defs = &state->defaults;
if (!fw3_is_family(zone, handle->family))
return;
@@ -712,8 +713,22 @@
{
r = fw3_ipt_rule_new(handle);
fw3_ipt_rule_src_dest(r, msrc, mdest);
- fw3_ipt_rule_target(r, "MASQUERADE");
- fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+ /*FIXME: Workaround for FULLCONE-NAT*/
+ if(defs->fullcone)
+ {
+ warn("%s will enable FULLCONE-NAT", zone->name);
+ fw3_ipt_rule_target(r, "FULLCONENAT");
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+ r = fw3_ipt_rule_new(handle);
+ fw3_ipt_rule_src_dest(r, msrc, mdest);
+ fw3_ipt_rule_target(r, "FULLCONENAT");
+ fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
+ }
+ else
+ {
+ fw3_ipt_rule_target(r, "MASQUERADE");
+ fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+ }
}
}
}

79
package/network/fullconenat/Makefile Normal file
View File

@ -0,0 +1,79 @@
#
# Copyright (C) 2018 Chion Tang <tech@chionlab.moe>
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
include $(INCLUDE_DIR)/kernel.mk
PKG_NAME:=fullconenat
PKG_RELEASE:=1
PKG_SOURCE_DATE:=2020-05-09
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/llccd/netfilter-full-cone-nat.git
PKG_MIRROR_HASH:=bec75e2c0dc1103928861f8ea8f3f9ada63731103099a884222e15eab0a2fff8
PKG_SOURCE_VERSION:=cc30ca6031ef5dca5bdb10cfd5ffc0c79425af9e
PKG_LICENSE:=GPL-2.0
PKG_LICENSE_FILES:=LICENSE
include $(INCLUDE_DIR)/package.mk
define Package/iptables-mod-fullconenat
SUBMENU:=Firewall
SECTION:=net
CATEGORY:=Network
TITLE:=FULLCONENAT iptables extension
DEPENDS:=iptables +kmod-ipt-fullconenat
MAINTAINER:=Chion Tang <tech@chionlab.moe>
endef
define Package/iptables-mod-fullconenat/install
$(INSTALL_DIR) $(1)/usr/lib/iptables
$(INSTALL_BIN) $(PKG_BUILD_DIR)/libipt_FULLCONENAT.so $(1)/usr/lib/iptables
endef
define Package/ip6tables-mod-fullconenat
SUBMENU:=Firewall
SECTION:=net
CATEGORY:=Network
TITLE:=FULLCONENAT ip6tables extension
DEPENDS:=ip6tables +kmod-nf-nat6 +kmod-ipt-fullconenat
MAINTAINER:=Chion Tang <tech@chionlab.moe>
endef
define Package/ip6tables-mod-fullconenat/install
$(INSTALL_DIR) $(1)/usr/lib/iptables
$(INSTALL_BIN) $(PKG_BUILD_DIR)/libip6t_FULLCONENAT.so $(1)/usr/lib/iptables
endef
define KernelPackage/ipt-fullconenat
SUBMENU:=Netfilter Extensions
TITLE:=FULLCONENAT netfilter module
DEPENDS:=+kmod-nf-ipt +kmod-nf-nat
MAINTAINER:=Chion Tang <tech@chionlab.moe>
KCONFIG:=CONFIG_NF_CONNTRACK_EVENTS=y CONFIG_NF_CONNTRACK_CHAIN_EVENTS=y
FILES:=$(PKG_BUILD_DIR)/xt_FULLCONENAT.ko
endef
include $(INCLUDE_DIR)/kernel-defaults.mk
define Build/Prepare
$(call Build/Prepare/Default)
$(CP) ./files/Makefile $(PKG_BUILD_DIR)/
endef
define Build/Compile
$(KERNEL_MAKE) M="$(PKG_BUILD_DIR)" \
EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
$(PKG_EXTRA_KCONFIG) \
modules
$(call Build/Compile/Default)
endef
$(eval $(call BuildPackage,iptables-mod-fullconenat))
$(eval $(call BuildPackage,ip6tables-mod-fullconenat))
$(eval $(call KernelPackage,ipt-fullconenat))

11
package/network/fullconenat/files/Makefile Normal file
View File

@ -0,0 +1,11 @@
all: libipt_FULLCONENAT.so libip6t_FULLCONENAT.so
libipt_FULLCONENAT.so: libipt_FULLCONENAT.o
$(CC) -shared -lxtables -o $@ $^;
libipt_FULLCONENAT.o: libipt_FULLCONENAT.c
$(CC) ${CFLAGS} -fPIC -D_INIT=$*_init -c -o $@ $<;
libip6t_FULLCONENAT.so: libip6t_FULLCONENAT.o
$(CC) -shared -lxtables -o $@ $^;
libip6t_FULLCONENAT.o: libip6t_FULLCONENAT.c
$(CC) ${CFLAGS} -fPIC -D_INIT=$*_init -c -o $@ $<;
obj-m += xt_FULLCONENAT.o

17
package/network/fullconenat/patches/000-printk.patch Normal file
View File

@ -0,0 +1,17 @@
diff --git a/xt_FULLCONENAT.c b/xt_FULLCONENAT.c
index 9e52eba..8658c5f 100644
--- a/xt_FULLCONENAT.c
+++ b/xt_FULLCONENAT.c
@@ -697,9 +697,11 @@ static struct xt_target tg_reg[] __read_mostly = {
static int __init fullconenat_tg_init(void)
{
+ printk(KERN_INFO "xt_FULLCONENAT: RFC3489 Full Cone NAT module\n"
+ "xt_FULLCONENAT: Copyright (C) 2018 Chion Tang <tech@chionlab.moe>\n");
wq = create_singlethread_workqueue("xt_FULLCONENAT");
if (wq == NULL) {
- printk("xt_FULLCONENAT: warning: failed to create workqueue\n");
+ printk(KERN_WARNING "xt_FULLCONENAT: warning: failed to create workqueue\n");
}
return xt_register_targets(tg_reg, ARRAY_SIZE(tg_reg));

20
package/network/fullconenat/patches/910-fix-linux4_4.patch
View File

@ -1,20 +0,0 @@
--- a/libipt_FULLCONENAT.c
+++ b/libipt_FULLCONENAT.c
@@ -1,3 +1,7 @@
+#if !defined(__GLIBC__)
+/* avoid IPPROTO_IP,in_addr,in6_addr,sockaddr_in6,etc. redefine */
+#define _LIBC_COMPAT_H
+#endif
#include <stdio.h>
#include <netdb.h>
#include <string.h>
--- a/libip6t_FULLCONENAT.c
+++ b/libip6t_FULLCONENAT.c
@@ -1,3 +1,7 @@
+#if !defined(__GLIBC__)
+/* avoid IPPROTO_IP,in_addr,in6_addr,sockaddr_in6,etc. redefine */
+#define _LIBC_COMPAT_H
+#endif
#include <stdio.h>
#include <netdb.h>
#include <string.h>