fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall4: enable hardware offloading by default

Browse Source 
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
This commit is contained in:
Tianling Shen 2023-05-12 15:50:27 +08:00
parent e6c7d13d23
commit 02fa53f246
No known key found for this signature in database
GPG Key ID: 6850B6345C862176
1 changed files with 15 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
package/network/config/firewall4/patches/001-firewall4-add-support-for-fullcone-nat.patch
View File

@ -22,19 +22,20 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
--- a/root/etc/config/firewall
+++ b/root/etc/config/firewall
@@ -5,6 +5,9 @@ config defaults
@@ -5,6 +5,10 @@ config defaults
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
+ option flow_offloading 1
+ option fullcone 1
+ option fullcone6 0
+ option flow_offloading 1
+ option flow_offloading_hw 1
+ option fullcone 1
+ option fullcone6 0
config zone
option name lan
--- a/root/usr/share/firewall4/templates/ruleset.uc
+++ b/root/usr/share/firewall4/templates/ruleset.uc
@@ -316,6 +316,12 @@ table inet fw4 {
@@ -320,6 +320,12 @@ table inet fw4 {
{% for (let redirect in fw4.redirects(`dstnat_${zone.name}`)): %}
{%+ include("redirect.uc", { fw4, redirect }) %}
{% endfor %}
@ -47,7 +48,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
{% fw4.includes('chain-append', `dstnat_${zone.name}`) %}
}
@@ -326,20 +326,26 @@ table inet fw4 {
@@ -330,20 +336,26 @@ table inet fw4 {
{% for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
{%+ include("redirect.uc", { fw4, redirect }) %}
{% endfor %}
@ -91,7 +92,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
const fs = require("fs");
const uci = require("uci");
const ubus = require("ubus");
@@ -428,6 +430,25 @@ function nft_try_hw_offload(devices) {
@@ -490,6 +492,25 @@ function nft_try_hw_offload(devices) {
return (rc == 0);
}
@ -117,7 +118,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
return {
read_kernel_version: function() {
@@ -778,6 +799,18 @@ return {
@@ -840,6 +861,18 @@ return {
warn(`[!] ${msg}\n`);
},
@ -136,7 +137,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
get: function(sid, opt) {
return this.cursor.get("firewall", sid, opt);
},
@@ -959,6 +992,21 @@ return {
@@ -1021,6 +1054,21 @@ return {
}
},
@ -158,7 +159,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
parse_policy: function(val) {
return this.parse_enum(val, [
"accept",
@@ -1398,6 +1446,7 @@ return {
@@ -1460,6 +1508,7 @@ return {
"dnat",
"snat",
"masquerade",
@ -166,7 +167,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
"accept",
"reject",
"drop"
@@ -1865,6 +1914,8 @@ return {
@@ -1927,6 +1976,8 @@ return {
}
let defs = this.parse_options(data, {
@ -175,7 +176,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
input: [ "policy", "drop" ],
output: [ "policy", "drop" ],
forward: [ "policy", "drop" ],
@@ -1899,6 +1950,11 @@ return {
@@ -1961,6 +2012,11 @@ return {
delete defs.syn_flood;
@ -187,7 +188,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
this.state.defaults = defs;
},
@@ -2124,10 +2180,23 @@ return {
@@ -2186,10 +2242,23 @@ return {
zone.related_subnets = related_subnets;
zone.related_physdevs = related_physdevs;
@ -207,7 +208,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
+ this.myinfo_section(data, "IPv6 fullcone enabled for zone '" + zone.name + "'");
+ }
+ }
- if ((zone.auto_helper && !(zone.masq || zone.masq6)) || length(zone.helper)) {
+ if ((zone.auto_helper && !(zone.masq || zone.masq6 || this.state.defaults.fullcone || this.state.defaults.fullcone6)) || length(zone.helper)) {
zone.dflags.helper = true;