configs: enable netfilter targets/matches OEM firewall scripts need#57
Closed
lacraig2 wants to merge 1 commit into
Closed
configs: enable netfilter targets/matches OEM firewall scripts need#57lacraig2 wants to merge 1 commit into
lacraig2 wants to merge 1 commit into
Conversation
Rehosted router firmware regenerates its whole ruleset from nvram and
loads it with `iptables-restore`. iptables resolves match/target names
kernel-side at COMMIT, and restore is atomic per table, so a single
unknown target discards the entire table and aborts the remaining ones
- the guest ends up with no firewall at all.
Seen on the RV130 (armel/4.10): /sbin/rc writes /tmp/.ipt, then
iptables-restore: line 52 failed <- COMMIT of *mangle
iptables: No chain/target/match by that name
ip6tables-restore: line 22 failed
Line 52 is the *mangle COMMIT; the first substantive rules in that
table are `-j LOG --log-prefix "URL Filter "/"ACL Allow "/"ACL Drop "`.
xt_LOG was not built in (only the nf_log core, via NFLOG), and the
guest cannot load modules, so nothing could rescue it.
Counting rule fragments in that firmware's /sbin/rc, the targets it
emits are ACCEPT, DROP, MARK, LOG, DNAT, DSCP, RETURN, TRIGGER, SNAT,
REJECT, QUEUE, IPS, CONNMARK, LED, TCPMSS, and the matches are state,
tcp, limit, udp, mark, iprange, webstr, physdev, mac, ipv6header,
tunnel, tcpmss, dscp, 6to6. Everything in-tree that was missing is
enabled here for both 4.10 and 6.13:
- xt_LOG (+ NF_LOG_IPV4/IPV6, pulled in by select)
- DSCP/TOS target and dscp/tos match
- LED target, plus the LEDS_CLASS/LEDS_TRIGGERS/NEW_LEDS it depends
on (XT_TARGET_LED was already listed for 6.13 but silently
dropped, since no LED class was enabled)
- ip6tables ah/eui64/frag/hl/ipv6header/mh/hbh-dst/rt matches
- conntrack+NAT helpers for H.323, IRC, PPTP (with GRE) and SIP,
which the device kernel has and which router NAT paths expect
Still unavailable, and out of scope for a config change: TRIGGER, IPS,
webstr, tunnel and 6to6 are out-of-tree Broadcom/vendor modules, and
the legacy QUEUE target and ULOG were removed upstream long ago
(NFQUEUE and NFLOG are the replacements, both already enabled).
Verified by building 4.10/armel: the resulting .config has
CONFIG_NETFILTER_XT_TARGET_LOG=y, NF_LOG_IPV4/IPV6=y, XT_TARGET_DSCP,
XT_MATCH_DSCP, the IP6_NF_MATCH_* set and NF_NAT_{SIP,IRC,PPTP,H323}.
`--config-only` lint is clean for both versions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded.