From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 1 Sep 2011 20:37:22 +0000 (+0000)
Subject: firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead... 
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=995face56d5d8f701a505dd2ed9d827a69384675;p=openwrt%2Fstaging%2Flinusw.git

firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)

SVN-Revision: 28148
---

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index b192ad330e..597a37e140 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=34
+PKG_RELEASE:=35
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index 185fffb98b..f2cde1c470 100644
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -1,4 +1,4 @@
-# Copyright (C) 2009-2010 OpenWrt.org
+# Copyright (C) 2009-2011 OpenWrt.org
 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
 
 FW_INITIALIZED=
@@ -66,17 +66,17 @@ fw_load_defaults() {
 	done
 	fw_sysctl_interface all
 
+	fw add i f INPUT   ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+	fw add i f OUTPUT  ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+	fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+
 	[ $defaults_drop_invalid == 1 ] && {
-		fw add i f INPUT   DROP { -m state --state INVALID }
-		fw add i f OUTPUT  DROP { -m state --state INVALID }
-		fw add i f FORWARD DROP { -m state --state INVALID }
+		fw add i f INPUT   DROP { -m conntrack --ctstate INVALID }
+		fw add i f OUTPUT  DROP { -m conntrack --ctstate INVALID }
+		fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
 		FW_NOTRACK_DISABLED=1
 	}
 
-	fw add i f INPUT   ACCEPT { -m state --state RELATED,ESTABLISHED }
-	fw add i f OUTPUT  ACCEPT { -m state --state RELATED,ESTABLISHED }
-	fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
-
 	fw add i f INPUT  ACCEPT { -i lo }
 	fw add i f OUTPUT ACCEPT { -o lo }