[backfire] firewall: sync with trunk