firewall: update to latest HEAD