From patchwork Sun May 30 14:21:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 4383 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4FtLFj0MhWz3wc6 for ; Sun, 30 May 2021 14:21:29 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4FtLFg0RP3z10D; Sun, 30 May 2021 14:21:27 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4FtLFf5V1pz2yNJ; Sun, 30 May 2021 14:21:26 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4FtLFd2JXGz2xLb for ; Sun, 30 May 2021 14:21:25 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4FtLFc3TkXzlG for ; Sun, 30 May 2021 14:21:24 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1622384484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=DyyKHcq22HG3FO/a1ghG8M1wi6qEdVS4DZc+ir86YS8=; b=qB9t1GMshGdBQXpQK8RQHqhpGcuTWkBhWFRg2JZyNFmaelW2EbshnU/ePYx+7+lveJHrvC hqtrgEFLCaAhjsCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1622384484; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=DyyKHcq22HG3FO/a1ghG8M1wi6qEdVS4DZc+ir86YS8=; b=NXrvVLQeL01axQ81kPryP8uwGKVWAYptMp6vLQpR85f2mivQzdmdpd+/wKtRU072pxBdFz FI7s1TyV3Y8xqTcggwZrNii00uYjGHeVXS13gnLnpeChH/BiUu0Vja3+VWcM7Z0AL6x5AB b7mJWwcRsKnHpbZUF+i4ewTlI8d0aopY2akd8TkZ01WnkvHLSXXM+3eikklRdRiArv9kxm Awx42dahvY5bY88whz484t627VIhsJYQGe8Tpnj+AhL5Pq32lPzbJ0/RqXOV326vyJ/LA3 0s12s+Sf8GZ/KqePR9RXsIRHpef/pd1CnJhz2tvlH/XXbybvX4znlxMhfqCDjA== From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init Date: Sun, 30 May 2021 16:21:20 +0200 Message-Id: <20210530142120.7245-1-matthias.fischer@ipfire.org> X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25 all ALGs were removed from UI. But they remained - somehow - in the initscript (firewall). I tried to remove the remnants - hopefully in the correct way. Signed-off-by: Matthias Fischer Acked-by: Peter Müller --- src/initscripts/system/firewall | 65 +-------------------------------- 1 file changed, 1 insertion(+), 64 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index dd9f1a484..1e558ee86 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -98,74 +98,11 @@ iptables_init() { iptables -t raw -N CONNTRACK iptables -t raw -A PREROUTING -j CONNTRACK - # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/) + # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/) # GRE (always enabled) modprobe nf_conntrack_proto_gre - # SIP - if [ "${CONNTRACK_SIP}" = "on" ]; then - modprobe nf_nat_sip - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper sip -j ACCEPT - for proto in udp tcp; do - iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip - done - fi - - # H.323 - if [ "${CONNTRACK_H323}" = "on" ]; then - modprobe nf_nat_h323 - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper h323 -j ACCEPT - - # Gatekeeper RAS - iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS - - # Q.931 - iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931 - fi - - # FTP - if [ "${CONNTRACK_FTP}" = "on" ]; then - modprobe nf_nat_ftp - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT - iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp - fi - - # PPTP - if [ "${CONNTRACK_PPTP}" = "on" ]; then - modprobe nf_nat_pptp - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper pptp -j ACCEPT - iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp - fi - - # TFTP - if [ "${CONNTRACK_TFTP}" = "on" ]; then - modprobe nf_nat_tftp - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper tftp -j ACCEPT - iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp - fi - - # IRC - if [ "${CONNTRACK_IRC}" = "on" ]; then - modprobe nf_nat_irc - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper irc -j ACCEPT - iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc - fi - - # Amanda - if [ "${CONNTRACK_AMANDA}" = "on" ]; then - modprobe nf_nat_amanda - iptables -A CONNTRACK -m conntrack --ctstate RELATED \ - -m helper --helper amanda -j ACCEPT - iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda - fi - # Fix for braindead ISPs iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu