[1/4] firewall: Drop support for blocking P2P protocols.
Commit Message
The main P2P (peer-to-peer) aera has passed for several year now, so
this kind of feature is realy out-dated.
The feature only supports a handfull of P2P protocols (mostly unencrypted)
for applications, which have been superseeded by various other
applications and protocols.
So, this fairly is not longer required and safely can be dropped.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
config/firewall/rules.pl | 23 -----------------------
1 file changed, 23 deletions(-)
Comments
Acked-by: Peter Müller <peter.mueller@ipfire.org>
> The main P2P (peer-to-peer) aera has passed for several year now, so
> this kind of feature is realy out-dated.
>
> The feature only supports a handfull of P2P protocols (mostly unencrypted)
> for applications, which have been superseeded by various other
> applications and protocols.
>
> So, this fairly is not longer required and safely can be dropped.
>
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> config/firewall/rules.pl | 23 -----------------------
> 1 file changed, 23 deletions(-)
>
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 9d280045a..fea6874a4 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -70,12 +70,9 @@ my %locationsettings = (
> "LOCATIONBLOCK_ENABLED" => "off"
> );
>
> -my @p2ps=();
> -
> my $configfwdfw = "${General::swroot}/firewall/config";
> my $configinput = "${General::swroot}/firewall/input";
> my $configoutgoing = "${General::swroot}/firewall/outgoing";
> -my $p2pfile = "${General::swroot}/firewall/p2protocols";
> my $locationfile = "${General::swroot}/firewall/locationblock";
> my $configgrp = "${General::swroot}/fwhosts/customgroups";
> my $netsettings = "${General::swroot}/ethernet/settings";
> @@ -125,9 +122,6 @@ sub main {
> &buildrules(\%configfwdfw);
> }
>
> - # Load P2P block rules.
> - &p2pblock();
> -
> # Load Location block rules.
> &locationblock();
>
> @@ -620,23 +614,6 @@ sub time_convert_to_minutes {
> return ($hrs * 60) + $min;
> }
>
> -sub p2pblock {
> - open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
> - my @protocols = ();
> - foreach my $p2pentry (<FILE>) {
> - my @p2pline = split(/\;/, $p2pentry);
> - next unless ($p2pline[2] eq "off");
> -
> - push(@protocols, "--$p2pline[1]");
> - }
> - close(FILE);
> -
> - run("$IPTABLES -F P2PBLOCK");
> - if (@protocols) {
> - run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
> - }
> -}
> -
> sub locationblock {
> # Flush iptables chain.
> run("$IPTABLES -F LOCATIONBLOCK");
Thank you for this.
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
> On 14 Feb 2022, at 19:03, Stefan Schantl <stefan.schantl@ipfire.org> wrote:
>
> The main P2P (peer-to-peer) aera has passed for several year now, so
> this kind of feature is realy out-dated.
>
> The feature only supports a handfull of P2P protocols (mostly unencrypted)
> for applications, which have been superseeded by various other
> applications and protocols.
>
> So, this fairly is not longer required and safely can be dropped.
>
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> config/firewall/rules.pl | 23 -----------------------
> 1 file changed, 23 deletions(-)
>
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 9d280045a..fea6874a4 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -70,12 +70,9 @@ my %locationsettings = (
> "LOCATIONBLOCK_ENABLED" => "off"
> );
>
> -my @p2ps=();
> -
> my $configfwdfw = "${General::swroot}/firewall/config";
> my $configinput = "${General::swroot}/firewall/input";
> my $configoutgoing = "${General::swroot}/firewall/outgoing";
> -my $p2pfile = "${General::swroot}/firewall/p2protocols";
> my $locationfile = "${General::swroot}/firewall/locationblock";
> my $configgrp = "${General::swroot}/fwhosts/customgroups";
> my $netsettings = "${General::swroot}/ethernet/settings";
> @@ -125,9 +122,6 @@ sub main {
> &buildrules(\%configfwdfw);
> }
>
> - # Load P2P block rules.
> - &p2pblock();
> -
> # Load Location block rules.
> &locationblock();
>
> @@ -620,23 +614,6 @@ sub time_convert_to_minutes {
> return ($hrs * 60) + $min;
> }
>
> -sub p2pblock {
> - open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
> - my @protocols = ();
> - foreach my $p2pentry (<FILE>) {
> - my @p2pline = split(/\;/, $p2pentry);
> - next unless ($p2pline[2] eq "off");
> -
> - push(@protocols, "--$p2pline[1]");
> - }
> - close(FILE);
> -
> - run("$IPTABLES -F P2PBLOCK");
> - if (@protocols) {
> - run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
> - }
> -}
> -
> sub locationblock {
> # Flush iptables chain.
> run("$IPTABLES -F LOCATIONBLOCK");
> --
> 2.30.2
>
@@ -70,12 +70,9 @@ my %locationsettings = (
"LOCATIONBLOCK_ENABLED" => "off"
);
-my @p2ps=();
-
my $configfwdfw = "${General::swroot}/firewall/config";
my $configinput = "${General::swroot}/firewall/input";
my $configoutgoing = "${General::swroot}/firewall/outgoing";
-my $p2pfile = "${General::swroot}/firewall/p2protocols";
my $locationfile = "${General::swroot}/firewall/locationblock";
my $configgrp = "${General::swroot}/fwhosts/customgroups";
my $netsettings = "${General::swroot}/ethernet/settings";
@@ -125,9 +122,6 @@ sub main {
&buildrules(\%configfwdfw);
}
- # Load P2P block rules.
- &p2pblock();
-
# Load Location block rules.
&locationblock();
@@ -620,23 +614,6 @@ sub time_convert_to_minutes {
return ($hrs * 60) + $min;
}
-sub p2pblock {
- open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
- my @protocols = ();
- foreach my $p2pentry (<FILE>) {
- my @p2pline = split(/\;/, $p2pentry);
- next unless ($p2pline[2] eq "off");
-
- push(@protocols, "--$p2pline[1]");
- }
- close(FILE);
-
- run("$IPTABLES -F P2PBLOCK");
- if (@protocols) {
- run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
- }
-}
-
sub locationblock {
# Flush iptables chain.
run("$IPTABLES -F LOCATIONBLOCK");