From patchwork Mon Feb 14 19:03:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefan Schantl X-Patchwork-Id: 5162 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4JyDBr5NBrz3wsl for ; Mon, 14 Feb 2022 19:03:16 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4JyDBp4pCCz3Yn; Mon, 14 Feb 2022 19:03:14 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4JyDBp4H1Wz2yWd; Mon, 14 Feb 2022 19:03:14 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4JyDBn5DTjz2y3N for ; Mon, 14 Feb 2022 19:03:13 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4JyDBn0R6Yz1TX; Mon, 14 Feb 2022 19:03:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1644865393; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Uuo/NS/1lHUhnvhM5tld4YIxSV1y5qKOilrhnwLJF40=; b=ApepXsU9V/f4RLnV/j4QAHiOq6l6VAs/muFA2iCY46R2bm0f3TFlqcfA/hZ+PRm2IzoNcv aQ2+FGN62A+hd61f4AvHYVm3Sz7VQb0H9FqVGjLzXFXxWN5hClYb11Bi+/h9VX2JJ9eS25 RwSPO+J0VZ3zlTxsPjyZekr3VR8vkrAZ0iRBrzGXpdMRAr9MqE6DJUtnYoh2yK+NB7CSUV ipuq/thjyYmCCA9HOjXkgkrZHvQrZ2FBBt0pgr/nkCeGAF+F7QKWYuEvCl7dqeiLhncQMT 4OX4BriJ8CzokusWB3jovj4OPPVQAuyhP/ZKY2uHSW4GAGoRAFJaZJbeC0KOog== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1644865393; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Uuo/NS/1lHUhnvhM5tld4YIxSV1y5qKOilrhnwLJF40=; b=w5+4pLFgp6681aO3RwgRsaepRmZAKdVuHzfFn4UepkoBUEFiZjbSWTN0elkz808cQuxq6Z HQCMH1sAZuWSAoBg== From: Stefan Schantl To: development@lists.ipfire.org Subject: [PATCH 1/4] firewall: Drop support for blocking P2P protocols. Date: Mon, 14 Feb 2022 20:03:04 +0100 Message-Id: <20220214190307.4086-1-stefan.schantl@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" The main P2P (peer-to-peer) aera has passed for several year now, so this kind of feature is realy out-dated. The feature only supports a handfull of P2P protocols (mostly unencrypted) for applications, which have been superseeded by various other applications and protocols. So, this fairly is not longer required and safely can be dropped. Signed-off-by: Stefan Schantl Acked-by: Peter Müller Acked-by: Michael Tremer --- config/firewall/rules.pl | 23 ----------------------- 1 file changed, 23 deletions(-) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 9d280045a..fea6874a4 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -70,12 +70,9 @@ my %locationsettings = ( "LOCATIONBLOCK_ENABLED" => "off" ); -my @p2ps=(); - my $configfwdfw = "${General::swroot}/firewall/config"; my $configinput = "${General::swroot}/firewall/input"; my $configoutgoing = "${General::swroot}/firewall/outgoing"; -my $p2pfile = "${General::swroot}/firewall/p2protocols"; my $locationfile = "${General::swroot}/firewall/locationblock"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; my $netsettings = "${General::swroot}/ethernet/settings"; @@ -125,9 +122,6 @@ sub main { &buildrules(\%configfwdfw); } - # Load P2P block rules. - &p2pblock(); - # Load Location block rules. &locationblock(); @@ -620,23 +614,6 @@ sub time_convert_to_minutes { return ($hrs * 60) + $min; } -sub p2pblock { - open(FILE, "<$p2pfile") or die "Unable to read $p2pfile"; - my @protocols = (); - foreach my $p2pentry () { - my @p2pline = split(/\;/, $p2pentry); - next unless ($p2pline[2] eq "off"); - - push(@protocols, "--$p2pline[1]"); - } - close(FILE); - - run("$IPTABLES -F P2PBLOCK"); - if (@protocols) { - run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP"); - } -} - sub locationblock { # Flush iptables chain. run("$IPTABLES -F LOCATIONBLOCK");