From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer <michael.tremer@ipfire.org> To: development@lists.ipfire.org Subject: Re: [PATCH] strongSwan: Bring back firewall rules for permitting ESP and AH traffic Date: Wed, 18 May 2022 17:02:39 +0100 Message-ID: <0F8B032D-8D07-41A5-9739-355685B5EE34@ipfire.org> In-Reply-To: <64c47b49-abd0-737b-5a93-6b621be190e2@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0307636305421691131==" List-Id: <development.lists.ipfire.org> --===============0307636305421691131== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Please see my reply in the bug report: https://bugzilla.ipfire.org/show_bug.c= gi?id=3D12866 > On 18 May 2022, at 16:53, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wr= ote: >=20 > Fixes: #12866 > Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org> > --- > src/patches/strongswan-ipfire.patch | 47 ++++++++++++++++++++--------- > 1 file changed, 33 insertions(+), 14 deletions(-) >=20 > diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-i= pfire.patch > index 0f2be7483..ab04d57e0 100644 > --- a/src/patches/strongswan-ipfire.patch > +++ b/src/patches/strongswan-ipfire.patch > @@ -1,13 +1,13 @@ > -commit 654e2b7688c5fbd4e1fc46648bc1864301fb6027 > -Author: Michael Tremer <michael.tremer(a)ipfire.org> > -Date: Mon Mar 21 19:49:02 2022 +0000 > +commit a3cfab9961cd088fb7df9fa8e646601f8f879762 > +Author: Peter M=C3=BCller <peter.mueller(a)ipfire.org> > +Date: Wed May 18 15:50:34 2022 +0000 >=20 > IPFire modifications to _updown script >=20 > - Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> > + Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org> >=20 > diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in > -index 34eaf68c7..514ecb578 100644 > +index 34eaf68c7..0302fa128 100644 > --- a/src/_updown/_updown.in > +++ b/src/_updown/_updown.in > @@ -242,10 +242,10 @@ up-host:iptables) > @@ -98,7 +98,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT > fi > # > -@@ -342,10 +324,10 @@ up-client:iptables) > +@@ -342,47 +324,34 @@ up-client:iptables) > if [ "$PLUTO_PEER_CLIENT" =3D "$PLUTO_PEER/32" ] > then > logger -t $TAG -p $FAC_PRIO \ > @@ -110,8 +110,17 @@ index 34eaf68c7..514ecb578 100644 > + "client+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT =3D=3D $PLUTO_PEER -- $P= LUTO_ME =3D=3D $PLUTO_MY_CLIENT" > fi > fi > ++ > ++ # Open Firewall for AH + ESP Traffic > ++ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \ > ++ -s $PLUTO_PEER $S_PEER_PORT \ > ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT > ++ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \ > ++ -s $PLUTO_PEER $S_PEER_PORT \ > ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT > ++ > ;; > -@@ -353,36 +335,14 @@ down-client:iptables) > + down-client:iptables) > # connection to client subnet, with (left/right)firewall=3Dyes, going down > # This is used only by the default updown script, not by your custom > # ones, so do not mess with it; see CAUTION comment up at top. > @@ -149,7 +158,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT > fi > # > -@@ -392,10 +352,10 @@ down-client:iptables) > +@@ -392,12 +361,20 @@ down-client:iptables) > if [ "$PLUTO_PEER_CLIENT" =3D "$PLUTO_PEER/32" ] > then > logger -t $TAG -p $FAC_PRIO -- \ > @@ -161,8 +170,18 @@ index 34eaf68c7..514ecb578 100644 > + "client- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT =3D=3D $PLUTO_PEER -- $P= LUTO_ME =3D=3D $PLUTO_MY_CLIENT" > fi > fi > ++ > ++ # Close Firewall for AH + ESP Traffic > ++ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \ > ++ -s $PLUTO_PEER $S_PEER_PORT \ > ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT > ++ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \ > ++ -s $PLUTO_PEER $S_PEER_PORT \ > ++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT > ;; > -@@ -422,10 +382,10 @@ up-host-v6:iptables) > + # > + # IPv6 > +@@ -422,10 +399,10 @@ up-host-v6:iptables) > # connection to me, with (left/right)firewall=3Dyes, coming up > # This is used only by the default updown script, not by your custom > # ones, so do not mess with it; see CAUTION comment up at top. > @@ -175,7 +194,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ > -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT > # > -@@ -454,10 +414,10 @@ down-host-v6:iptables) > +@@ -454,10 +431,10 @@ down-host-v6:iptables) > # connection to me, with (left/right)firewall=3Dyes, going down > # This is used only by the default updown script, not by your custom > # ones, so do not mess with it; see CAUTION comment up at top. > @@ -188,7 +207,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \ > -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT > # > -@@ -487,10 +447,10 @@ up-client-v6:iptables) > +@@ -487,10 +464,10 @@ up-client-v6:iptables) > # ones, so do not mess with it; see CAUTION comment up at top. > if [ "$PLUTO_PEER_CLIENT" !=3D "$PLUTO_MY_SOURCEIP/128" ] > then > @@ -201,7 +220,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ > -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT > fi > -@@ -499,10 +459,10 @@ up-client-v6:iptables) > +@@ -499,10 +476,10 @@ up-client-v6:iptables) > # or sometimes host access via the internal IP is needed > if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] > then > @@ -214,7 +233,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_MY_CLIENT $S_MY_PORT \ > -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT > fi > -@@ -535,11 +495,11 @@ down-client-v6:iptables) > +@@ -535,11 +512,11 @@ down-client-v6:iptables) > # ones, so do not mess with it; see CAUTION comment up at top. > if [ "$PLUTO_PEER_CLIENT" !=3D "$PLUTO_MY_SOURCEIP/128" ] > then > @@ -228,7 +247,7 @@ index 34eaf68c7..514ecb578 100644 > -s $PLUTO_PEER_CLIENT $S_PEER_PORT \ > -d $PLUTO_MY_CLIENT $D_MY_PORT \ > $IPSEC_POLICY_IN -j ACCEPT > -@@ -549,11 +509,11 @@ down-client-v6:iptables) > +@@ -549,11 +526,11 @@ down-client-v6:iptables) > # or sometimes host access via the internal IP is needed > if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ] > then > --=20 > 2.35.3 --===============0307636305421691131==--