From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] firewall: Disable all connection tracking helpers by default
Date: Tue, 02 Mar 2021 10:07:59 +0000
Message-ID: <20210302100759.7823-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7920951578926130425=="
List-Id: <development.lists.ipfire.org>

--===============7920951578926130425==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This will mitigate exploiting networks secured by IPFire using NAT
Slipstreaming:

https://lists.ipfire.org/pipermail/development/2021-February/009303.html

Suggested-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 lfs/configroot | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lfs/configroot b/lfs/configroot
index bc8c0283f..a3e474d70 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -139,12 +139,7 @@ $(TARGET) :
 	cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file   /usr/sbin/conve=
rt-ids-modifysids-file
=20
 	# Add conntrack helper default settings
-	for proto in FTP H323 IRC SIP TFTP; do \
-		echo "CONNTRACK_$${proto}=3Don" >> $(CONFIG_ROOT)/optionsfw/settings; \
-	done
-
-	# Do not enable these by default because these are broken
-	for proto in AMANDA PPTP; do \
+	for proto in AMANDA FTP H323 IRC PPTP SIP TFTP; do \
 		echo "CONNTRACK_$${proto}=3Doff" >> $(CONFIG_ROOT)/optionsfw/settings; \
 	done
=20
--=20
2.20.1


--===============7920951578926130425==--