From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init
Date: Sun, 30 May 2021 16:21:20 +0200
Message-ID: <20210530142120.7245-1-matthias.fischer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7187892435998043803=="
List-Id: <development.lists.ipfire.org>

--===============7187892435998043803==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

In https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dcommit;h=3Dffafaa71a6970a8c=
3d0942247feb37facfe24d25
all ALGs were removed from UI.

But they remained - somehow - in the initscript (firewall).

I tried to remove the remnants - hopefully in the correct way.

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
---
 src/initscripts/system/firewall | 65 +--------------------------------
 1 file changed, 1 insertion(+), 64 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index dd9f1a484..1e558ee86 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -98,74 +98,11 @@ iptables_init() {
 	iptables -t raw -N CONNTRACK
 	iptables -t raw -A PREROUTING -j CONNTRACK
=20
-	# Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-help=
ers/)
+	# Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpe=
rs/)
=20
 	# GRE (always enabled)
 	modprobe nf_conntrack_proto_gre
=20
-	# SIP
-	if [ "${CONNTRACK_SIP}" =3D "on" ]; then
-		modprobe nf_nat_sip
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper sip -j ACCEPT
-		for proto in udp tcp; do
-			iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
-		done
-	fi
-
-	# H.323
-	if [ "${CONNTRACK_H323}" =3D "on" ]; then
-		modprobe nf_nat_h323
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper h323 -j ACCEPT
-
-		# Gatekeeper RAS
-		iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
-
-		# Q.931
-		iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
-	fi
-
-	# FTP
-	if [ "${CONNTRACK_FTP}" =3D "on" ]; then
-		modprobe nf_nat_ftp
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
-		iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
-	fi
-
-	# PPTP
-	if [ "${CONNTRACK_PPTP}" =3D "on" ]; then
-		modprobe nf_nat_pptp
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper pptp -j ACCEPT
-		iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
-	fi
-
-	# TFTP
-	if [ "${CONNTRACK_TFTP}" =3D "on" ]; then
-		modprobe nf_nat_tftp
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper tftp -j ACCEPT
-		iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
-	fi
-
-	# IRC
-	if [ "${CONNTRACK_IRC}" =3D "on" ]; then
-		modprobe nf_nat_irc
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper irc -j ACCEPT
-		iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
-	fi
-
-	# Amanda
-	if [ "${CONNTRACK_AMANDA}" =3D "on" ]; then
-		modprobe nf_nat_amanda
-		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-			-m helper --helper amanda -j ACCEPT
-		iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
-	fi
-
 	# Fix for braindead ISPs
 	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to=
-pmtu
=20
--=20
2.18.0


--===============7187892435998043803==--