From: "Peter Müller" <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] strongSwan: Bring back firewall rules for permitting ESP and AH traffic
Date: Wed, 18 May 2022 15:53:42 +0000 [thread overview]
Message-ID: <64c47b49-abd0-737b-5a93-6b621be190e2@ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 5512 bytes --]
Fixes: #12866
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
src/patches/strongswan-ipfire.patch | 47 ++++++++++++++++++++---------
1 file changed, 33 insertions(+), 14 deletions(-)
diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-ipfire.patch
index 0f2be7483..ab04d57e0 100644
--- a/src/patches/strongswan-ipfire.patch
+++ b/src/patches/strongswan-ipfire.patch
@@ -1,13 +1,13 @@
-commit 654e2b7688c5fbd4e1fc46648bc1864301fb6027
-Author: Michael Tremer <michael.tremer(a)ipfire.org>
-Date: Mon Mar 21 19:49:02 2022 +0000
+commit a3cfab9961cd088fb7df9fa8e646601f8f879762
+Author: Peter Müller <peter.mueller(a)ipfire.org>
+Date: Wed May 18 15:50:34 2022 +0000
IPFire modifications to _updown script
- Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
+ Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in
-index 34eaf68c7..514ecb578 100644
+index 34eaf68c7..0302fa128 100644
--- a/src/_updown/_updown.in
+++ b/src/_updown/_updown.in
@@ -242,10 +242,10 @@ up-host:iptables)
@@ -98,7 +98,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
-@@ -342,10 +324,10 @@ up-client:iptables)
+@@ -342,47 +324,34 @@ up-client:iptables)
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO \
@@ -110,8 +110,17 @@ index 34eaf68c7..514ecb578 100644
+ "client+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
fi
fi
++
++ # Open Firewall for AH + ESP Traffic
++ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
++ -s $PLUTO_PEER $S_PEER_PORT \
++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
++ -s $PLUTO_PEER $S_PEER_PORT \
++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++
;;
-@@ -353,36 +335,14 @@ down-client:iptables)
+ down-client:iptables)
# connection to client subnet, with (left/right)firewall=yes, going down
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
@@ -149,7 +158,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
-@@ -392,10 +352,10 @@ down-client:iptables)
+@@ -392,12 +361,20 @@ down-client:iptables)
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO -- \
@@ -161,8 +170,18 @@ index 34eaf68c7..514ecb578 100644
+ "client- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
fi
fi
++
++ # Close Firewall for AH + ESP Traffic
++ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
++ -s $PLUTO_PEER $S_PEER_PORT \
++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
++ -s $PLUTO_PEER $S_PEER_PORT \
++ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
;;
-@@ -422,10 +382,10 @@ up-host-v6:iptables)
+ #
+ # IPv6
+@@ -422,10 +399,10 @@ up-host-v6:iptables)
# connection to me, with (left/right)firewall=yes, coming up
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
@@ -175,7 +194,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
-@@ -454,10 +414,10 @@ down-host-v6:iptables)
+@@ -454,10 +431,10 @@ down-host-v6:iptables)
# connection to me, with (left/right)firewall=yes, going down
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
@@ -188,7 +207,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
-@@ -487,10 +447,10 @@ up-client-v6:iptables)
+@@ -487,10 +464,10 @@ up-client-v6:iptables)
# ones, so do not mess with it; see CAUTION comment up at top.
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
then
@@ -201,7 +220,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
fi
-@@ -499,10 +459,10 @@ up-client-v6:iptables)
+@@ -499,10 +476,10 @@ up-client-v6:iptables)
# or sometimes host access via the internal IP is needed
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
then
@@ -214,7 +233,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_MY_CLIENT $S_MY_PORT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
-@@ -535,11 +495,11 @@ down-client-v6:iptables)
+@@ -535,11 +512,11 @@ down-client-v6:iptables)
# ones, so do not mess with it; see CAUTION comment up at top.
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
then
@@ -228,7 +247,7 @@ index 34eaf68c7..514ecb578 100644
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
-d $PLUTO_MY_CLIENT $D_MY_PORT \
$IPSEC_POLICY_IN -j ACCEPT
-@@ -549,11 +509,11 @@ down-client-v6:iptables)
+@@ -549,11 +526,11 @@ down-client-v6:iptables)
# or sometimes host access via the internal IP is needed
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
then
--
2.35.3
next reply other threads:[~2022-05-18 15:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-18 15:53 Peter Müller [this message]
2022-05-18 16:02 ` Michael Tremer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=64c47b49-abd0-737b-5a93-6b621be190e2@ipfire.org \
--to=peter.mueller@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox