Re: [PATCH 1/4] firewall: Drop support for blocking P2P protocols.

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2277 bytes --]

Thank you for this.

Acked-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 14 Feb 2022, at 19:03, Stefan Schantl <stefan.schantl(a)ipfire.org> wrote:
> 
> The main P2P (peer-to-peer) aera has passed for several year now, so
> this kind of feature is realy out-dated.
> 
> The feature only supports a handfull of P2P protocols (mostly unencrypted)
> for applications, which have been superseeded by various other
> applications and protocols.
> 
> So, this fairly is not longer required and safely can be dropped.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
> config/firewall/rules.pl | 23 -----------------------
> 1 file changed, 23 deletions(-)
> 
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 9d280045a..fea6874a4 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -70,12 +70,9 @@ my %locationsettings = (
> 	"LOCATIONBLOCK_ENABLED" => "off"
> );
> 
> -my @p2ps=();
> -
> my $configfwdfw		= "${General::swroot}/firewall/config";
> my $configinput	    = "${General::swroot}/firewall/input";
> my $configoutgoing  = "${General::swroot}/firewall/outgoing";
> -my $p2pfile			= "${General::swroot}/firewall/p2protocols";
> my $locationfile		= "${General::swroot}/firewall/locationblock";
> my $configgrp		= "${General::swroot}/fwhosts/customgroups";
> my $netsettings		= "${General::swroot}/ethernet/settings";
> @@ -125,9 +122,6 @@ sub main {
> 		&buildrules(\%configfwdfw);
> 	}
> 
> -	# Load P2P block rules.
> -	&p2pblock();
> -
> 	# Load Location block rules.
> 	&locationblock();
> 
> @@ -620,23 +614,6 @@ sub time_convert_to_minutes {
> 	return ($hrs * 60) + $min;
> }
> 
> -sub p2pblock {
> -	open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
> -	my @protocols = ();
> -	foreach my $p2pentry (<FILE>) {
> -		my @p2pline = split(/\;/, $p2pentry);
> -		next unless ($p2pline[2] eq "off");
> -
> -		push(@protocols, "--$p2pline[1]");
> -	}
> -	close(FILE);
> -
> -	run("$IPTABLES -F P2PBLOCK");
> -	if (@protocols) {
> -		run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
> -	}
> -}
> -
> sub locationblock {
> 	# Flush iptables chain.
> 	run("$IPTABLES -F LOCATIONBLOCK");
> -- 
> 2.30.2
>