From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject:
 Re: [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init
Date: Sun, 30 May 2021 19:59:50 +0200
Message-ID: <b8899158-3880-9b98-0b77-5b09b3ffa1c8@ipfire.org>
In-Reply-To: <20210530142120.7245-1-matthias.fischer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5814621514642876417=="
List-Id: <development.lists.ipfire.org>

--===============5814621514642876417==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Matthias,

thank you for this patch - removing the remains of ALGs has been on my to-do =
list as well... :-)

I agree with the changes you propose to the firewall initscript. However, the=
re are still some ALG-related
configuration files left, and we continue to ship the corresponding kernel mo=
dules.

While the latter might be worth a separate patch as soon as Linux 5.10 landed=
 in IPFire 2.x, cleaning
up the rest of ALG bits and pieces as much as we can makes sense to me.

Acked-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>

Thanks, and best regards,
Peter M=C3=BCller

> In https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dcommit;h=3Dffafaa71a6970a=
8c3d0942247feb37facfe24d25
> all ALGs were removed from UI.
>=20
> But they remained - somehow - in the initscript (firewall).
>=20
> I tried to remove the remnants - hopefully in the correct way.
>=20
> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
> ---
>  src/initscripts/system/firewall | 65 +--------------------------------
>  1 file changed, 1 insertion(+), 64 deletions(-)
>=20
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firew=
all
> index dd9f1a484..1e558ee86 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -98,74 +98,11 @@ iptables_init() {
>  	iptables -t raw -N CONNTRACK
>  	iptables -t raw -A PREROUTING -j CONNTRACK
> =20
> -	# Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-he=
lpers/)
> +	# Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-hel=
pers/)
> =20
>  	# GRE (always enabled)
>  	modprobe nf_conntrack_proto_gre
> =20
> -	# SIP
> -	if [ "${CONNTRACK_SIP}" =3D "on" ]; then
> -		modprobe nf_nat_sip
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper sip -j ACCEPT
> -		for proto in udp tcp; do
> -			iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper =
sip
> -		done
> -	fi
> -
> -	# H.323
> -	if [ "${CONNTRACK_H323}" =3D "on" ]; then
> -		modprobe nf_nat_h323
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper h323 -j ACCEPT
> -
> -		# Gatekeeper RAS
> -		iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
> -
> -		# Q.931
> -		iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
> -	fi
> -
> -	# FTP
> -	if [ "${CONNTRACK_FTP}" =3D "on" ]; then
> -		modprobe nf_nat_ftp
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
> -		iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
> -	fi
> -
> -	# PPTP
> -	if [ "${CONNTRACK_PPTP}" =3D "on" ]; then
> -		modprobe nf_nat_pptp
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper pptp -j ACCEPT
> -		iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
> -	fi
> -
> -	# TFTP
> -	if [ "${CONNTRACK_TFTP}" =3D "on" ]; then
> -		modprobe nf_nat_tftp
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper tftp -j ACCEPT
> -		iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
> -	fi
> -
> -	# IRC
> -	if [ "${CONNTRACK_IRC}" =3D "on" ]; then
> -		modprobe nf_nat_irc
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper irc -j ACCEPT
> -		iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
> -	fi
> -
> -	# Amanda
> -	if [ "${CONNTRACK_AMANDA}" =3D "on" ]; then
> -		modprobe nf_nat_amanda
> -		iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> -			-m helper --helper amanda -j ACCEPT
> -		iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
> -	fi
> -
>  	# Fix for braindead ISPs
>  	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-=
to-pmtu
> =20
>=20

--===============5814621514642876417==--