Re: [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init

Hello,

They were left intentionally so that people could re-enable the ALGs if there was not other solution available.

Since the migration seemed to have worked well, I would suggest that we merge this and drop the kernel modules with the next kernel update.

On 30 May 2021, at 18:59, Peter Müller peter.mueller@ipfire.org wrote:

Hello Matthias,

thank you for this patch - removing the remains of ALGs has been on my to-do list as well... :-)

I agree with the changes you propose to the firewall initscript. However, there are still some ALG-related configuration files left, and we continue to ship the corresponding kernel modules.

Which are those?

While the latter might be worth a separate patch as soon as Linux 5.10 landed in IPFire 2.x, cleaning up the rest of ALG bits and pieces as much as we can makes sense to me.

Acked-by: Peter Müller peter.mueller@ipfire.org

Thanks, and best regards, Peter Müller

...

In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d094224... all ALGs were removed from UI.

But they remained - somehow - in the initscript (firewall).

I tried to remove the remnants - hopefully in the correct way.

Signed-off-by: Matthias Fischer matthias.fischer@ipfire.org

src/initscripts/system/firewall | 65 +-------------------------------- 1 file changed, 1 insertion(+), 64 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index dd9f1a484..1e558ee86 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -98,74 +98,11 @@ iptables_init() { iptables -t raw -N CONNTRACK iptables -t raw -A PREROUTING -j CONNTRACK

• # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)

• # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)

  # GRE (always enabled) modprobe nf_conntrack_proto_gre

• # SIP
• if [ "${CONNTRACK_SIP}" = "on" ]; then

• modprobe nf_nat_sip
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper sip -j ACCEPT
  

• for proto in udp tcp; do
  

• 	iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
  

• done
  

• fi
• # H.323
• if [ "${CONNTRACK_H323}" = "on" ]; then

• modprobe nf_nat_h323
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper h323 -j ACCEPT
  

• # Gatekeeper RAS
  

• iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
  

• # Q.931
  

• iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
  

• fi
• # FTP
• if [ "${CONNTRACK_FTP}" = "on" ]; then

• modprobe nf_nat_ftp
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
  

• iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
  

• fi
• # PPTP
• if [ "${CONNTRACK_PPTP}" = "on" ]; then

• modprobe nf_nat_pptp
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper pptp -j ACCEPT
  

• iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
  

• fi
• # TFTP
• if [ "${CONNTRACK_TFTP}" = "on" ]; then

• modprobe nf_nat_tftp
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper tftp -j ACCEPT
  

• iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
  

• fi
• # IRC
• if [ "${CONNTRACK_IRC}" = "on" ]; then

• modprobe nf_nat_irc
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper irc -j ACCEPT
  

• iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
  

• fi
• # Amanda
• if [ "${CONNTRACK_AMANDA}" = "on" ]; then

• modprobe nf_nat_amanda
  

• iptables -A CONNTRACK -m conntrack --ctstate RELATED \
  

• 	-m helper --helper amanda -j ACCEPT
  

• iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
  

• fi
• # Fix for braindead ISPs iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu