This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via cda384a280b11461f4114faf4c86c8589df15eb0 (commit) from e89b407f8894a1378ef9afbdd79180ed3d99a89c (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit cda384a280b11461f4114faf4c86c8589df15eb0 Author: Michael Tremer michael.tremer@ipfire.org Date: Fri Mar 24 13:24:42 2017 +0100

ipsec: Do not reject connections in on-demand mode

When an on-demand VPN connection is not up, the packets will traverse the firewall and be rejected by the IPSECBLOCK chain which will cause that an ICMP error message will be sent to the client. If that does not happen and the packet is being silently dropped, the client will retransmit and by then the VPN connection will hopefully be up.

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/firewall/ipsec-block | 41 ++++++++++++++++++++++++++----- config/rootfiles/core/110/filelists/files | 1 + 2 files changed, 36 insertions(+), 6 deletions(-)

Difference in files: diff --git a/config/firewall/ipsec-block b/config/firewall/ipsec-block index 9fa8e1a..96682b8 100644 --- a/config/firewall/ipsec-block +++ b/config/firewall/ipsec-block @@ -23,23 +23,43 @@ VPN_CONFIG="/var/ipfire/vpn/config"

block_subnet() { local subnet="${1}" + local action="${2}"

# Don't block a wildcard subnet if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then return 0 fi

- iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable + case "${action}" in + reject) + iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable + ;; + drop) + iptables -A IPSECBLOCK -d "${subnet}" -j DROP + ;; + *) + return 1 + ;; + esac + + return 0 }

block_ipsec() { # Flush all exists rules iptables -F IPSECBLOCK

- local id status name lefthost type ctype unknown1 unknown2 unknown3 - local leftsubnets unknown4 righthost rightsubnets rest - while IFS="," read -r id status name lefthost type ctype unkown1 unknown2 unknown3 \ - leftsubnets unknown4 righthost rightsubnets rest; do + local action + + local vars="id status name lefthost type ctype x1 x2 x3 leftsubnets" + vars="${vars} x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12" + vars="${vars} x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24" + vars="${vars} route rest" + + # Register local variables + local ${vars} + + while IFS="," read -r ${vars}; do # Check if the connection is enabled [ "${status}" = "on" ] || continue

@@ -49,9 +69,18 @@ block_ipsec() { # Split multiple subnets rightsubnets="${rightsubnets//|/ }"

+ case "${route}" in + route) + action="drop" + ;; + *) + action="reject" + ;; + esac + local rightsubnet for rightsubnet in ${rightsubnets}; do - block_subnet "${rightsubnet}" + block_subnet "${rightsubnet}" "${action}" done done < "${VPN_CONFIG}" } diff --git a/config/rootfiles/core/110/filelists/files b/config/rootfiles/core/110/filelists/files index 5816027..c6d15d6 100644 --- a/config/rootfiles/core/110/filelists/files +++ b/config/rootfiles/core/110/filelists/files @@ -13,6 +13,7 @@ srv/web/ipfire/cgi-bin/vpnmain.cgi srv/web/ipfire/html/themes/darkdos/include/style.css srv/web/ipfire/html/themes/ipfire/include/css/style.css srv/web/ipfire/html/themes/maniac/include/style.css +usr/lib/firewall/ipsec-block usr/lib/libssp.so.0 usr/lib/libssp.so.0.0.0 usr/local/bin/xt_geoip_update

hooks/post-receive -- IPFire 2.x development tree