This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via 8d2fe8cedd68bfdf648df1baf8b654a846f8c022 (commit) via 8490e4961886c6fc44bbfcbaa5073484f235208e (commit) from 39e96de566bc4f3a48de9b683de7ffac850bc0a3 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 8d2fe8cedd68bfdf648df1baf8b654a846f8c022 Merge: 8490e49 39e96de Author: Michael Tremer michael.tremer@ipfire.org Date: Fri Apr 18 22:24:24 2014 +0200

Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x

commit 8490e4961886c6fc44bbfcbaa5073484f235208e Author: Michael Tremer michael.tremer@ipfire.org Date: Thu Apr 17 12:31:27 2014 +0200

firewall: Explicitely allow DHCP messages.

-----------------------------------------------------------------------

Summary of changes: src/initscripts/init.d/dhcp | 25 +++++++++++++++++++------ src/initscripts/init.d/firewall | 31 ++++++++++++++++++++++++++----- 2 files changed, 45 insertions(+), 11 deletions(-)

Difference in files: diff --git a/src/initscripts/init.d/dhcp b/src/initscripts/init.d/dhcp index abc6b5c..bc0abce 100644 --- a/src/initscripts/init.d/dhcp +++ b/src/initscripts/init.d/dhcp @@ -9,19 +9,30 @@ . $rc_functions eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)

+function flush_chains() { + iptables -F DHCPGREENINPUT + iptables -F DHCPGREENOUTPUT + iptables -F DHCPBLUEINPUT + iptables -F DHCPBLUEOUTPUT +} + case "$1" in start) - iptables -F DHCPBLUEINPUT + flush_chains + if [ -e /var/ipfire/dhcp/enable_green ]; then devices="${GREEN_DEV}" + + iptables -A DHCPGREENINPUT -i "${GREEN_DEV}" -j DHCPINPUT + iptables -A DHCPGREENOUTPUT -o "${GREEN_DEV}" -j DHCPOUTPUT fi if [ -e /var/ipfire/dhcp/enable_blue ]; then devices+=" ${BLUE_DEV}" - - iptables -A DHCPBLUEINPUT -p tcp --source-port 68 --destination-port 67 -i ${BLUE_DEV} -j ACCEPT > /dev/null 2>&1 - iptables -A DHCPBLUEINPUT -p udp --source-port 68 --destination-port 67 -i ${BLUE_DEV} -j ACCEPT > /dev/null 2>&1 - fi - + + iptables -A DHCPBLUEINPUT -i "${BLUE_DEV}" -j DHCPINPUT + iptables -A DHCPBLUEOUTPUT -o "${BLUE_DEV}" -j DHCPOUTPUT + fi + boot_mesg "Starting DHCP Server..." loadproc /usr/sbin/dhcpd -q ${devices} @@ -29,6 +40,8 @@ case "$1" in ;;

stop) + flush_chains + boot_mesg "Stopping DHCP Server..." killproc -p /var/run/dhcpd.pid /usr/sbin/dhcpd if [ "$(ps -A | grep " dhcpd")" != "" ] ; then diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index f0d9c49..8371781 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -143,6 +143,31 @@ iptables_init() { iptables -A ${i} -j CONNTRACK done

+ # Allow DHCP + iptables -N DHCPINPUT + iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT + iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT + + iptables -N DHCPOUTPUT + iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT + iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT + + # Allow DHCP on GREEN + iptables -N DHCPGREENINPUT + iptables -N DHCPGREENOUTPUT + if [ -n "${GREEN_DEV}" ]; then + iptables -A INPUT -i "${GREEN_DEV}" -j DHCPGREENINPUT + iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT + fi + + # allow DHCP on BLUE to be turned on/off + iptables -N DHCPBLUEINPUT + iptables -N DHCPBLUEOUTPUT + if [ -n "${BLUE_DEV}" ]; then + iptables -A INPUT -i "${BLUE_DEV}" -j DHCPBLUEINPUT + iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT + fi + # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything iptables -N IPSECINPUT iptables -N IPSECFORWARD @@ -155,11 +180,7 @@ iptables_init() {

# localhost and ethernet. iptables -A INPUT -i $GREEN_DEV -m conntrack --ctstate NEW -j ACCEPT ! -p icmp - - # allow DHCP on BLUE to be turned on/off - iptables -N DHCPBLUEINPUT - iptables -A INPUT -j DHCPBLUEINPUT - + # WIRELESS chains iptables -N WIRELESSINPUT iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT

hooks/post-receive -- IPFire 2.x development tree