This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c (commit) from b6deb78d91664a8ef7b9eac2cbfd44b5d9cfaf2c (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Mar 2 10:04:46 2021 +0000

firewall: Disable all connection tracking helpers by default

This will mitigate exploiting networks secured by IPFire using NAT Slipstreaming:

https://lists.ipfire.org/pipermail/development/2021-February/009303.html

Suggested-by: Peter Müller peter.mueller@ipfire.org Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: lfs/configroot | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)

Difference in files: diff --git a/lfs/configroot b/lfs/configroot index bc8c0283f..a3e474d70 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -139,12 +139,7 @@ $(TARGET) : cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file /usr/sbin/convert-ids-modifysids-file

# Add conntrack helper default settings - for proto in FTP H323 IRC SIP TFTP; do \ - echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \ - done - - # Do not enable these by default because these are broken - for proto in AMANDA PPTP; do \ + for proto in AMANDA FTP H323 IRC PPTP SIP TFTP; do \ echo "CONNTRACK_$${proto}=off" >> $(CONFIG_ROOT)/optionsfw/settings; \ done

hooks/post-receive -- IPFire 2.x development tree