This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 0f1cda211c441d17e212ee7c881e0d0014238155 (commit) from 3baa3661a16c7ed2024dc2d8526502cad2eb6e55 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 0f1cda211c441d17e212ee7c881e0d0014238155 Author: Jonatan Schlag jonatan.schlag@ipfire.org Date: Sat Mar 11 09:10:39 2017 +0100

Disable netfilter on all bridges per default

Fixes: #11301

Signed-off-by: Jonatan Schlag jonatan.schlag@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/etc/sysctl.conf | 5 +++++ config/rootfiles/core/110/filelists/files | 1 + 2 files changed, 6 insertions(+)

Difference in files: diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index e2e3d81..ad56240 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -34,3 +34,8 @@ net.ipv6.conf.default.disable_ipv6 = 1

# Enable netfilter accounting net.netfilter.nf_conntrack_acct=1 + +# Disable netfilter on bridges. +net.bridge.bridge-nf-call-ip6tables = 0 +net.bridge.bridge-nf-call-iptables = 0 +net.bridge.bridge-nf-call-arptables = 0 diff --git a/config/rootfiles/core/110/filelists/files b/config/rootfiles/core/110/filelists/files index b996e48..f06b6d5 100644 --- a/config/rootfiles/core/110/filelists/files +++ b/config/rootfiles/core/110/filelists/files @@ -2,6 +2,7 @@ etc/system-release etc/issue etc/httpd/conf/server-tuning.conf etc/rc.d/init.d/unbound +etc/sysctl.conf srv/web/ipfire/cgi-bin/index.cgi srv/web/ipfire/cgi-bin/vpnmain.cgi usr/lib/libssp.so.0

hooks/post-receive -- IPFire 2.x development tree