This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via b5aec71462d90bec69621d76b960d0c11aab2a01 (commit) via 8269c8319ccb9e78c8c48a4218396621d5a156e3 (commit) via 5ca74566b3404539b46c904aaec0ac7e4033657f (commit) via 53378856a87eabf3e5dff2a8bbc7331ebed694a2 (commit) via d0167455738dd1f50a84a667db1cc6f8730ec95a (commit) via 10148970eb431e8a1a99aaca67c531dc3b6f1492 (commit) via 1217807d09933ed3760132498360d13d17b98155 (commit) via 4b94860d07b5124e90711c802e87cce8547c3043 (commit) from bff444621e224663b5906671602fef17ac1756d8 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit b5aec71462d90bec69621d76b960d0c11aab2a01 Merge: d01674557 8269c8319 Author: Peter Müller peter.mueller@ipfire.org Date: Fri Feb 18 22:47:07 2022 +0000

Merge branch 'temp-c165-development' into next

commit 8269c8319ccb9e78c8c48a4218396621d5a156e3 Author: Peter Müller peter.mueller@ipfire.org Date: Fri Feb 18 22:40:55 2022 +0000

firewall: Make logging of conntrack INVALIDs configureable

In theory, logging of dropped packets classified by conntrack as being INVALID should never be disabled, since one wants to have a paper trail of what his/her firewall is doing.

However, conntrack seems to drop a lot of (at the first glance legitimate) packets, hence bloating the logs, making spotting the important firewall hits more difficult.

This patch therefore adds the option to disable logging of packets being dropped by conntrack due to INVALID state.

Please note: - This patch does not add this category to the firewall hits graph. - The variables in this patch ("LOGDROPCTINVALID") should make it clear that it is about toggling _logging_, not the actual _dropping_. Other variables are still in need of being renamed to clarify this, which will be done in a dedicated patch. - Also, the changes made to update.sh need to take place in config/rootfiles/core/164/update.sh for "master", since this patch has been developed against "next". Kindly cherry-pick the necessary changes.

Partially fixes: #12778

Reported-by: Arne Fitzenreiter arne.fitzenreiter@ipfire.org Signed-off-by: Peter Müller peter.mueller@ipfire.org

commit 5ca74566b3404539b46c904aaec0ac7e4033657f Author: Peter Müller peter.mueller@ipfire.org Date: Thu Feb 17 20:16:02 2022 +0000

firewall: Add proper logging prefix for conntrack INVALID hits

Fixes: #12778

Signed-off-by: Peter Müller peter.mueller@ipfire.org

commit 53378856a87eabf3e5dff2a8bbc7331ebed694a2 Merge: bff444621 10148970e Author: Peter Müller peter.mueller@ipfire.org Date: Fri Feb 18 22:28:55 2022 +0000

Merge branch 'master' into temp-c165-development

commit d0167455738dd1f50a84a667db1cc6f8730ec95a Merge: bff444621 10148970e Author: Peter Müller peter.mueller@ipfire.org Date: Fri Feb 18 22:28:35 2022 +0000

Merge branch 'master' into next

-----------------------------------------------------------------------

Summary of changes: config/rootfiles/oldcore/164/update.sh | 13 ++++++++++--- html/cgi-bin/optionsfw.cgi | 12 +++++++++++- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + lfs/configroot | 1 + src/initscripts/system/firewall | 8 +++++++- 6 files changed, 31 insertions(+), 5 deletions(-)

Difference in files: diff --git a/config/rootfiles/oldcore/164/update.sh b/config/rootfiles/oldcore/164/update.sh index a0650dbda..05f2a03e4 100644 --- a/config/rootfiles/oldcore/164/update.sh +++ b/config/rootfiles/oldcore/164/update.sh @@ -100,9 +100,16 @@ ldconfig # Run convert script for IDS multiple providers /usr/sbin/convert-ids-multiple-providers

-# Add missing configuration settings to optionsfw configuration -echo "DROPHOSTILE=off" > /var/ipfire/optionsfw/settings -echo "DROPSPOOFEDMARTIAN=on" > /var/ipfire/optionsfw/settings +# Add configuration settings to optionsfw if they are missing +if [ "$(grep "^DROPHOSTILE" /var/ipfire/optionsfw/settings)" == "" ]; then + echo "DROPHOSTILE=off" >> /var/ipfire/optionsfw/settings +fi +if [ "$(grep "^DROPSPOOFEDMARTIAN" /var/ipfire/optionsfw/settings)" == "" ]; then + echo "DROPSPOOFEDMARTIAN=on" >> /var/ipfire/optionsfw/settings +fi +if [ "$(grep "^LOGDROPCTINVALID" /var/ipfire/optionsfw/settings)" == "" ]; then + echo "LOGDROPCTINVALID=on" >> /var/ipfire/optionsfw/settings +fi

# Apply sysctl changes /etc/init.d/sysctl start diff --git a/html/cgi-bin/optionsfw.cgi b/html/cgi-bin/optionsfw.cgi index 481d5bdbd..5611b71b7 100644 --- a/html/cgi-bin/optionsfw.cgi +++ b/html/cgi-bin/optionsfw.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2014-2021 IPFire Team info@ipfire.org # +# Copyright (C) 2007-2022 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -116,6 +116,9 @@ $checked{'DROPSPOOFEDMARTIAN'}{$settings{'DROPSPOOFEDMARTIAN'}} = "checked='chec $checked{'DROPHOSTILE'}{'off'} = ''; $checked{'DROPHOSTILE'}{'on'} = ''; $checked{'DROPHOSTILE'}{$settings{'DROPHOSTILE'}} = "checked='checked'"; +$checked{'LOGDROPCTINVALID'}{'off'} = ''; +$checked{'LOGDROPCTINVALID'}{'on'} = ''; +$checked{'LOGDROPCTINVALID'}{$settings{'LOGDROPCTINVALID'}} = "checked='checked'"; $checked{'DROPPROXY'}{'off'} = ''; $checked{'DROPPROXY'}{'on'} = ''; $checked{'DROPPROXY'}{$settings{'DROPPROXY'}} = "checked='checked'"; @@ -211,6 +214,13 @@ END <input type='radio' name='DROPNEWNOTSYN' value='off' $checked{'DROPNEWNOTSYN'}{'off'} /> $Lang::tr{'off'} </td> </tr> + <tr> + <td align='left' width='60%'>$Lang::tr{'log dropped conntrack invalids'}</td> + <td align='left'> + $Lang::tr{'on'} <input type='radio' name='LOGDROPCTINVALID' value='on' $checked{'LOGDROPCTINVALID'}{'on'} />/ + <input type='radio' name='LOGDROPCTINVALID' value='off' $checked{'LOGDROPCTINVALID'}{'off'} /> $Lang::tr{'off'} + </td> + </tr> <tr> <td align='left' width='60%'>$Lang::tr{'drop input'}</td> <td align='left'> diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 7a4b30ad5..a9b4dadd8 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1603,6 +1603,7 @@ 'locationblock enable feature' => 'Location-basierte Filterung aktivieren:', 'locationblock flag' => 'Flagge', 'log' => 'Protokoll', +'log dropped conntrack invalids' => 'Verworfene, von der Verbindungsverfolgung als INVALID eingestufte Pakete protokollieren', 'log enabled' => 'Protokoll aktiviert', 'log level' => 'Protokollierungsniveau', 'log lines per page' => 'Zeilen pro Seite', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 644eb0574..ed0d756f5 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1651,6 +1651,7 @@ 'locationblock enable feature' => 'Enable Location based blocking:', 'locationblock flag' => 'Flag', 'log' => 'Log', +'log dropped conntrack invalids' => 'Log dropped packets classified as INVALID by connection tracking', 'log enabled' => 'Log Enabled', 'log level' => 'Log Level', 'log lines per page' => 'Lines per page', diff --git a/lfs/configroot b/lfs/configroot index b836767c1..111ab6787 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -131,6 +131,7 @@ $(TARGET) : echo "DROPWIRELESSFORWARD=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPSPOOFEDMARTIAN=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPHOSTILE=on" >> $(CONFIG_ROOT)/optionsfw/settings + echo "LOGDROPCTINVALID=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "USE_ISP_NAMESERVERS=on" >> $(CONFIG_ROOT)/dns/settings diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 2ae6157aa..14f93d9c7 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -121,9 +121,15 @@ iptables_init() { iptables -A FORWARD -p tcp -j BADTCP

# Connection tracking chains + iptables -N CTINVALID + if [ "$LOGDROPCTINVALID" == "on" ]; then + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + fi + iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" + iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT

# Restore any connection marks

hooks/post-receive -- IPFire 2.x development tree