This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via 69031f7674295d6d95219a97063c718beecc1052 (commit) from bb46f3bef8445a0dba2e92bbb614113a9a4adcaf (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 69031f7674295d6d95219a97063c718beecc1052 Author: Michael Tremer michael.tremer@ipfire.org Date: Wed Apr 3 21:42:13 2024 +0100

suricata: Disable fail-open on NFQUEUE

This change causes that if suricata crashes, the NFQUEUE will no longer fall into a mode where ALL packets are being accepted. This used the be the case before which opened the entire firewall.

If suricata randomly crashes, we will fall back to the "bypass" mode where packets will bypass suricata, but nothing else.

Fixes: #13642 Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: config/suricata/suricata.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

Difference in files: diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index fb4f9426b..5bec5cd01 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -351,7 +351,7 @@ nfq: bypass-mask: 1073741824 # route-queue: 2 # batchcount: 20 - fail-open: yes + fail-open: no

## ## Step 5: App Layer Protocol Configuration

hooks/post-receive -- IPFire 2.x development tree