[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0eba3dc448e17d49299781706ff1f44f51413f3f

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 6684 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  0eba3dc448e17d49299781706ff1f44f51413f3f (commit)
       via  4b12aa414c0ae63e135d3ec36737152fff44f6d9 (commit)
      from  4616ecceced8208c695e697395f0b916d875fb91 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0eba3dc448e17d49299781706ff1f44f51413f3f
Author: Timo Eissler <timo(a)eissler.pro>
Date:   Thu Aug 7 20:11:22 2014 +0200

    firewall: updated rootfiles

commit 4b12aa414c0ae63e135d3ec36737152fff44f6d9
Author: Timo Eissler <timo(a)eissler.pro>
Date:   Thu Aug 7 19:00:58 2014 +0200

    firewall: fix faulty masquerading packets

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/common/armv5tel/initscripts       |  4 +--
 config/rootfiles/common/i586/initscripts           |  4 +--
 lfs/initscripts                                    |  1 -
 src/initscripts/init.d/firewall                    | 31 +++++++++++++++++++---
 .../init.d/networking/red.down/20-firewall         |  3 +++
 .../init.d/networking/red.up/20-firewall           |  3 +++
 6 files changed, 37 insertions(+), 9 deletions(-)
 create mode 100644 src/initscripts/init.d/networking/red.down/20-firewall
 create mode 100644 src/initscripts/init.d/networking/red.up/20-firewall

Difference in files:
diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index 7657fe6..dfe2e48 100644
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -73,13 +73,13 @@ etc/rc.d/init.d/networking/red.down/05-RS-dnsmasq
 etc/rc.d/init.d/networking/red.down/10-ipsec
 etc/rc.d/init.d/networking/red.down/10-miniupnpd
 etc/rc.d/init.d/networking/red.down/10-ovpn
-etc/rc.d/init.d/networking/red.down/20-RL-firewall
+etc/rc.d/init.d/networking/red.down/20-firewall
 #etc/rc.d/init.d/networking/red.up
 etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
 etc/rc.d/init.d/networking/red.up/05-RS-dnsmasq
 etc/rc.d/init.d/networking/red.up/10-miniupnpd
 etc/rc.d/init.d/networking/red.up/10-multicast
-etc/rc.d/init.d/networking/red.up/20-RL-firewall
+etc/rc.d/init.d/networking/red.up/20-firewall
 etc/rc.d/init.d/networking/red.up/23-RS-snort
 etc/rc.d/init.d/networking/red.up/24-RS-qos
 etc/rc.d/init.d/networking/red.up/27-RS-squid
diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index 458b966..622886f 100644
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -75,13 +75,13 @@ etc/rc.d/init.d/networking/red.down/05-RS-dnsmasq
 etc/rc.d/init.d/networking/red.down/10-ipsec
 etc/rc.d/init.d/networking/red.down/10-miniupnpd
 etc/rc.d/init.d/networking/red.down/10-ovpn
-etc/rc.d/init.d/networking/red.down/20-RL-firewall
+etc/rc.d/init.d/networking/red.down/20-firewall
 #etc/rc.d/init.d/networking/red.up
 etc/rc.d/init.d/networking/red.up/01-conntrack-cleanup
 etc/rc.d/init.d/networking/red.up/05-RS-dnsmasq
 etc/rc.d/init.d/networking/red.up/10-miniupnpd
 etc/rc.d/init.d/networking/red.up/10-multicast
-etc/rc.d/init.d/networking/red.up/20-RL-firewall
+etc/rc.d/init.d/networking/red.up/20-firewall
 etc/rc.d/init.d/networking/red.up/23-RS-snort
 etc/rc.d/init.d/networking/red.up/24-RS-qos
 etc/rc.d/init.d/networking/red.up/27-RS-squid
diff --git a/lfs/initscripts b/lfs/initscripts
index 02f9743..ab870dc 100644
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -187,7 +187,6 @@ $(TARGET) :
 		/etc/rc.d/init.d/networking/red.up/24-RS-qos
 	ln -sf ../../squid /etc/rc.d/init.d/networking/red.up/27-RS-squid
 	ln -sf ../../dnsmasq /etc/rc.d/init.d/networking/red.down/05-RS-dnsmasq
-	ln -sf ../../firewall /etc/rc.d/init.d/networking/red.down/20-RL-firewall
 
 	for i in green blue orange; do \
 		ln -sf any /etc/rc.d/init.d/networking/$$i; \
diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index f77bc02..0d80e7c 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -277,10 +277,16 @@ iptables_init() {
 	/usr/sbin/firewall-policy
 
 	# Install firewall rules for the red interface.
-	iptables_red
+	iptables_red_up
+
+	# If red has not been brought up yet, we will
+	# add the blocking rules for MASQUERADE
+	if [ ! -e "/var/ipfire/red/active" ]; then
+		iptables_red_down
+	fi
 }
 
-iptables_red() {
+iptables_red_up() {
 	iptables -F REDINPUT
 	iptables -F REDFORWARD
 	iptables -t nat -F REDNAT
@@ -358,6 +364,18 @@ iptables_red() {
 	/usr/local/bin/firewallctrl
 }
 
+iptables_red_down() {
+	# Prohibit packets to reach the masquerading rule
+	# while the wan interface is down - this is required to
+	# circumvent udp related NAT issues
+	# http://forum.ipfire.org/index.php?topic=11127.0
+	iptables -F REDFORWARD
+	iptables -A REDFORWARD -o $IFACE -j DROP
+
+	# Reload all rules.
+	/usr/local/bin/firewallctrl
+}
+
 # See how we were called.
 case "$1" in
   start)
@@ -388,9 +406,9 @@ case "$1" in
 		/etc/sysconfig/firewall.local start
 	fi
 	;;
-  reload)
+  reload|up)
 	boot_mesg "Reloading firewall"
-	iptables_red
+	iptables_red_up
 	evaluate_retval
 
 	# run local firewall configuration, if present
@@ -398,6 +416,11 @@ case "$1" in
 		/etc/sysconfig/firewall.local reload
 	fi
 	;;
+  down)
+	boot_mesg "Disabling firewall access to RED"
+	iptables_red_down
+	evaluate_retval
+	;;
   restart)
 	# run local firewall configuration, if present
 	if [ -x /etc/sysconfig/firewall.local ]; then
diff --git a/src/initscripts/init.d/networking/red.down/20-firewall b/src/initscripts/init.d/networking/red.down/20-firewall
new file mode 100644
index 0000000..d21c97c
--- /dev/null
+++ b/src/initscripts/init.d/networking/red.down/20-firewall
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+exec /etc/rc.d/init.d/firewall down
diff --git a/src/initscripts/init.d/networking/red.up/20-firewall b/src/initscripts/init.d/networking/red.up/20-firewall
new file mode 100644
index 0000000..ca52b4b
--- /dev/null
+++ b/src/initscripts/init.d/networking/red.up/20-firewall
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+exec /etc/rc.d/init.d/firewall up


hooks/post-receive
--
IPFire 2.x development tree