[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0f1cda211c441d17e212ee7c881e0d0014238155

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0f1cda211c441d17e212ee7c881e0d0014238155

[git]

[-- Attachment #1: Type: text/plain, Size: 2158 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  0f1cda211c441d17e212ee7c881e0d0014238155 (commit)
      from  3baa3661a16c7ed2024dc2d8526502cad2eb6e55 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0f1cda211c441d17e212ee7c881e0d0014238155
Author: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
Date:   Sat Mar 11 09:10:39 2017 +0100

    Disable netfilter on all bridges per default
    
    Fixes: #11301
    
    Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/etc/sysctl.conf                    | 5 +++++
 config/rootfiles/core/110/filelists/files | 1 +
 2 files changed, 6 insertions(+)

Difference in files:
diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index e2e3d81..ad56240 100644
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -34,3 +34,8 @@ net.ipv6.conf.default.disable_ipv6 = 1
 
 # Enable netfilter accounting
 net.netfilter.nf_conntrack_acct=1
+
+# Disable netfilter on bridges.
+net.bridge.bridge-nf-call-ip6tables = 0
+net.bridge.bridge-nf-call-iptables = 0
+net.bridge.bridge-nf-call-arptables = 0
diff --git a/config/rootfiles/core/110/filelists/files b/config/rootfiles/core/110/filelists/files
index b996e48..f06b6d5 100644
--- a/config/rootfiles/core/110/filelists/files
+++ b/config/rootfiles/core/110/filelists/files
@@ -2,6 +2,7 @@ etc/system-release
 etc/issue
 etc/httpd/conf/server-tuning.conf
 etc/rc.d/init.d/unbound
+etc/sysctl.conf
 srv/web/ipfire/cgi-bin/index.cgi
 srv/web/ipfire/cgi-bin/vpnmain.cgi
 usr/lib/libssp.so.0


hooks/post-receive
--
IPFire 2.x development tree