[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 2108 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c (commit)
      from  b6deb78d91664a8ef7b9eac2cbfd44b5d9cfaf2c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 74d3d9cbe3e3b198e6c7a8c30ec2a0c58b6c5e2c
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Tue Mar 2 10:04:46 2021 +0000

    firewall: Disable all connection tracking helpers by default
    
    This will mitigate exploiting networks secured by IPFire using NAT
    Slipstreaming:
    
    https://lists.ipfire.org/pipermail/development/2021-February/009303.html
    
    Suggested-by: Peter Müller <peter.mueller(a)ipfire.org>
    Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 lfs/configroot | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

Difference in files:
diff --git a/lfs/configroot b/lfs/configroot
index bc8c0283f..a3e474d70 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -139,12 +139,7 @@ $(TARGET) :
 	cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file   /usr/sbin/convert-ids-modifysids-file
 
 	# Add conntrack helper default settings
-	for proto in FTP H323 IRC SIP TFTP; do \
-		echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \
-	done
-
-	# Do not enable these by default because these are broken
-	for proto in AMANDA PPTP; do \
+	for proto in AMANDA FTP H323 IRC PPTP SIP TFTP; do \
 		echo "CONNTRACK_$${proto}=off" >> $(CONFIG_ROOT)/optionsfw/settings; \
 	done
 


hooks/post-receive
--
IPFire 2.x development tree