[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 926d840faeafe9528532f42aa12a0922188c1959

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 926d840faeafe9528532f42aa12a0922188c1959

[Arne Fitzenreiter]

[-- Attachment #1: Type: text/plain, Size: 7575 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  926d840faeafe9528532f42aa12a0922188c1959 (commit)
      from  5c1af49c835921232a0312819025fb08dddae4b3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 926d840faeafe9528532f42aa12a0922188c1959
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date:   Fri Feb 18 22:40:55 2022 +0000

    firewall: Make logging of conntrack INVALIDs configureable
    
    In theory, logging of dropped packets classified by conntrack as being
    INVALID should never be disabled, since one wants to have a paper trail
    of what his/her firewall is doing.
    
    However, conntrack seems to drop a lot of (at the first glance
    legitimate) packets, hence bloating the logs, making spotting the
    important firewall hits more difficult.
    
    This patch therefore adds the option to disable logging of packets being
    dropped by conntrack due to INVALID state.
    
    Please note:
    - This patch does not add this category to the firewall hits graph.
    - The variables in this patch ("LOGDROPCTINVALID") should make it clear
      that it is about toggling _logging_, not the actual _dropping_. Other
      variables are still in need of being renamed to clarify this, which
      will be done in a dedicated patch.
    - Also, the changes made to update.sh need to take place in
      config/rootfiles/core/164/update.sh for "master", since this patch has
      been developed against "next". Kindly cherry-pick the necessary
      changes.
    
    Partially fixes: #12778
    
    Reported-by: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
    Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/core/164/update.sh |  3 +++
 html/cgi-bin/optionsfw.cgi          | 12 +++++++++++-
 langs/de/cgi-bin/de.pl              |  1 +
 langs/en/cgi-bin/en.pl              |  1 +
 lfs/configroot                      |  1 +
 src/initscripts/system/firewall     |  4 +++-
 6 files changed, 20 insertions(+), 2 deletions(-)

Difference in files:
diff --git a/config/rootfiles/core/164/update.sh b/config/rootfiles/core/164/update.sh
index e6847359c..05f2a03e4 100644
--- a/config/rootfiles/core/164/update.sh
+++ b/config/rootfiles/core/164/update.sh
@@ -107,6 +107,9 @@ fi
 if [ "$(grep "^DROPSPOOFEDMARTIAN" /var/ipfire/optionsfw/settings)" == "" ]; then
 	echo "DROPSPOOFEDMARTIAN=on" >> /var/ipfire/optionsfw/settings
 fi
+if [ "$(grep "^LOGDROPCTINVALID" /var/ipfire/optionsfw/settings)" == "" ]; then
+	echo "LOGDROPCTINVALID=on" >> /var/ipfire/optionsfw/settings
+fi
 
 # Apply sysctl changes
 /etc/init.d/sysctl start
diff --git a/html/cgi-bin/optionsfw.cgi b/html/cgi-bin/optionsfw.cgi
index 481d5bdbd..5611b71b7 100644
--- a/html/cgi-bin/optionsfw.cgi
+++ b/html/cgi-bin/optionsfw.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2014-2021  IPFire Team  <info(a)ipfire.org>                     #
+# Copyright (C) 2007-2022  IPFire Team  <info(a)ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -116,6 +116,9 @@ $checked{'DROPSPOOFEDMARTIAN'}{$settings{'DROPSPOOFEDMARTIAN'}} = "checked='chec
 $checked{'DROPHOSTILE'}{'off'} = '';
 $checked{'DROPHOSTILE'}{'on'} = '';
 $checked{'DROPHOSTILE'}{$settings{'DROPHOSTILE'}} = "checked='checked'";
+$checked{'LOGDROPCTINVALID'}{'off'} = '';
+$checked{'LOGDROPCTINVALID'}{'on'} = '';
+$checked{'LOGDROPCTINVALID'}{$settings{'LOGDROPCTINVALID'}} = "checked='checked'";
 $checked{'DROPPROXY'}{'off'} = '';
 $checked{'DROPPROXY'}{'on'} = '';
 $checked{'DROPPROXY'}{$settings{'DROPPROXY'}} = "checked='checked'";
@@ -211,6 +214,13 @@ END
 			<input type='radio' name='DROPNEWNOTSYN' value='off' $checked{'DROPNEWNOTSYN'}{'off'} /> $Lang::tr{'off'}
 		</td>
 	</tr>
+	<tr>
+		<td align='left' width='60%'>$Lang::tr{'log dropped conntrack invalids'}</td>
+		<td align='left'>
+			$Lang::tr{'on'} <input type='radio' name='LOGDROPCTINVALID' value='on' $checked{'LOGDROPCTINVALID'}{'on'} />/
+			<input type='radio' name='LOGDROPCTINVALID' value='off' $checked{'LOGDROPCTINVALID'}{'off'} /> $Lang::tr{'off'}
+		</td>
+	</tr>
 	<tr>
 		<td align='left' width='60%'>$Lang::tr{'drop input'}</td>
 		<td align='left'>
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index cf34fd86e..93aaff203 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -1603,6 +1603,7 @@
 'locationblock enable feature' => 'Location-basierte Filterung aktivieren:',
 'locationblock flag' => 'Flagge',
 'log' => 'Protokoll',
+'log dropped conntrack invalids' => 'Verworfene, von der Verbindungsverfolgung als INVALID eingestufte Pakete protokollieren',
 'log enabled' => 'Protokoll aktiviert',
 'log level' => 'Protokollierungsniveau',
 'log lines per page' => 'Zeilen pro Seite',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index b17064713..f534a49bd 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -1651,6 +1651,7 @@
 'locationblock enable feature' => 'Enable Location based blocking:',
 'locationblock flag' => 'Flag',
 'log' => 'Log',
+'log dropped conntrack invalids' => 'Log dropped packets classified as INVALID by connection tracking',
 'log enabled' => 'Log Enabled',
 'log level' => 'Log Level',
 'log lines per page' => 'Lines per page',
diff --git a/lfs/configroot b/lfs/configroot
index 9f3188aab..ed264e72b 100644
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -132,6 +132,7 @@ $(TARGET) :
 	echo  "DROPWIRELESSFORWARD=on"	>> $(CONFIG_ROOT)/optionsfw/settings
 	echo  "DROPSPOOFEDMARTIAN=on"	>> $(CONFIG_ROOT)/optionsfw/settings
 	echo  "DROPHOSTILE=on"		>> $(CONFIG_ROOT)/optionsfw/settings
+	echo  "LOGDROPCTINVALID=on"	>> $(CONFIG_ROOT)/optionsfw/settings
 	echo  "POLICY=MODE2"		>> $(CONFIG_ROOT)/firewall/settings
 	echo  "POLICY1=MODE2"		>> $(CONFIG_ROOT)/firewall/settings
 	echo  "USE_ISP_NAMESERVERS=on"  >> $(CONFIG_ROOT)/dns/settings
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 2f4b4e30e..f0b7d70ff 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -120,7 +120,9 @@ iptables_init() {
 
 	# Connection tracking chains
 	iptables -N CTINVALID
-	iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
+	if [ "$LOGDROPCTINVALID" == "on" ]; then
+		iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
+	fi
 	iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
 
 	iptables -N CONNTRACK


hooks/post-receive
--
IPFire 2.x development tree