[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 69031f7674295d6d95219a97063c718beecc1052

[Michael Tremer <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1808 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  69031f7674295d6d95219a97063c718beecc1052 (commit)
      from  bb46f3bef8445a0dba2e92bbb614113a9a4adcaf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 69031f7674295d6d95219a97063c718beecc1052
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Wed Apr 3 21:42:13 2024 +0100

    suricata: Disable fail-open on NFQUEUE
    
    This change causes that if suricata crashes, the NFQUEUE will no longer
    fall into a mode where ALL packets are being accepted. This used the be
    the case before which opened the entire firewall.
    
    If suricata randomly crashes, we will fall back to the "bypass" mode
    where packets will bypass suricata, but nothing else.
    
    Fixes: #13642
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/suricata/suricata.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Difference in files:
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index fb4f9426b..5bec5cd01 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -351,7 +351,7 @@ nfq:
    bypass-mask: 1073741824
 #  route-queue: 2
 #  batchcount: 20
-   fail-open: yes
+   fail-open: no
 
 ##
 ## Step 5: App Layer Protocol Configuration


hooks/post-receive
--
IPFire 2.x development tree