From 5c1af49c835921232a0312819025fb08dddae4b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20M=C3=BCller?= Date: Thu, 17 Feb 2022 20:16:02 +0000 Subject: [PATCH 1/4] firewall: Add proper logging prefix for conntrack INVALID hits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: #12778 Signed-off-by: Peter Müller --- src/initscripts/system/firewall | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index fc355cd5d..2f4b4e30e 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -119,9 +119,13 @@ iptables_init() { iptables -A FORWARD -p tcp -j BADTCP # Connection tracking chains + iptables -N CTINVALID + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" + iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT # Restore any connection marks From 926d840faeafe9528532f42aa12a0922188c1959 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20M=C3=BCller?= Date: Fri, 18 Feb 2022 22:40:55 +0000 Subject: [PATCH 2/4] firewall: Make logging of conntrack INVALIDs configureable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In theory, logging of dropped packets classified by conntrack as being INVALID should never be disabled, since one wants to have a paper trail of what his/her firewall is doing. However, conntrack seems to drop a lot of (at the first glance legitimate) packets, hence bloating the logs, making spotting the important firewall hits more difficult. This patch therefore adds the option to disable logging of packets being dropped by conntrack due to INVALID state. Please note: - This patch does not add this category to the firewall hits graph. - The variables in this patch ("LOGDROPCTINVALID") should make it clear that it is about toggling _logging_, not the actual _dropping_. Other variables are still in need of being renamed to clarify this, which will be done in a dedicated patch. - Also, the changes made to update.sh need to take place in config/rootfiles/core/164/update.sh for "master", since this patch has been developed against "next". Kindly cherry-pick the necessary changes. Partially fixes: #12778 Reported-by: Arne Fitzenreiter Signed-off-by: Peter Müller --- config/rootfiles/core/164/update.sh | 3 +++ html/cgi-bin/optionsfw.cgi | 12 +++++++++++- langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 1 + lfs/configroot | 1 + src/initscripts/system/firewall | 4 +++- 6 files changed, 20 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/core/164/update.sh b/config/rootfiles/core/164/update.sh index e6847359c..05f2a03e4 100644 --- a/config/rootfiles/core/164/update.sh +++ b/config/rootfiles/core/164/update.sh @@ -107,6 +107,9 @@ fi if [ "$(grep "^DROPSPOOFEDMARTIAN" /var/ipfire/optionsfw/settings)" == "" ]; then echo "DROPSPOOFEDMARTIAN=on" >> /var/ipfire/optionsfw/settings fi +if [ "$(grep "^LOGDROPCTINVALID" /var/ipfire/optionsfw/settings)" == "" ]; then + echo "LOGDROPCTINVALID=on" >> /var/ipfire/optionsfw/settings +fi # Apply sysctl changes /etc/init.d/sysctl start diff --git a/html/cgi-bin/optionsfw.cgi b/html/cgi-bin/optionsfw.cgi index 481d5bdbd..5611b71b7 100644 --- a/html/cgi-bin/optionsfw.cgi +++ b/html/cgi-bin/optionsfw.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2014-2021 IPFire Team # +# Copyright (C) 2007-2022 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -116,6 +116,9 @@ $checked{'DROPSPOOFEDMARTIAN'}{$settings{'DROPSPOOFEDMARTIAN'}} = "checked='chec $checked{'DROPHOSTILE'}{'off'} = ''; $checked{'DROPHOSTILE'}{'on'} = ''; $checked{'DROPHOSTILE'}{$settings{'DROPHOSTILE'}} = "checked='checked'"; +$checked{'LOGDROPCTINVALID'}{'off'} = ''; +$checked{'LOGDROPCTINVALID'}{'on'} = ''; +$checked{'LOGDROPCTINVALID'}{$settings{'LOGDROPCTINVALID'}} = "checked='checked'"; $checked{'DROPPROXY'}{'off'} = ''; $checked{'DROPPROXY'}{'on'} = ''; $checked{'DROPPROXY'}{$settings{'DROPPROXY'}} = "checked='checked'"; @@ -211,6 +214,13 @@ END $Lang::tr{'off'} + + $Lang::tr{'log dropped conntrack invalids'} + + $Lang::tr{'on'} / + $Lang::tr{'off'} + + $Lang::tr{'drop input'} diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index cf34fd86e..93aaff203 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1603,6 +1603,7 @@ 'locationblock enable feature' => 'Location-basierte Filterung aktivieren:', 'locationblock flag' => 'Flagge', 'log' => 'Protokoll', +'log dropped conntrack invalids' => 'Verworfene, von der Verbindungsverfolgung als INVALID eingestufte Pakete protokollieren', 'log enabled' => 'Protokoll aktiviert', 'log level' => 'Protokollierungsniveau', 'log lines per page' => 'Zeilen pro Seite', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index b17064713..f534a49bd 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1651,6 +1651,7 @@ 'locationblock enable feature' => 'Enable Location based blocking:', 'locationblock flag' => 'Flag', 'log' => 'Log', +'log dropped conntrack invalids' => 'Log dropped packets classified as INVALID by connection tracking', 'log enabled' => 'Log Enabled', 'log level' => 'Log Level', 'log lines per page' => 'Lines per page', diff --git a/lfs/configroot b/lfs/configroot index 9f3188aab..ed264e72b 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -132,6 +132,7 @@ $(TARGET) : echo "DROPWIRELESSFORWARD=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPSPOOFEDMARTIAN=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPHOSTILE=on" >> $(CONFIG_ROOT)/optionsfw/settings + echo "LOGDROPCTINVALID=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "USE_ISP_NAMESERVERS=on" >> $(CONFIG_ROOT)/dns/settings diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 2f4b4e30e..f0b7d70ff 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -120,7 +120,9 @@ iptables_init() { # Connection tracking chains iptables -N CTINVALID - iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + if [ "$LOGDROPCTINVALID" == "on" ]; then + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + fi iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" iptables -N CONNTRACK From 2ecb2784625f597c676533f63859b49e416f53a1 Mon Sep 17 00:00:00 2001 From: Arne Fitzenreiter Date: Sat, 19 Feb 2022 09:22:06 +0100 Subject: [PATCH 3/4] unbound: fix dns working check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pool.ipfire.org cannot resolved. Now try both default dns servers. If one works dns is working. Signed-off-by: Arne Fitzenreiter Reviewed-by: Peter Müller Signed-off-by: Arne Fitzenreiter --- src/initscripts/system/unbound | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index 1b42ac720..b959520a1 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -267,7 +267,8 @@ get_memory_amount() { fix_time_if_dns_fails() { # If DNS is working, everything is fine - if resolve "ipfire.pool.ntp.org" &>/dev/null; then + if resolve "0.ipfire.pool.ntp.org" &>/dev/null || \ + resolve "1.ipfire.pool.ntp.org" &>/dev/null ; then return 0 fi From 3b45d9561b6d30d9491419a2022f2befaf2b2f4a Mon Sep 17 00:00:00 2001 From: Arne Fitzenreiter Date: Sat, 19 Feb 2022 15:53:54 +0000 Subject: [PATCH 4/4] core164: add unbound initskript Signed-off-by: Arne Fitzenreiter --- config/rootfiles/core/164/filelists/files | 1 + 1 file changed, 1 insertion(+) diff --git a/config/rootfiles/core/164/filelists/files b/config/rootfiles/core/164/filelists/files index 278dc20a6..89118ae62 100644 --- a/config/rootfiles/core/164/filelists/files +++ b/config/rootfiles/core/164/filelists/files @@ -3,6 +3,7 @@ etc/rc.d/init.d/firewall etc/rc.d/init.d/leds etc/rc.d/init.d/partresize etc/rc.d/init.d/squid +etc/rc.d/init.d/unbound etc/suricata/suricata.yaml etc/sysctl.conf opt/pakfire/lib/functions.pl