sad/firehol
1
0
Fork 0
mirror of https://github.com/firehol/firehol.git synced 2024-06-25 16:38:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

allow DROP_INVALID with any action (e.g. REJECT)

Browse Source
This commit is contained in:
Costa Tsaousis (ktsaou) 2018-03-06 15:47:01 +02:00
parent 08ee50c2a0
commit b776394cde
No known key found for this signature in database
GPG Key ID: 29CA335889B9A863
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sbin/firehol
View File

@ -409,6 +409,9 @@ FIREHOL_DROP_INVALID=1
# Default: 1
FIREHOL_LOG_DROP_INVALID=1
# the action to be performed when we drop INVALID packets
FIREHOL_DROP_INVALID_ACTION="DROP"
# If set to 1, FireHOL will silently drop orphan TCP packets with ACK,FIN set.
# In modern kernels, the connection tracker detects closed sockets
# and removes them from memory before receiving the FIN,ACK from the remote
@ -5640,9 +5643,9 @@ protection() {
invalid)
if [ "${FIREHOL_DROP_INVALID}" -eq 0 ]
then
set_work_function "Rules for dropping invalid packets on '${prface}' for ${work_cmd} '${work_name}'"
set_work_function "Rules to ${FIREHOL_DROP_INVALID_ACTION} invalid packets on '${prface}' for ${work_cmd} '${work_name}'"
rule in chain "${in}_${work_name}" state INVALID action drop || return 1
rule in chain "${in}_${work_name}" state INVALID action ${FIREHOL_DROP_INVALID_ACTION} || return 1
fi
;;
@ -11838,9 +11841,9 @@ firewall_filtering_policy_common_late() {
if [ ${FIREHOL_LOG_DROP_INVALID} -eq 1 ]
then
rule table filter chain ${iptables_chain} state INVALID action DROP loglimit "BLOCKED INVALID ${iptables_chain}"
rule table filter chain ${iptables_chain} state INVALID action ${FIREHOL_DROP_INVALID_ACTION} loglimit "${FIREHOL_DROP_INVALID_ACTION} INVALID ${iptables_chain}"
else
${iptables_cmd} -t filter -A ${iptables_chain} -m conntrack --ctstate INVALID -j DROP
rule table filter chain ${iptables_chain} state INVALID action ${FIREHOL_DROP_INVALID_ACTION}
fi
fi