Enhance the security of the netfilter conntrack helpers

This is suggested here
  https://home.regit.org/netfilter-en/secure-use-of-helpers/
and deprecated in the kernel (#10665).

diff --git a/config/etc/modprobe.d/nf_conntrack.conf b/config/etc/modprobe.d/nf_conntrack.conf
new file mode 100644 (file)
index 0000000..d5a1813
--- /dev/null
+++ b/config/etc/modprobe.d/nf_conntrack.conf
@@ -0,0 +1,2 @@
+# Disable automatic conntrack helper assignment
+options nf_conntrack nf_conntrack_helper=0

diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index 90e28d9c4c26cc7f404ae5766b4088de30215198..b5a996bc48ca0159c7db5aa5083808c450650f93 100644 (file)
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -22,6 +22,7 @@ etc/mime.types
 etc/modprobe.d
 etc/modprobe.d/btmrvl_sdio.conf
 etc/modprobe.d/cfg80211.conf
+etc/modprobe.d/nf_conntrack.conf
 etc/modprobe.d/pcspeaker.conf
 etc/modules.conf
 etc/mtab

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 8ca02bc9d1932b4530556d5baf29ef0053eb090d..8040ed4038b3fe7276cfea43f9f180be14a9fe57 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -21,9 +21,11 @@ iptables_init() {
        iptables -F
        iptables -t nat -F
        iptables -t mangle -F
+       iptables -t raw -F
        iptables -X
        iptables -t nat -X
        iptables -t mangle -X
+       iptables -t raw -X
 
        # Set up policies
        iptables -P INPUT DROP
@@ -84,10 +86,36 @@ iptables_init() {
        iptables -A INPUT   -p tcp -j BADTCP
        iptables -A FORWARD -p tcp -j BADTCP
 
-       # Connection tracking chain
+       # Connection tracking chains
        iptables -N CONNTRACK
-       iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+       iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
        iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
+       iptables -t raw -N CONNTRACK
+       iptables -t raw -A PREROUTING -j CONNTRACK
+
+       # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
+
+       # SIP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper sip -j ACCEPT
+       for proto in udp tcp; do
+               iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
+       done
+
+       # FTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
+       iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
+
+       # PPTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper pptp -j ACCEPT
+       iptables -t raw -A CONNTRACK -p udp --dport 1723 -j CT --helper pptp
+
+       # TFTP
+       iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+               -m helper --helper tftp -j ACCEPT
+       iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
 
        # Fix for braindead ISP's
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu