mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deprecate references to modulate state. Remove rule allowing TCP 1723 inbound when PPTP client is in use, as that's unnecessary.

Browse Source
This commit is contained in:
Chris Buechler 2016-04-06 19:50:39 -05:00
parent ae366af139
commit dfaaa729c3
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/etc/inc/filter.inc
View File

@ -2903,11 +2903,9 @@ function filter_generate_user_rule($rule) {
* # keep state
* works with TCP, UDP, and ICMP.
* # modulate state
* works only with TCP. pfSense will generate strong Initial Sequence Numbers (ISNs)
* for packets matching this rule.
* deprecated
* # synproxy state
* proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods.
* This option includes the functionality of keep state and modulate state combined.
* # none
* do not use state mechanisms to keep track. this is only useful if your doing advanced
* queueing in certain situations. please check the faq.
@ -3360,7 +3358,6 @@ EOD;
case "pptp":
$ipfrules .= <<<EOD
# allow PPTP client
pass in {$log['pass']} on \${$oc['descr']} proto tcp from any to any port = 1723 flags S/SA modulate state tracker {$increment_tracker($tracker)} label "{$fix_rule_label("allow PPTP client on {$oc['descr']}")}"
pass in {$log['pass']} on \${$oc['descr']} proto gre from any to any keep state tracker {$increment_tracker($tracker)} label "{$fix_rule_label("allow PPTP client on {$oc['descr']}")}"
EOD;

6
src/usr/local/www/firewall_rules_edit.php
View File

@ -452,7 +452,7 @@ if ($_POST) {
$reqdfieldsn[] = gettext("Destination");
}
if ($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
if ($_POST['statetype'] == "synproxy state") {
if ($_POST['proto'] != "tcp") {
$input_errors[] = sprintf(gettext("%s is only valid with protocol TCP."), $_POST['statetype']);
}
@ -2026,9 +2026,9 @@ events.push(function() {
} else if (val == 'sloppy state') {
dispstr += 'Sloppy: works with all IP protocols';
} else if (val == 'synproxy state') {
dispstr += 'Synproxy: proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined';
dispstr += 'Synproxy: proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods, at the cost of performance (no SACK or window scaling)';
} else if (val == 'none') {
dispstr += 'None: Do not use state mechanisms to keep track. This is only useful for doing advanced queueing in certain situations';
dispstr += 'None: Do not use state mechanisms to keep track';
}
dispstr += '</span>';