Re: Is the article "Secure use of iptables and connection tracking helpers" (by Pablo et al.) still relevant?

[Florian Westphal <fw@strlen.de>]

Binarus <lists@binarus.de> wrote:
> I've come across the following article (which has been co-authored by Pablo):
> 
> https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst
> 
> All statements of this article make sense in my eyes. I have understood that it relates to iptables, not nftables, but it seems that the underlying reasoning and explanations are valid for nftables as well.
> 
> However, since the article is 14 years old (at least), I'd like to know whether it is still up to date and whether we should follow its recommendations.
> 
> For example, the nf_conntrack module in modern kernels (e.g., 6.12.90 on my Debian trixie system) obviously does not have the "nf_conntrack_helper" parameter the article mentions. Hence, setting it to 0 does not effect anything. Setting the "port" parameter to 0 seems to do the trick, though.

You don't have to set it to 0, the feature was removed, i.e. the
'Disable helper by default' section no longer applies.  All helpers are
off unless there are rules that explicitly activate them ('-j CT
--helper ftp' etc).

> In other words, I' like to know whether we should still prevent the automatic loading of the nf_conntrack_sip module, and how we can achieve that.

No.  There is no automatic helper assignement in the kernel anymore and
therefore no helper ever automatically snoops traffic even if the module
is loaded.

The port module arguments are dead-weight and will be removed soon.
They don't do anything these days.