[PATCH] services: %default-nftables-ruleset: Tighten the rules.

  • Done
  • quality assurance status badge
Details
3 participants
  • Ludovic Courtès
  • Tomas Volf
  • Tomas Volf
Owner
unassigned
Submitted by
Tomas Volf
Severity
normal

Debbugs page

Tomas Volf wrote 2 years ago
(address . guix-patches@gnu.org)(name . Tomas Volf)(address . wolf@wolfsden.cz)
cff119b8c775d3a4ae016e66047cd2228cc88278.1691968893.git.wolf@wolfsden.cz
Packets for local host IP ranges should be coming only over lo. If that is
not the case, we should drop them. Use iif for the check instead of iifname,
lo is guaranteed to exists, and iif is faster.

* gnu/services/networking.scm: Tighten the rules.
---
gnu/services/networking.scm | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

Toggle diff (20 lines)
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 5657b141d9..e24d2a876a 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1804,7 +1804,10 @@ (define %default-nftables-ruleset
ct state { established, related } accept
# allow from loopback
- iifname lo accept
+ iif lo accept
+ # drop connections to lo not coming from lo
+ iif != lo ip daddr 127.0.0.1/8 drop
+ iif != lo ip6 daddr ::1/128 drop
# allow icmp
ip protocol icmp accept

base-commit: be6f5edd445850720dfcec2642db643b84fc0645
--
2.41.0
Ludovic Courtès wrote 1 years ago
(name . Tomas Volf)(address . wolf@wolfsden.cz)(address . 65275-done@debbugs.gnu.org)
87il72z8kn.fsf@gnu.org
Hi,

Tomas Volf <wolf@wolfsden.cz> skribis:

Toggle quote (6 lines)
> Packets for local host IP ranges should be coming only over lo. If that is
> not the case, we should drop them. Use iif for the check instead of iifname,
> lo is guaranteed to exists, and iif is faster.
>
> * gnu/services/networking.scm: Tighten the rules.

I tweaked the commit log and finally applied it, thanks!

Ludo’.
Closed
Tomas Volf wrote 1 years ago
control message for bug #65275
(address . control@debbugs.gnu.org)
d875ec07a5e9d2f870592504744cc494@wolfsden.cz
unarchive 65275
quit
Tomas Volf wrote 1 years ago
(address . control@debbugs.gnu.org)
87a5o0z8ef.fsf@wolfsden.cz
submitter 65275 !
quit
?
Your comment

This issue is archived.

To comment on this conversation send an email to 65275@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 65275
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch
You may also tag this issue. See list of standard tags. For example, to set the confirmed and easy tags
mumi command -t +confirmed -t +easy
Or, remove the moreinfo tag and set the help tag
mumi command -t -moreinfo -t +help