GNU bug report logs - #65275
[PATCH] services: %default-nftables-ruleset: Tighten the rules.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 65275 in the body.
You can then email your comments to 65275 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Tomas Volf <wolf <at> wolfsden.cz>
To: guix-patches <at> gnu.org
Cc: Tomas Volf <wolf <at> wolfsden.cz>
Subject: [PATCH] services: %default-nftables-ruleset: Tighten the rules.
Date: Mon, 14 Aug 2023 01:21:33 +0200

Packets for local host IP ranges should be coming only over lo.  If that is
not the case, we should drop them.  Use iif for the check instead of iifname,
lo is guaranteed to exists, and iif is faster.

* gnu/services/networking.scm: Tighten the rules.
---
 gnu/services/networking.scm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 5657b141d9..e24d2a876a 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1804,7 +1804,10 @@ (define %default-nftables-ruleset
     ct state { established, related } accept
 
     # allow from loopback
-    iifname lo accept
+    iif lo accept
+    # drop connections to lo not coming from lo
+    iif != lo ip daddr 127.0.0.1/8 drop
+    iif != lo ip6 daddr ::1/128 drop
 
     # allow icmp
     ip protocol icmp accept

base-commit: be6f5edd445850720dfcec2642db643b84fc0645
-- 
2.41.0

Message #10 received at 65275-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Tomas Volf <wolf <at> wolfsden.cz>
Cc: 65275-done <at> debbugs.gnu.org
Subject: Re: [bug#65275] [PATCH] services: %default-nftables-ruleset:
 Tighten the rules.
Date: Thu, 19 Oct 2023 22:00:24 +0200

Hi,

Tomas Volf <wolf <at> wolfsden.cz> skribis:

> Packets for local host IP ranges should be coming only over lo.  If that is
> not the case, we should drop them.  Use iif for the check instead of iifname,
> lo is guaranteed to exists, and iif is faster.
>
> * gnu/services/networking.scm: Tighten the rules.

I tweaked the commit log and finally applied it, thanks!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.