* [bug#65275] [PATCH] services: %default-nftables-ruleset: Tighten the rules.
@ 2023-08-13 23:21 Tomas Volf
2023-10-19 20:00 ` bug#65275: " Ludovic Courtès
0 siblings, 1 reply; 2+ messages in thread
From: Tomas Volf @ 2023-08-13 23:21 UTC (permalink / raw)
To: 65275; +Cc: Tomas Volf
Packets for local host IP ranges should be coming only over lo. If that is
not the case, we should drop them. Use iif for the check instead of iifname,
lo is guaranteed to exists, and iif is faster.
* gnu/services/networking.scm: Tighten the rules.
---
gnu/services/networking.scm | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 5657b141d9..e24d2a876a 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1804,7 +1804,10 @@ (define %default-nftables-ruleset
ct state { established, related } accept
# allow from loopback
- iifname lo accept
+ iif lo accept
+ # drop connections to lo not coming from lo
+ iif != lo ip daddr 127.0.0.1/8 drop
+ iif != lo ip6 daddr ::1/128 drop
# allow icmp
ip protocol icmp accept
base-commit: be6f5edd445850720dfcec2642db643b84fc0645
--
2.41.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* bug#65275: [PATCH] services: %default-nftables-ruleset: Tighten the rules.
2023-08-13 23:21 [bug#65275] [PATCH] services: %default-nftables-ruleset: Tighten the rules Tomas Volf
@ 2023-10-19 20:00 ` Ludovic Courtès
0 siblings, 0 replies; 2+ messages in thread
From: Ludovic Courtès @ 2023-10-19 20:00 UTC (permalink / raw)
To: Tomas Volf; +Cc: 65275-done
Hi,
Tomas Volf <wolf@wolfsden.cz> skribis:
> Packets for local host IP ranges should be coming only over lo. If that is
> not the case, we should drop them. Use iif for the check instead of iifname,
> lo is guaranteed to exists, and iif is faster.
>
> * gnu/services/networking.scm: Tighten the rules.
I tweaked the commit log and finally applied it, thanks!
Ludo’.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-10-19 20:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-13 23:21 [bug#65275] [PATCH] services: %default-nftables-ruleset: Tighten the rules Tomas Volf
2023-10-19 20:00 ` bug#65275: " Ludovic Courtès
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.