bug#65275: closed ([PATCH] services: %default-nftables-ruleset: Tighten the rules.)

[GNU bug Tracking System]

Your message dated Thu, 19 Oct 2023 22:00:24 +0200
with message-id <87il72z8kn.fsf@gnu.org>
and subject line Re: [bug#65275] [PATCH] services: %default-nftables-ruleset: 
Tighten the rules.
has caused the debbugs.gnu.org bug report #65275,
regarding [PATCH] services: %default-nftables-ruleset: Tighten the rules.
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs@gnu.org.)


-- 
65275: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=65275
GNU Bug Tracking System
Contact help-debbugs@gnu.org with problems
> --- Begin Message ---
>
>
>
> Subject: 
>
> [PATCH] services: %default-nftables-ruleset: Tighten the rules.
>
>
>
>
> Date: 
>
> Mon, 14 Aug 2023 01:21:33 +0200
>
>
>
>
> Packets for local host IP ranges should be coming only over lo.  If that is
> not the case, we should drop them.  Use iif for the check instead of iifname,
> lo is guaranteed to exists, and iif is faster.
>
> * gnu/services/networking.scm: Tighten the rules.
> ---
>  gnu/services/networking.scm | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
> index 5657b141d9..e24d2a876a 100644
> --- a/gnu/services/networking.scm
> +++ b/gnu/services/networking.scm
> @@ -1804,7 +1804,10 @@ (define %default-nftables-ruleset
>      ct state { established, related } accept
>  
>      # allow from loopback
> -    iifname lo accept
> +    iif lo accept
> +    # drop connections to lo not coming from lo
> +    iif != lo ip daddr 127.0.0.1/8 drop
> +    iif != lo ip6 daddr ::1/128 drop
>  
>      # allow icmp
>      ip protocol icmp accept
>
> base-commit: be6f5edd445850720dfcec2642db643b84fc0645
> -- 
> 2.41.0
>
>
>
>
> --- End Message ---
> --- Begin Message ---
>
>
>
> Subject: 
>
> Re: [bug#65275] [PATCH] services: %default-nftables-ruleset: Tighten the rules.
>
>
>
>
> Date: 
>
> Thu, 19 Oct 2023 22:00:24 +0200
>
>
>
>
> User-agent: 
>
> Gnus/5.13 (Gnus v5.13)
>
>
>
>
> Hi,
>
> Tomas Volf <wolf@wolfsden.cz> skribis:
>
> > Packets for local host IP ranges should be coming only over lo.  If that is
> > not the case, we should drop them.  Use iif for the check instead of iifname,
> > lo is guaranteed to exists, and iif is faster.
> >
> > * gnu/services/networking.scm: Tighten the rules.
>
> I tweaked the commit log and finally applied it, thanks!
>
> Ludo’.
>
>
> --- End Message ---