diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2016-08-08 15:52:28 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2016-08-08 16:16:04 +0200 |
| commit | 6009904eb4dfe91e3d0b5cb96c4095232a303835 (patch) | |
| tree | 5e34398dc80b2632aeea2138acfaf693831f7737 | |
| parent | 47b23946cb2d51c486cd01596744955f850e2060 (diff) | |
| download | firewall3-6009904eb4dfe91e3d0b5cb96c4095232a303835.tar.gz | |
zones: restrict default ACCEPT rules to NEW ctstate
Restrict the per-zone default accept rules to only accept streams with
conntrack state NEW when drop_invalid is disabled.
This commit hardens the firewall in order to allow disabling drop_invalid
by default since ctstate INVALID also matches desired traffic like IPv6
neighbour discovery messages.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
| -rw-r--r-- | zones.c | 8 |
1 files changed, 8 insertions, 0 deletions
@@ -348,6 +348,10 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL); fw3_ipt_rule_target(r, jump_target(t)); fw3_ipt_rule_extra(r, zone->extra_src); + + if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) + fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name, fw3_flag_names[t]); } @@ -357,6 +361,10 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub); fw3_ipt_rule_target(r, jump_target(t)); fw3_ipt_rule_extra(r, zone->extra_dest); + + if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) + fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name, fw3_flag_names[t]); } |