reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block non-local traffic to the Weave control port

Browse Source 
We expect the loopback address 127.0.0.1 to be accessible only from
the local host.

We need to allow RELATED,ESTABLISHED traffic which may be the return
path of a Kubernetes HostPort.
This commit is contained in:
Bryan Boreham committed 2020-05-27 16:43:50 +00:00
1 parent 1f920513de
commit 6ee961b068
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

net/bridge.go
+5
View File
@@ -469,6 +469,11 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
}
}
// Block non-local traffic to the Weave control port
if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil {
return err
}
if config.NPC {
// Steer traffic via the NPC.
weave
+1
View File
@@ -483,6 +483,7 @@ destroy_bridge() {
[ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE)
run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true