From 6ee961b06827a7b2475d677d2b74c84714b621d1 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 22 May 2020 10:47:21 +0000 Subject: [PATCH] Block non-local traffic to the Weave control port We expect the loopback address 127.0.0.1 to be accessible only from the local host. We need to allow RELATED,ESTABLISHED traffic which may be the return path of a Kubernetes HostPort. --- net/bridge.go | 5 +++++ weave | 1 + 2 files changed, 6 insertions(+) diff --git a/net/bridge.go b/net/bridge.go index 0cf0e17b..f27e3175 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -469,6 +469,11 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error { } } + // Block non-local traffic to the Weave control port + if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil { + return err + } + if config.NPC { // Steer traffic via the NPC. diff --git a/weave b/weave index 03ff58b1..b824d008 100755 --- a/weave +++ b/weave @@ -483,6 +483,7 @@ destroy_bridge() { [ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE) + run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true