reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3805 from weaveworks/block-remote-localhost

Browse Source 
Block non-local traffic to the Weave control port
This commit is contained in:
Bryan Boreham authored and GitHub committed 2020-05-28 10:50:55 +01:00
2 parents 1f920513de 6ee961b068
commit 9245b73913
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

net/bridge.go
+5
View File
@@ -469,6 +469,11 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
}
}
// Block non-local traffic to the Weave control port
if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil {
return err
}
if config.NPC {
// Steer traffic via the NPC.
weave
+1
View File
@@ -483,6 +483,7 @@ destroy_bridge() {
[ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE)
run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true