From 6ee961b06827a7b2475d677d2b74c84714b621d1 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Fri, 22 May 2020 10:47:21 +0000 Subject: [PATCH 1/2] Block non-local traffic to the Weave control port We expect the loopback address 127.0.0.1 to be accessible only from the local host. We need to allow RELATED,ESTABLISHED traffic which may be the return path of a Kubernetes HostPort. --- net/bridge.go | 5 +++++ weave | 1 + 2 files changed, 6 insertions(+) diff --git a/net/bridge.go b/net/bridge.go index 0cf0e17b..f27e3175 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -469,6 +469,11 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error { } } + // Block non-local traffic to the Weave control port + if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil { + return err + } + if config.NPC { // Steer traffic via the NPC. diff --git a/weave b/weave index 03ff58b1..b824d008 100755 --- a/weave +++ b/weave @@ -483,6 +483,7 @@ destroy_bridge() { [ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE) + run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true From f78c4dacc54adb42a48a64c1b2a1a266b103cb45 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 28 May 2020 10:12:54 +0000 Subject: [PATCH 2/2] Add release v2.6.3 --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5c36fe5..33a29538 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +## Release 2.6.3 + +This release has a couple of security improvements, and some other fixes. + +* Block non-local traffic to the Weave control port #3805 +* Tell Linux not to accept router advisory messages #3801 +* Network Policy Controller: add a metric to show errors while operating #3804 +* Network Policy Controller: don't treat named port as a fatal error #3790 + ## Release 2.6.2 This release fixes a regression found in 2.6.1 release and removes a possible case