reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3811 from weaveworks/allow-dnat-127

Browse Source 
Only drop traffic to the Weave Net port on 127.0.0.1
This commit is contained in:
Bryan Boreham authored and GitHub committed 2020-05-30 11:07:13 +01:00
2 parents 95c020fbe0 a46d18da0c
commit bef50d3730
3 files changed
+17 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

net/bridge.go
+11 -3
View File
@@ -221,6 +221,7 @@ type BridgeConfig struct {
MTU int
Mac string
Port int
ControlPort string
NoMasqLocal bool
}
@@ -469,10 +470,17 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
}
}
// Block non-local traffic to the Weave control port
if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil {
return err
if config.ControlPort != "" {
if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "--dport", config.ControlPort,
"-m", "addrtype", "!", "--src-type", "LOCAL",
"-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED",
"-m", "comment", "--comment", "Block non-local access to Weave Net control port",
"-j", "DROP"); err != nil {
return err
}
}
// Remove the rule from Weave Net 2.6.3 which dropped too much.
_ = ipt.Delete("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP")
if config.NPC {
// Steer traffic via the NPC.
prog/weaver/main.go
+5
View File
@@ -307,6 +307,11 @@ func main() {
bridgeConfig.Mac = name.String()
bridgeConfig.Port = config.Port
if httpAddr != "" {
if _, port, err := net.SplitHostPort(httpAddr); err == nil {
bridgeConfig.ControlPort = port
}
}
ips := ipset.New(common.LogLogger(), 0)
bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log, ips)
checkFatal(err)
weave
+1 -1
View File
@@ -483,7 +483,7 @@ destroy_bridge() {
[ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE)
run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp --dport 6784 -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -m comment --comment "Block non-local access to Weave Net control port" -j DROP >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53 -j ACCEPT >/dev/null 2>&1 || true
run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1 || true