[PATCH] firewall: Accept traffic on loopback interface if source and destination are within 127.0.0.0/8 only

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1368 bytes --]

This ensures traffic on the loopback interface matches the IPv4
loopback characteristics (source and destination are within 127.0.0.0/8)
and prevents any damage in the unlikely case of non-loopback traffic
being injected/emitted (in)to the loopback interface.

Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
Cc: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 src/initscripts/system/firewall | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 00512d9fa..409aaf7a9 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -219,10 +219,10 @@ iptables_init() {
 	iptables -A INPUT -j ICMPINPUT
 	iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 
-	# Accept everything on loopback
+	# Accept everything on loopback if both source and destination are within 127.0.0.0/8
 	iptables -N LOOPBACK
-	iptables -A LOOPBACK -i lo -j ACCEPT
-	iptables -A LOOPBACK -o lo -j ACCEPT
+	iptables -A LOOPBACK -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+	iptables -A LOOPBACK -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
 
 	# Filter all packets with loopback addresses on non-loopback interfaces.
 	iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP
-- 
2.26.1