From mboxrd@z Thu Jan 1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] firewall: Accept traffic on loopback interface if source and
destination are within 127.0.0.0/8 only
Date: Wed, 13 May 2020 20:21:15 +0000
Message-ID: <01be0c7f-555e-a788-9b79-344fc3a05d34@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7303957274798917604=="
List-Id: <development.lists.ipfire.org>
--===============7303957274798917604==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
This ensures traffic on the loopback interface matches the IPv4
loopback characteristics (source and destination are within 127.0.0.0/8)
and prevents any damage in the unlikely case of non-loopback traffic
being injected/emitted (in)to the loopback interface.
Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org>
Cc: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
---
src/initscripts/system/firewall | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 00512d9fa..409aaf7a9 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -219,10 +219,10 @@ iptables_init() {
iptables -A INPUT -j ICMPINPUT
iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
=20
- # Accept everything on loopback
+ # Accept everything on loopback if both source and destination are within 1=
27.0.0.0/8
iptables -N LOOPBACK
- iptables -A LOOPBACK -i lo -j ACCEPT
- iptables -A LOOPBACK -o lo -j ACCEPT
+ iptables -A LOOPBACK -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+ iptables -A LOOPBACK -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
=20
# Filter all packets with loopback addresses on non-loopback interfaces.
iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP
--=20
2.26.1
--===============7303957274798917604==--