Restrict the per-zone default accept rules to only accept streams with
conntrack state NEW when drop_invalid is disabled.
This commit hardens the firewall in order to allow disabling drop_invalid
by default since ctstate INVALID also matches desired traffic like IPv6
neighbour discovery messages.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_src);
r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_src);
+
+ if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+ fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+
fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
fw3_flag_names[t]);
}
fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
fw3_flag_names[t]);
}
r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_dest);
r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_dest);
+
+ if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+ fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+
fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
fw3_flag_names[t]);
}
fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
fw3_flag_names[t]);
}