|
 |
21c891 |
From 9d0817d8a21a9d61d7518c2965981879b22f4b36 Mon Sep 17 00:00:00 2001
|
|
|
21c891 |
From: Eric Garver <e@erig.me>
|
|
|
21c891 |
Date: Thu, 20 Dec 2018 15:34:36 -0500
|
|
|
21c891 |
Subject: [PATCH 4/4] ipXtables: simplify rpfilter rule generation
|
|
|
21c891 |
|
|
|
21c891 |
Don't bother specifying indexes. Just insert them in the correct order.
|
|
|
21c891 |
|
|
|
21c891 |
(cherry picked from commit e93b1c1801ce2b8a71e433d90f095a7693e9a2a7)
|
|
|
21c891 |
---
|
|
|
21c891 |
src/firewall/core/ipXtables.py | 18 +++++++++---------
|
|
|
21c891 |
1 file changed, 9 insertions(+), 9 deletions(-)
|
|
|
21c891 |
|
|
|
21c891 |
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
|
21c891 |
index 1940641c982e..d7626df1b023 100644
|
|
|
21c891 |
--- a/src/firewall/core/ipXtables.py
|
|
|
21c891 |
+++ b/src/firewall/core/ipXtables.py
|
|
|
21c891 |
@@ -1290,19 +1290,19 @@ class ip6tables(ip4tables):
|
|
|
21c891 |
|
|
|
21c891 |
def build_rpfilter_rules(self, log_denied=False):
|
|
|
21c891 |
rules = []
|
|
|
21c891 |
- rules.append([ "-I", "PREROUTING", "1", "-t", "raw",
|
|
|
21c891 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
21c891 |
+ "-m", "rpfilter", "--invert", "-j", "DROP" ])
|
|
|
21c891 |
+ if log_denied != "off":
|
|
|
21c891 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
21c891 |
+ "-m", "rpfilter", "--invert",
|
|
|
21c891 |
+ "-j", "LOG",
|
|
|
21c891 |
+ "--log-prefix", "rpfilter_DROP: " ])
|
|
|
21c891 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
21c891 |
"-p", "ipv6-icmp",
|
|
|
21c891 |
"--icmpv6-type=neighbour-solicitation",
|
|
|
21c891 |
"-j", "ACCEPT" ]) # RHBZ#1575431, kernel bug in 4.16-4.17
|
|
|
21c891 |
- rules.append([ "-I", "PREROUTING", "2", "-t", "raw",
|
|
|
21c891 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
21c891 |
"-p", "ipv6-icmp",
|
|
|
21c891 |
"--icmpv6-type=router-advertisement",
|
|
|
21c891 |
"-j", "ACCEPT" ]) # RHBZ#1058505
|
|
|
21c891 |
- rules.append([ "-I", "PREROUTING", "3", "-t", "raw",
|
|
|
21c891 |
- "-m", "rpfilter", "--invert", "-j", "DROP" ])
|
|
|
21c891 |
- if log_denied != "off":
|
|
|
21c891 |
- rules.append([ "-I", "PREROUTING", "3", "-t", "raw",
|
|
|
21c891 |
- "-m", "rpfilter", "--invert",
|
|
|
21c891 |
- "-j", "LOG",
|
|
|
21c891 |
- "--log-prefix", "rpfilter_DROP: " ])
|
|
|
21c891 |
return rules
|
|
|
21c891 |
--
|
|
|
21c891 |
2.18.0
|
|
|
21c891 |
|