|
 |
24f428 |
From e387abcc0f63b83a407c720a99f4d5ea787186d6 Mon Sep 17 00:00:00 2001
|
|
|
24f428 |
From: Eric Garver <e@erig.me>
|
|
|
24f428 |
Date: Thu, 20 Dec 2018 15:34:36 -0500
|
|
|
24f428 |
Subject: [PATCH 17/23] ipXtables: simplify rpfilter rule generation
|
|
|
24f428 |
|
|
|
24f428 |
Don't bother specifying indexes. Just insert them in the correct order.
|
|
|
24f428 |
|
|
|
24f428 |
(cherry picked from commit e93b1c1801ce2b8a71e433d90f095a7693e9a2a7)
|
|
|
24f428 |
---
|
|
|
24f428 |
src/firewall/core/ipXtables.py | 18 +++++++++---------
|
|
|
24f428 |
1 file changed, 9 insertions(+), 9 deletions(-)
|
|
|
24f428 |
|
|
|
24f428 |
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
|
24f428 |
index b98ba5228e68..2bd8cc20dc7b 100644
|
|
|
24f428 |
--- a/src/firewall/core/ipXtables.py
|
|
|
24f428 |
+++ b/src/firewall/core/ipXtables.py
|
|
|
24f428 |
@@ -1132,19 +1132,19 @@ class ip6tables(ip4tables):
|
|
|
24f428 |
|
|
|
24f428 |
def build_rpfilter_rules(self, log_denied=False):
|
|
|
24f428 |
rules = []
|
|
|
24f428 |
- rules.append([ "-I", "PREROUTING", "1", "-t", "raw",
|
|
|
24f428 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
24f428 |
+ "-m", "rpfilter", "--invert", "-j", "DROP" ])
|
|
|
24f428 |
+ if log_denied != "off":
|
|
|
24f428 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
24f428 |
+ "-m", "rpfilter", "--invert",
|
|
|
24f428 |
+ "-j", "LOG",
|
|
|
24f428 |
+ "--log-prefix", "rpfilter_DROP: " ])
|
|
|
24f428 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
24f428 |
"-p", "ipv6-icmp",
|
|
|
24f428 |
"--icmpv6-type=neighbour-solicitation",
|
|
|
24f428 |
"-j", "ACCEPT" ]) # RHBZ#1575431, kernel bug in 4.16-4.17
|
|
|
24f428 |
- rules.append([ "-I", "PREROUTING", "2", "-t", "raw",
|
|
|
24f428 |
+ rules.append([ "-I", "PREROUTING", "-t", "raw",
|
|
|
24f428 |
"-p", "ipv6-icmp",
|
|
|
24f428 |
"--icmpv6-type=router-advertisement",
|
|
|
24f428 |
"-j", "ACCEPT" ]) # RHBZ#1058505
|
|
|
24f428 |
- rules.append([ "-I", "PREROUTING", "3", "-t", "raw",
|
|
|
24f428 |
- "-m", "rpfilter", "--invert", "-j", "DROP" ])
|
|
|
24f428 |
- if log_denied != "off":
|
|
|
24f428 |
- rules.append([ "-I", "PREROUTING", "3", "-t", "raw",
|
|
|
24f428 |
- "-m", "rpfilter", "--invert",
|
|
|
24f428 |
- "-j", "LOG",
|
|
|
24f428 |
- "--log-prefix", "rpfilter_DROP: " ])
|
|
|
24f428 |
return rules
|
|
|
24f428 |
--
|
|
|
24f428 |
2.20.1
|
|
|
24f428 |
|