Skip to content

firewall: fix DNS accept rule port on internal networks with custom dns_port #1509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ajoshua2004 wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −6
Open

firewall: fix DNS accept rule port on internal networks with custom dns_port #1509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/firewall/nft.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -523,7 +523,7 @@ impl firewall::FirewallDriver for Nftables {
}

// Next, populate basic chains with forwarding rules
// Input chain: ip saddr <subnet> udp dport 53 accept
// Input chain: ip saddr <subnet> udp dport <dns_port> accept
batch.add(make_rule(
Cow::Borrowed(INPUTCHAIN),
Cow::Owned(vec![
Expand Down Expand Up @@ -551,7 +551,7 @@ impl firewall::FirewallDriver for Nftables {
field: Cow::Borrowed("dport"),
}),
)),
right: expr::Expression::Number(53),
right: expr::Expression::Number(network_setup.dns_port as u32),
op: stmt::Operator::EQ,
}),
stmt::Statement::Accept(None),
Expand Down
6 changes: 2 additions & 4 deletions test/250-bridge-nftables.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1500,8 +1500,8 @@ EOF

# INPUT: base chain + one DNS accept per subnet (v4, v6), nothing else
run_in_host_netns nft list chain inet netavark INPUT
assert "${lines[3]}" =~ "ip saddr 10.89.3.0/24 meta l4proto \{ tcp, udp \} th dport 53 accept" "ipv4 DNS accept rule"
assert "${lines[4]}" =~ "ip6 saddr fd10:88:a::/64 meta l4proto \{ tcp, udp \} th dport 53 accept" "ipv6 DNS accept rule"
assert "${lines[3]}" =~ "ip saddr 10.89.3.0/24 meta l4proto \{ tcp, udp \} th dport $dns_port accept" "ipv4 DNS accept rule"
assert "${lines[4]}" =~ "ip6 saddr fd10:88:a::/64 meta l4proto \{ tcp, udp \} th dport $dns_port accept" "ipv6 DNS accept rule"
assert "${#lines[@]}" = 7 "only DNS accept rules in INPUT chain"

# per-subnet chains must be empty: no daddr accept, no masquerade/SNAT
Expand All @@ -1524,8 +1524,6 @@ EOF

# after the redirect DNS arrives on dns_port, so accept that under the drop policy
run_in_host_netns nft add chain inet netavark INPUT \{ type filter hook input priority 0 \; policy drop \; \}
run_in_host_netns nft add rule inet netavark INPUT ip saddr 10.89.3.0/24 meta l4proto \{ tcp, udp \} th dport $dns_port accept
run_in_host_netns nft add rule inet netavark INPUT ip6 saddr fd10:88:a::/64 meta l4proto \{ tcp, udp \} th dport $dns_port accept
run_in_host_netns nft add rule inet netavark INPUT ct state related,established accept
run_in_host_netns nft add rule inet netavark INPUT meta l4proto ipv6-icmp accept

Expand Down