rpms/nftables
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Prevent port-shadow attacks in sample nat config. Fixes rhbz#2061917

Browse Source
This commit is contained in:
Phil Sutter 2022-03-08 19:37:13 +01:00
parent de6fc1c6f7
commit 57e70bfa4f
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nat.nft
View File

@ -18,13 +18,22 @@ table ip nftables_svc {
elements = { 192.168.122.0/24 } elements = { 192.168.122.0/24 }
} }
# [CVE-2021-3773] force port randomization for non-locally originated
# connections using suspicious port values to prevent port-shadow
# attacks, i.e. accidental matching of new inbound connections vs.
# existing ones
chain do_masquerade {
meta iif > 0 th sport < 16384 th dport >= 32768 masquerade random
masquerade
}
# base-chain to manipulate conntrack in postrouting, # base-chain to manipulate conntrack in postrouting,
# will see packets for new or related traffic only # will see packets for new or related traffic only
chain POSTROUTING { chain POSTROUTING {
type nat hook postrouting priority srcnat + 20 type nat hook postrouting priority srcnat + 20
policy accept policy accept
iifname @masq_interfaces oifname != @masq_interfaces masquerade iifname @masq_interfaces oifname != @masq_interfaces jump do_masquerade
ip saddr @masq_ips masquerade ip saddr @masq_ips jump do_masquerade
} }
} }

5
nftables.spec
View File

@ -1,6 +1,6 @@
Name: nftables Name: nftables
Version: 1.0.1 Version: 1.0.1
Release: 3%{?dist} Release: 4%{?dist}
# Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track. # Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track.
Epoch: 1 Epoch: 1
Summary: Netfilter Tables userspace utilites Summary: Netfilter Tables userspace utilites
@ -131,6 +131,9 @@ sed -i -e 's/\(sofile=\)".*"/\1"'$sofile'"/' \
%{python3_sitelib}/nftables/ %{python3_sitelib}/nftables/
%changelog %changelog
* Tue Mar 08 2022 Phil Sutter <psutter@redhat.com> - 1:1.0.1-4
- Prevent port-shadow attacks in sample nat config. Fixes rhbz#2061917
* Thu Feb 03 2022 Phil Sutter <psutter@redhat.com> - 1:1.0.1-3 * Thu Feb 03 2022 Phil Sutter <psutter@redhat.com> - 1:1.0.1-3
- Ship a more advanced default config. Fixes rhbz#1999596 - Ship a more advanced default config. Fixes rhbz#1999596