Bug 847707 - firewalld: needs source address validation
Summary: firewalld: needs source address validation
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: firewalld
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 847757
Blocks: 847708 1045104
TreeView+ depends on / blocked
 
Reported: 2012-08-13 10:08 UTC by Florian Weimer
Modified: 2014-04-03 13:07 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
: 1045104 (view as bug list)
Environment:
Last Closed: 2014-04-03 13:07:34 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Florian Weimer 2012-08-13 10:08:19 UTC
ESTABLISHED/RELATED rules match packets irrespective of the interface they arrive on.  This means that without rp_filter=1, connected devices can inject traffic into existing flows and send packets to services to which they would not ordinarily have access.  Only rp_filter=1 prevents that, rp_filter=2 (loose uRPF) is not sufficient.

As far as I can tell, the default configuration sets rp_filter=1 on IPv4 interfaces, so this is just additional hardening for IPv4.  A sanity check in firewalld for the rp_filter setting might therefore be sufficient.

Not sure about IPv6, I couldn't find an equivalent to rp_filter there, so this might be an actual loophole there.

Comment 1 Florian Weimer 2012-08-14 13:19:19 UTC
Linux 3.3 introduced the rpfilter match type (for the raw and mangle chains).  This can be used to implement filtering for IPv6.  In userspace, iptables version version 1.4.14 is required.

Comment 2 Jaroslav Reznik 2013-04-05 12:24:41 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19

Comment 4 Thomas Woerner 2014-01-13 14:48:42 UTC
Enable IPv6_rpfilter by default: https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=a1a48ea3a2fc9f3174c814540cbf28b6a2105a7c


Note You need to log in before you can comment on or make changes to this bug.