public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/firewall: clean up rpfilter rules properly 

The rpfilter rules wouldn't be removed if it was previously enabled
but disabled in a new generation.
This commit is contained in:
Franz Pletz 2017-05-29 17:24:27 +02:00
parent fde29b2b06
commit a49c2366ef
No known key found for this signature in database
GPG Key ID: 846FDED7792617B4
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
nixos/modules/services/networking/firewall.nix
View File

@ -114,14 +114,15 @@ let
# The "nixos-fw" chain does the actual work. # The "nixos-fw" chain does the actual work.
ip46tables -N nixos-fw ip46tables -N nixos-fw
# Perform a reverse-path test to refuse spoofers # Clean up rpfilter rules
# For now, we just drop, as the raw table doesn't have a log-refuse yet ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2> /dev/null || true
${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) '' ip46tables -t raw -F nixos-fw-rpfilter 2> /dev/null || true
# Clean up rpfilter rules ip46tables -t raw -X nixos-fw-rpfilter 2> /dev/null || true
ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2> /dev/null || true
ip46tables -t raw -F nixos-fw-rpfilter 2> /dev/null || true
ip46tables -t raw -N nixos-fw-rpfilter 2> /dev/null || true
${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) ''
# Perform a reverse-path test to refuse spoofers
# For now, we just drop, as the raw table doesn't have a log-refuse yet
ip46tables -t raw -N nixos-fw-rpfilter 2> /dev/null || true
ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN
# Allows this host to act as a DHCPv4 server # Allows this host to act as a DHCPv4 server