04/07: services: nftables: Tighten the default rules.

[guix-commits]

civodul pushed a commit to branch master
in repository guix.

commit 82f9e5ac97e076d57b8502c920ac770a82879b9a
Author: Tomas Volf <wolf@wolfsden.cz>
AuthorDate: Mon Aug 14 01:21:33 2023 +0200

    services: nftables: Tighten the default rules.
    
    Packets for local host IP ranges should be coming only over lo.  If that is
    not the case, we should drop them.  Use iif for the check instead of 
iifname,
    lo is guaranteed to exists, and iif is faster.
    
    * gnu/services/networking.scm (%default-nftables-ruleset): Tighten the 
rules.
    
    Signed-off-by: Ludovic Courtès <ludo@gnu.org>
---
 gnu/services/networking.scm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 99889e3072..0508a4282c 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1813,7 +1813,10 @@ table inet filter {
     ct state { established, related } accept
 
     # allow from loopback
-    iifname lo accept
+    iif lo accept
+    # drop connections to lo not coming from lo
+    iif != lo ip daddr 127.0.0.1/8 drop
+    iif != lo ip6 daddr ::1/128 drop
 
     # allow icmp
     ip protocol icmp accept