[bug#65275] [PATCH] services: %default-nftables-ruleset: Tighten the rules.

[Tomas Volf]

Packets for local host IP ranges should be coming only over lo.  If that is
not the case, we should drop them.  Use iif for the check instead of iifname,
lo is guaranteed to exists, and iif is faster.

* gnu/services/networking.scm: Tighten the rules.
---
 gnu/services/networking.scm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 5657b141d9..e24d2a876a 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -1804,7 +1804,10 @@ (define %default-nftables-ruleset
     ct state { established, related } accept
 
     # allow from loopback
-    iifname lo accept
+    iif lo accept
+    # drop connections to lo not coming from lo
+    iif != lo ip daddr 127.0.0.1/8 drop
+    iif != lo ip6 daddr ::1/128 drop
 
     # allow icmp
     ip protocol icmp accept

base-commit: be6f5edd445850720dfcec2642db643b84fc0645
-- 
2.41.0