8000 Block non-local traffic to the Weave control port by bboreham · Pull Request #3805 · weaveworks/weave · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
This repository has been archived by the owner on Jun 20, 2024. It is now read-only.

Block non-local traffic to the Weave control port #3805

Merged
merged 1 commit into from
May 28, 2020

Conversation

bboreham
Copy link
Contributor

We expect the loopback address 127.0.0.1 to only be accessible from the local host.
However under some Linux configurations it can be accessed remotely. kubernetes/kubernetes#90259

Add an iptables rule to block this case.

@bboreham bboreham added this to the 2.6.3 milestone May 22, 2020
@bboreham bboreham force-pushed the block-remote-localhost branch 5 times, most recently from a2ea34f to 74c55ec Compare May 27, 2020 14:25
We expect the loopback address 127.0.0.1 to be accessible only from
the local host.

We need to allow RELATED,ESTABLISHED traffic which may be the return
path of a Kubernetes HostPort.
@bboreham bboreham force-pushed the block-remote-localhost branch from 74c55ec to 6ee961b Compare May 27, 2020 16:44
@bboreham bboreham merged commit 9245b73 into 2.6 May 28, 2020
@bboreham bboreham deleted the block-remote-localhost branch May 28, 2020 09:51
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant
0