From ab55a6196256999eb0cd69a230cc326946902522 Mon Sep 17 00:00:00 2001 From: NuxRo Date: Mon, 22 Aug 2016 10:31:41 +0100 Subject: [PATCH] Prevent DNS reflection attacks At least in SG zones DNS on the VR is publicly accessible and as such susceptible to DNS amplification/reflection attacks. This fixes it as per https://issues.apache.org/jira/browse/CLOUDSTACK-6432 Signed-off-by: Rohit Yadav --- .../patches/debian/config/opt/cloud/bin/cs/CsAddress.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py index f78ec4c371c5..6b6bdcda449f 100755 --- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py @@ -397,9 +397,9 @@ def fw_router(self): self.fw.append( ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev]) self.fw.append( - ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -j ACCEPT" % self.dev]) + ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -s %s -j ACCEPT" % (self.dev, self.address['network'])]) self.fw.append( - ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -j ACCEPT" % self.dev]) + ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -s %s -j ACCEPT" % (self.dev, self.address['network'])]) self.fw.append( ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT" % self.dev]) self.fw.append( @@ -452,9 +452,9 @@ def fw_vpcrouter(self): self.fw.append( ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev]) self.fw.append( - ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -j ACCEPT" % self.dev]) + ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -s %s -j ACCEPT" % (self.dev, self.address['network'])]) self.fw.append( - ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -j ACCEPT" % self.dev]) + ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -s %s -j ACCEPT" % (self.dev, self.address['network'])]) self.fw.append( ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT" % self.dev])