webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-13 12:32:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: always allow outgoing DNS traffic to root servers

Browse Source 
Allowing outgoing DNS traffic (destination port 53, both TCP
and UDP) to the root servers is BCP for some reasons. First,
RFC 5011 assumes resolvers are able to fetch new trust ancors
from the root servers for a certain time period in order to
do key rollovers.

Second, Unbound shows some side effects if it cannot do trust
anchor signaling (see RFC 8145) or fetch the current trust anchor,
resulting in SERVFAILs for arbitrary requests a few minutes.

There is little security implication of allowing DNS traffic
to the root servers: An attacker might abuse this for exfiltrating
data via DNS queries, but is unable to infiltrate data unless
he gains control over at least one root server instance. If
there is no firewall ruleset in place which prohibits any other
DNS traffic than to chosen DNS servers, this patch will not
have security implications at all.

The second version of this patch does not use unnecessary xargs-
call nor changes anything else not related to this issue.

Fixes #12183

Cc: Michael Tremer <michael.tremer@ipfire.org>
Suggested-by: Horace Michael <horace.michael@gmx.com>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
peter.mueller@ipfire.org
2019-10-01 15:22:00 +00:00
committed by Arne Fitzenreiter
parent 974d86532f
commit 70cd5c42f0
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
config/rootfiles/core/137/filelists/files
View File

@@ -1,8 +1,9 @@
etc/system-release
etc/issue
srv/web/ipfire/cgi-bin/credits.cgi
usr/lib/firewall/rules.pl
usr/sbin/firewall-policy
var/ipfire/langs
etc/logrotate.conf
etc/rc.d/init.d/firewall
srv/web/ipfire/cgi-bin/ovpnmain.cgi
usr/lib/firewall/rules.pl
usr/sbin/firewall-policy

12
src/initscripts/system/firewall
View File

@@ -6,6 +6,7 @@
eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
ROOTHINTS="/etc/unbound/root.hints"
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
if [ -f /var/ipfire/red/device ]; then
@@ -307,6 +308,17 @@ iptables_init() {
iptables -A INPUT -j TOR_INPUT
iptables -N TOR_OUTPUT
iptables -A OUTPUT -j TOR_OUTPUT
# Allow outgoing DNS traffic (TCP and UDP) to DNS root servers
local rootserverips="$( awk '/\s+A\s+/ { print $4 }' ${ROOTHINTS} )"
ipset -N root-servers iphash
for ip in "${rootserverips[@]}"; do
ipset add root-servers $ip
done
iptables -A OUTPUT -m set --match-set root-servers dst -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -m set --match-set root-servers dst -p udp --dport 53 -j ACCEPT
# Jump into the actual firewall ruleset.
iptables -N INPUTFW