[elpa] externals/nftables-mode b2991ce112 05/41: Notes from RFC4890 (separate vmaps initially)

[Stefan Monnier]

branch: externals/nftables-mode
commit b2991ce112d5bc13f3f61bcb9db77176c80c36da
Author: Trent W. Buck <trentbuck@gmail.com>
Commit: Trent W. Buck <trentbuck@gmail.com>

    Notes from RFC4890 (separate vmaps initially)
---
 nftables-host.nft | 46 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 44 insertions(+), 2 deletions(-)

diff --git a/nftables-host.nft b/nftables-host.nft
index 5ff348a36d..184e3c4465 100644
--- a/nftables-host.nft
+++ b/nftables-host.nft
@@ -62,6 +62,12 @@
 ####
 #### NOTE: "table x" is implicitly "table ip x", which is IPv4 only.
 ####       If you want dual-stack, say "table inet x".
+####
+#### NOTE: If you blanket allow ICMPv6, YOU ARE TOTALLY INSECURE!
+####       If you blanket deny ICMPv6, YOU BROKE THE INTERNET!
+####       Ref. https://www.ietf.org/rfc/rfc4890.txt
+####       Ref. 
https://raw.githubusercontent.com/intel/intel-iot-refkit/master/meta-refkit-core/recipes-security/nftables-settings-default/files/firewall.template
+
 
 # FIXME: add ICMPv6 then change "table ip" to "table inet" (i.e. dual-stack).
 # FIXME: rate-limit ICMPv4 by source IP?
@@ -72,7 +78,6 @@ table inet my_filter {
     chain my_input {
         type filter hook input priority filter
         policy drop
-
         # Typically 95%+ of packets are part of an already-established flow.
         # Allow those first, so we're a fast, stateful firewall.
         # The rest SHOULD be "ct state new" (or untracked).
@@ -84,8 +89,45 @@ table inet my_filter {
         iif lo                       accept
         # Allow arbitrary IPv4/ICMP and IPv6/ICMPv6.
         # FIXME: this is too broad -- narrow this!
+        # Ref. https://www.ietf.org/rfc/rfc4890.txt
+        # Ref. 
https://raw.githubusercontent.com/intel/intel-iot-refkit/master/meta-refkit-core/recipes-security/nftables-settings-default/files/firewall.template
         ip protocol icmp             accept
-        ip6 nexthdr icmpv6           accept
+#       ip6 nexthdr icmpv6           accept  comment "blanket allow ICMPv6 --- 
insecure!"
+
+
+        # FOR THE FORWARD CHAIN (RFC 4890 4.3)
+        icmpv6 type vmap {
+              1 -   4 : accept, # RFC 4890 4.3.1 essential errors
+            128 - 129 : accept, # RFC 4890 4.3.1 Echo (ping)
+            144 - 147 : accept, # RFC 4890 4.3.2 Mobile IPv6
+                  150 : drop,   # RFC 4890 4.3.4 Seamoby
+              5 -  99 : drop,   # RFC 4890 4.3.4 unallocated error messages
+            102 - 126 : drop,   # RFC 4890 4.3.4 unallocated error messages
+            154 - 199 : drop,   # RFC 4890 4.3.4 unallocated informational 
messages
+            202 - 254 : drop,   # RFC 4890 4.3.4 unallocated informational 
messages
+            139 - 140 : drop,   # RFC 4890 4.3.5 node information
+                  138 : drop,   # RFC 4890 4.3.5 route renumbering
+            100 - 101 : drop,   # RFC 4890 4.3.5 experimental allocations
+            200 - 201 : drop,   # RFC 4890 4.3.5 experimental allocations
+                  127 : drop,   # RFC 4890 4.3.5 extension type numbers
+                  255 : drop,   # RFC 4890 4.3.5 extension type numbers
+        }
+
+        # FOR THE INPUT CHAIN (RFC 4890 4.4)
+        icmpv6 type vmap {
+              1 -   4 : accept, # RFC 4890 4.4.1 essential errors
+            128 - 129 : accept, # RFC 4890 4.4.1 Echo (ping)
+            133 - 136 : accept,  # RFC 4890 4.4.1 (replaces ARP and DHCPv4)
+            141 - 142 : accept,  # RFC 4890 4.4.1 (replaces ARP and DHCPv4)
+            130 - 132 : accept,  # RFC 4890 4.4.1 LLMNR
+                  143 : accept,  # RFC 4890 4.4.1 LLMNR
+            148 - 149 : accept,  # RFC 4890 4.4.1 SEND
+            151 - 153 : accept,  # RFC 4890 4.4.1 Multicast Router
+                  137 : drop,  # RFC 4890 4.4.4 Redirect
+            139 - 140 : drop,  # RFC 4890 4.4.4 Node Information
+        }
+
+
 
         # YOUR RULES HERE.
         # NOTE: service names resolve via nss (/etc/hosts) only in nft 0.9.1+!