From 4782bcca1b8384b95c5ab84e36110ad2ffdba4dc Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Sat, 8 Mar 2014 14:54:39 +0000 Subject: [PATCH] fender.m4: BCP38 source-address filtering, at ebtables level. I found an annoying bug here, reported to Debian as #741101. --- fender.m4 | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/fender.m4 b/fender.m4 index e8e766a..b9ce79f 100644 --- a/fender.m4 +++ b/fender.m4 @@ -41,15 +41,17 @@ run ip6tables -I INPUT -d 2001:ba8:0:1d9::ffff -j DROP run ebtables -F for i in log limit ip ip6; do run modprobe ebt-$i; done -for c in bad-source-addr check-eth0; do +for c in bad-source-addr check-eth0 bcp38 check-bcp38; do run ebtables -X $c >/dev/null 2>&1 || : done -run ebtables -N bad-source-addr -run ebtables -A bad-source-addr \ - --limit 20/second --limit-burst 100 \ - --log-prefix "fw: bad-source-addr(br) " --log-ip --log-ip6 -run ebtables -A bad-source-addr -j DROP +for ch in bad-source-addr bcp38; do + run ebtables -N $ch + run ebtables -A $ch \ + --limit 20/second --limit-burst 100 \ + --log-prefix "fw: $ch(br)" --log-ip --log-ip6 + run ebtables -A $ch -j DROP +done run ebtables -N check-eth0 run ebtables -A check-eth0 -j RETURN -p ip --ip-source ! 212.13.198.64/28 @@ -65,5 +67,21 @@ run ebtables -A check-eth0 -j bad-source-addr -p ip run ebtables -A INPUT -j check-eth0 -i bond0 run ebtables -A FORWARD -j check-eth0 -i bond0 +run ebtables -N check-bcp38 +run ebtables -A check-bcp38 -j RETURN -p ip --ip-source 212.13.198.64/28 +run ebtables -A check-bcp38 -j bcp38 -p ip +run ebtables -A check-bcp38 -j RETURN -p ip6 --ip6-source 2001:ba8:0:1d9::/64 +run ebtables -A check-bcp38 -j RETURN -p ip6 --ip6-source 2001:ba8:1d9::/48 +run ebtables -A check-bcp38 -j RETURN -p ip6 --ip6-source fe80::/10 +run ebtables -A check-bcp38 -j bcp38 -p ip6 +run ebtables -A FORWARD -j check-bcp38 -o bond0 + +## There's a hideous bug in Linux' 3.2.51-1's ebtables: for some reason it +## misparses (at least) locally originated multicast packets, and tries to +## extract IP header fields relative to the start of the Ethernet frame. The +## result is obviously a hideous mess. Don't try to do BCP38 checking for +## locally originated packets until this is fixed. +##run ebtables -A OUTPUT -j check-bcp38 -o bond0 + m4_divert(-1) ###----- That's all, folks -------------------------------------------------- -- 2.11.0