Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[caclmgrd] Add a rule to allow all connections from localhost #1858

Merged
merged 3 commits into from
Jul 13, 2018
Merged

[caclmgrd] Add a rule to allow all connections from localhost #1858

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e933747
[caclmgrd] Add a rule to allow all connections from localhost
jleveque Jul 12, 2018
e07a8e2
Make rule interface-based, not IP-based for security; Add IPv6 rule
jleveque Jul 12, 2018
3eb31ee
Allow incoming traffic on lo ONLY if from localhost IPs
jleveque Jul 12, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions files/image_config/caclmgrd/caclmgrd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,10 @@ class ControlPlaneAclManager(object):
iptables_cmds.append("ip6tables -F")
iptables_cmds.append("ip6tables -X")

# Add iptables commands to allow all IPv4 and IPv6 traffic from localhost
iptables_cmds.append("iptables -A INPUT -s 127.0.0.1 -i lo -j ACCEPT")
iptables_cmds.append("ip6tables -A INPUT -s ::1 -i lo -j ACCEPT")

# Get current ACL tables and rules from Config DB
self._tables_db_info = self.config_db.get_table(self.ACL_TABLE)
self._rules_db_info = self.config_db.get_table(self.ACL_RULE)
Expand Down