ExternalVendorCode/balena-supervisor
1
0
Fork 0
mirror of https://github.com/balena-os/balena-supervisor.git synced 2024-12-19 05:37:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

WIP: Remove DNS firewall rules

Browse Source 
The Engine uses dnsmasq for DNS resolution since OS v2.0-beta.1, by passing
the dnsmasq IP using `--dns` when starting up balenad. It is less complicated
to have dnsmasq handle DNS resolution; the firewall adding DNS rules to
iptables is overly complex with an unclear & undocumented reason as to why.

"WIP" indicates that this commit is under consideration for its security impact.

Change-type: patch
Signed-off-by: Christina Ying Wang <christina@balena.io>
This commit is contained in:
Christina Ying Wang 2024-11-12 11:38:05 -08:00
parent 0a9de69994
commit cfd8dffc51
2 changed files with 0 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/lib/firewall.ts
View File

@ -55,20 +55,6 @@ const standardServices: iptables.Rule[] = [
proto: 'icmp', proto: 'icmp',
target: 'ACCEPT', target: 'ACCEPT',
}, },
{
comment: 'DNS from balena0',
action: iptables.RuleAction.Append,
proto: 'udp',
matches: ['--dport 53', '-i balena0'],
target: 'ACCEPT',
},
{
comment: 'DNS from custom Engine networks',
action: iptables.RuleAction.Append,
proto: 'udp',
matches: ['--dport 53', '-i br+'],
target: 'ACCEPT',
},
]; ];
const standardPolicy: iptables.Rule[] = [ const standardPolicy: iptables.Rule[] = [

24
test/integration/lib/firewall.spec.ts
View File

@ -352,30 +352,6 @@ describe('lib/firewall', function () {
}); });
}; };
it('should have a rule to allow DNS traffic from the balena0 interface', async () => {
await iptablesMock.whilstMocked(
async ({ hasAppliedRules, expectRule }) => {
// set the firewall to be on...
await config.set({ firewallMode: 'on' });
await hasAppliedRules;
[4, 6].forEach((family: 4 | 6) => {
// expect that we have a rule to allow DNS access...
checkForRules(
{
family,
target: 'ACCEPT',
chain: 'BALENA-FIREWALL',
proto: 'udp',
matches: ['--dport 53', '-i balena0'],
},
expectRule,
);
});
},
);
});
it('should have a rule to allow SSH traffic any interface', async () => { it('should have a rule to allow SSH traffic any interface', async () => {
await iptablesMock.whilstMocked( await iptablesMock.whilstMocked(
async ({ hasAppliedRules, expectRule }) => { async ({ hasAppliedRules, expectRule }) => {