Skip rules and policies for zones without interfaces

internal/nftables/compiler.go

@@ -417,8 +417,8 @@ func splitAddrs(addr string) []string {
 func (c *Compiler) compileZonePair(state *FirewallState, tag, srcZone, srcAddr, dstZone, dstAddr, proto string,
 	dports, sports config.PortSpec, action config.RuleAction, logLevel string,
 	fwZone string, section config.RuleSection) error {
-	srcIfaces := c.resolveZoneInterfaces(srcZone)
-	dstIfaces := c.resolveZoneInterfaces(dstZone)
+	srcIfaces := c.resolveZoneInterfaces(srcZone, srcAddr != "")
+	dstIfaces := c.resolveZoneInterfaces(dstZone, dstAddr != "")
 	chain := c.selectChain(srcZone, dstZone, fwZone)
 
 	for _, srcIface := range srcIfaces {
@@ -474,7 +474,7 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr,
 		dnatPort = uint16(p)
 	}
 
-	srcIfaces := c.resolveZoneInterfaces(srcZone)
+	srcIfaces := c.resolveZoneInterfaces(srcZone, srcAddr != "")
 
 	matches, err := l4Matches(proto, dports, nil)
 	if err != nil {
@@ -589,8 +589,8 @@ func (c *Compiler) compilePolicies(state *FirewallState) error {
 				}
 
 				chain := c.selectChain(sz, dz, fwZone)
-				srcIfaces := c.resolveZoneInterfaces(sz)
-				dstIfaces := c.resolveZoneInterfaces(dz)
+				srcIfaces := c.resolveZoneInterfaces(sz, false)
+				dstIfaces := c.resolveZoneInterfaces(dz, false)
 
 				for _, si := range srcIfaces {
 					for _, di := range dstIfaces {
@@ -932,34 +932,25 @@ func (c *Compiler) selectChain(srcZone, dstZone, fwZone string) string {
 	return "forward"
 }
 
-func (c *Compiler) resolveZoneInterfaces(zone string) []string {
-	if zone == "all" || zone == "" {
+// resolveZoneInterfaces returns nil (fail closed) for a zone with no interfaces unless an address match narrows the rule.
+func (c *Compiler) resolveZoneInterfaces(zone string, addrNarrowed bool) []string {
+	if z, ok := c.cfg.Zones[zone]; !ok || z.Type == config.ZoneFirewall {
 		return []string{""}
 	}
-	ifaces := c.cfg.ZoneInterfaces(zone)
-	if len(ifaces) > 0 {
+	if ifaces := c.cfg.ZoneInterfaces(zone); len(ifaces) > 0 {
 		return ifaces
 	}
-	if z, ok := c.cfg.Zones[zone]; ok && z.Type == config.ZoneIP && !c.zoneHasHosts(zone) {
-		if !c.warned[zone] {
-			if c.warned == nil {
-				c.warned = map[string]bool{}
-			}
-			c.warned[zone] = true
-			slog.Warn("compiler: zone has no interfaces, skipping its rules", "zone", zone)
-		}
-		return nil
+	if addrNarrowed {
+		return []string{""}
 	}
-	return []string{""}
-}
-
-func (c *Compiler) zoneHasHosts(zone string) bool {
-	for _, h := range c.cfg.Hosts {
-		if h.Zone == zone {
-			return true
+	if !c.warned[zone] {
+		if c.warned == nil {
+			c.warned = map[string]bool{}
 		}
+		c.warned[zone] = true
+		slog.Warn("compiler: zone has no interfaces, skipping its rules", "zone", zone)
 	}
-	return false
+	return nil
 }
 
 func (c *Compiler) expandZoneRef(ref string) []string {

internal/nftables/compiler_test.go

@@ -141,17 +141,17 @@ func TestCompiler_ResolveZoneInterfaces(t *testing.T) {
 	}
 	c := NewCompiler(cfg)
 
-	ifaces := c.resolveZoneInterfaces("net")
+	ifaces := c.resolveZoneInterfaces("net", false)
 	if len(ifaces) != 1 || ifaces[0] != "eth0" {
 		t.Errorf("resolveZoneInterfaces(net) = %v, want [eth0]", ifaces)
 	}
 
-	ifaces = c.resolveZoneInterfaces("all")
+	ifaces = c.resolveZoneInterfaces("all", false)
 	if len(ifaces) != 1 || ifaces[0] != "" {
 		t.Errorf("resolveZoneInterfaces(all) = %v, want [\"\"]", ifaces)
 	}
 
-	ifaces = c.resolveZoneInterfaces("fw")
+	ifaces = c.resolveZoneInterfaces("fw", false)
 	if len(ifaces) != 1 || ifaces[0] != "" {
 		t.Errorf("resolveZoneInterfaces(fw) = %v, want [\"\"]", ifaces)
 	}
@@ -1757,6 +1757,7 @@ func TestCompile_PortAndProtoLists(t *testing.T) {
 		})
 	}
 }
+
 func TestCompile_OutputPolicyMatchesOif(t *testing.T) {
 	cfg := listCfg(func(c *config.Config) {
 		c.Zones["lan"] = config.Zone{Type: config.ZoneIP}
@@ -1769,6 +1770,41 @@ func TestCompile_OutputPolicyMatchesOif(t *testing.T) {
 	}
 }
 
+func TestCompile_InterfacelessZonesFailClosed(t *testing.T) {
+	tests := []struct {
+		name string
+		mod  func(*config.Config)
+	}{
+		{"ipsec zone without interface", func(c *config.Config) {
+			c.Zones["ips"] = config.Zone{Type: config.ZoneIPSec}
+			c.Policy = []config.Policy{{Source: "fw", Dest: "ips", Action: config.PolicyAccept}}
+		}},
+		{"hosts-only zone", func(c *config.Config) {
+			c.Zones["hst"] = config.Zone{Type: config.ZoneIP}
+			c.Hosts = []config.Host{{Zone: "hst", Interface: "eth0", Addresses: []string{"192.0.2.0/24"}}}
+			c.Policy = []config.Policy{{Source: "fw", Dest: "hst", Action: config.PolicyAccept}}
+		}},
+		{"fw all expansion", func(c *config.Config) {
+			c.Zones["ips"] = config.Zone{Type: config.ZoneIPSec}
+			c.Zones["hst"] = config.Zone{Type: config.ZoneIP}
+			c.Hosts = []config.Host{{Zone: "hst", Interface: "eth0", Addresses: []string{"192.0.2.0/24"}}}
+			c.Policy = []config.Policy{{Source: "fw", Dest: "all", Action: config.PolicyDrop}}
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := mustCompile(t, listCfg(tt.mod))
+			for chain := range state.Rules {
+				for _, r := range taggedRules(state, chain, "policy:0") {
+					if describeRule(r) == "" {
+						t.Errorf("%s: un-scoped policy rule", chain)
+					}
+				}
+			}
+		})
+	}
+}
+
 // describeRule renders a rule's iif/oif/saddr/daddr matches, e.g. "iif=eth1 oif=eth2 daddr=192.0.2.1".
 func describeRule(r ManagedRule) string {
 	var parts []string
@@ -1857,14 +1893,19 @@ func TestCompile_CommaZoneLists(t *testing.T) {
 			want: map[string][]string{"forward": {"iif=eth1 oif=eth3", "iif=eth1 oif=eth0"}},
 		},
 		{
-			name: "interface-less ipsec zone keeps zone-agnostic rule, ip zone skipped",
+			name: "interface-less zones are skipped",
 			rule: config.Rule{Action: config.RuleAccept, Source: "lan", Dest: "vpn,dmz"},
-			want: map[string][]string{"forward": {"iif=eth1"}},
+			want: map[string][]string{},
+		},
+		{
+			name: "interface-less zone kept when address narrows it",
+			rule: config.Rule{Action: config.RuleAccept, Source: "lan", Dest: "vpn:192.0.2.1"},
+			want: map[string][]string{"forward": {"iif=eth1 daddr=192.0.2.1"}},
 		},
 		{
 			name: "fw source matches dest zone oif",
 			rule: config.Rule{Action: config.RuleAccept, Source: "fw", Dest: "lan,vpn,dmz", Proto: "tcp", DPort: config.PortSpec{"22"}},
-			want: map[string][]string{"output": {"oif=eth1", ""}},
+			want: map[string][]string{"output": {"oif=eth1"}},
 		},
 		{
 			name: "fw to all has no oif",