From 96a1ba83517202219e29849d85efe43acad6f39e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 9 Oct 2026 22:45:53 +1100 Subject: [PATCH 1/2] Accept intra-zone traffic between different interfaces --- internal/nftables/compiler.go | 42 +++++++++++++++++- internal/nftables/compiler_test.go | 68 ++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+), 2 deletions(-) diff --git a/internal/nftables/compiler.go b/internal/nftables/compiler.go index 47244d4..d1420f2 100644 --- a/internal/nftables/compiler.go +++ b/internal/nftables/compiler.go @@ -857,16 +857,21 @@ func (c *Compiler) compileDNATRule(state *FirewallState, tag, srcZone, srcAddr, func (c *Compiler) compilePolicies(state *FirewallState) error { fwZone := c.cfg.FirewallZone() + overridden := map[string]bool{} for i, pol := range c.cfg.Policy { tag := fmt.Sprintf("policy:%d", i) + explicitIntra := pol.Source == pol.Dest && !isGlobalZone(pol.Source) srcZones := c.expandZoneRef(pol.Source) dstZones := c.expandZoneRef(pol.Dest) for _, sz := range srcZones { for _, dz := range dstZones { - if sz == dz && !strings.HasSuffix(pol.Source, "+") { - continue + if sz == dz { + if !explicitIntra && !strings.HasSuffix(pol.Source, "+") { + continue + } + overridden[sz] = true } chain := c.selectChain(sz, dz, fwZone) @@ -875,6 +880,9 @@ func (c *Compiler) compilePolicies(state *FirewallState) error { for _, si := range srcIfaces { for _, di := range dstIfaces { + if sz == dz && si != "" && si == di { + continue + } var exprs []expr.Any if si != "" { @@ -909,9 +917,39 @@ func (c *Compiler) compilePolicies(state *FirewallState) error { } } + c.compileImplicitIntraZone(state, overridden) return nil } +// compileImplicitIntraZone accepts traffic between different interfaces of one zone, shorewall's implicit intra-zone ACCEPT policy. +func (c *Compiler) compileImplicitIntraZone(state *FirewallState, overridden map[string]bool) { + fwZone := c.cfg.FirewallZone() + zones := make([]string, 0, len(c.cfg.Zones)) + for z := range c.cfg.Zones { + zones = append(zones, z) + } + sort.Strings(zones) + for _, z := range zones { + if z == fwZone || overridden[z] { + continue + } + ifaces := c.cfg.ZoneInterfaces(z) + for _, si := range ifaces { + for _, di := range ifaces { + if si == di { + continue + } + state.Rules["forward"] = append(state.Rules["forward"], ManagedRule{ + Chain: "forward", + Exprs: append(append(matchIfaceName(true, si), matchIfaceName(false, di)...), + &expr.Verdict{Kind: expr.VerdictAccept}), + Tag: "intra:" + z, + }) + } + } + } +} + func (c *Compiler) compileSNAT(state *FirewallState) error { for i, snat := range c.cfg.SNAT { tag := fmt.Sprintf("snat:%d", i) diff --git a/internal/nftables/compiler_test.go b/internal/nftables/compiler_test.go index 5d70611..b1ad0be 100644 --- a/internal/nftables/compiler_test.go +++ b/internal/nftables/compiler_test.go @@ -3320,3 +3320,71 @@ func TestCompile_LogLimitSplitsAroundExtrasAndNAT(t *testing.T) { } } } + +func TestCompile_IntraZoneMultiInterface(t *testing.T) { + tests := []struct { + name string + policy []config.Policy + tag string + want []string + }{ + { + name: "implicit accept between distinct interfaces", + policy: []config.Policy{{Source: "all", Dest: "all", Action: config.PolicyDrop}}, + tag: "intra:lxd", + want: []string{"iif=lxdbr0 oif=docker0", "iif=lxdbr0 oif=br-", "iif=docker0 oif=lxdbr0", "iif=docker0 oif=br-", "iif=br- oif=lxdbr0", "iif=br- oif=docker0"}, + }, + { + name: "explicit zone policy overrides", + policy: []config.Policy{{Source: "lxd", Dest: "lxd", Action: config.PolicyDrop, Log: "info"}, {Source: "all", Dest: "all", Action: config.PolicyDrop}}, + tag: "policy:0", + want: []string{"iif=lxdbr0 oif=docker0", "iif=lxdbr0 oif=br-", "iif=docker0 oif=lxdbr0", "iif=docker0 oif=br-", "iif=br- oif=lxdbr0", "iif=br- oif=docker0"}, + }, + } + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + cfg := &config.Config{ + Settings: config.Settings{TableName: "test", AddressFamily: config.FamilyINET}, + Zones: map[string]config.Zone{ + "fw": {Type: config.ZoneFirewall}, + "net": {Type: config.ZoneIP}, + "lxd": {Type: config.ZoneIP}, + }, + Interfaces: []config.Interface{ + {Zone: "net", Interface: "eth0"}, + {Zone: "lxd", Interface: "lxdbr0"}, + {Zone: "lxd", Interface: "docker0"}, + {Zone: "lxd", Interface: "br-+"}, + }, + Policy: tc.policy, + PortGroups: map[string]config.PortGroup{}, + } + state, err := NewCompiler(cfg).Compile() + if err != nil { + t.Fatalf("Compile() error: %v", err) + } + var got, all []string + for _, r := range state.Rules["forward"] { + if r.Tag == tc.tag { + got = append(got, describeRule(r)) + } + if strings.HasPrefix(r.Tag, "intra:") { + all = append(all, r.Tag) + } + } + if !reflect.DeepEqual(got, tc.want) { + t.Errorf("%s rules = %q, want %q", tc.tag, got, tc.want) + } + if tc.tag != "intra:lxd" && len(all) != 0 { + t.Errorf("explicit policy must replace implicit accept, got %q", all) + } + last := taggedRules(state, "forward", tc.tag) + if len(last) == 0 { + return + } + if v, ok := last[0].Exprs[len(last[0].Exprs)-1].(*expr.Verdict); !ok || (tc.tag == "intra:lxd") != (v.Kind == expr.VerdictAccept) { + t.Errorf("%s verdict = %#v", tc.tag, last[0].Exprs[len(last[0].Exprs)-1]) + } + }) + } +} -- 2.47.3 From ecc349cb6fc8bfc17146c16138e6c15de165c8ca Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 9 Oct 2026 22:48:33 +1100 Subject: [PATCH 2/2] Skip fw->fw policies and treat dest-side + as intra-zone override --- internal/nftables/compiler.go | 2 +- internal/nftables/compiler_test.go | 36 ++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/internal/nftables/compiler.go b/internal/nftables/compiler.go index d1420f2..9a28ee6 100644 --- a/internal/nftables/compiler.go +++ b/internal/nftables/compiler.go @@ -868,7 +868,7 @@ func (c *Compiler) compilePolicies(state *FirewallState) error { for _, sz := range srcZones { for _, dz := range dstZones { if sz == dz { - if !explicitIntra && !strings.HasSuffix(pol.Source, "+") { + if sz == fwZone || (!explicitIntra && !strings.HasSuffix(pol.Source, "+") && !strings.HasSuffix(pol.Dest, "+")) { continue } overridden[sz] = true diff --git a/internal/nftables/compiler_test.go b/internal/nftables/compiler_test.go index b1ad0be..4371c1f 100644 --- a/internal/nftables/compiler_test.go +++ b/internal/nftables/compiler_test.go @@ -3388,3 +3388,39 @@ func TestCompile_IntraZoneMultiInterface(t *testing.T) { }) } } + +func TestCompile_FirewallSelfPolicySkipped(t *testing.T) { + for _, action := range []config.PolicyAction{config.PolicyAccept, config.PolicyDrop} { + t.Run(string(action), func(t *testing.T) { + state := mustCompile(t, listCfg(func(c *config.Config) { + c.Policy = []config.Policy{ + {Source: "fw", Dest: "fw", Action: action}, + {Source: "net", Dest: "fw", Action: config.PolicyDrop, Log: "info"}, + } + })) + for _, chain := range []string{"input", "output", "forward"} { + if got := taggedRules(state, chain, "policy:0"); len(got) != 0 { + t.Errorf("fw->fw emitted %d rules in %s", len(got), chain) + } + } + got := taggedRules(state, "input", "policy:1") + if len(got) != 1 || describeRule(got[0]) != "iif=eth0" { + t.Errorf("net->fw input rules = %d, want one scoped to eth0", len(got)) + } + }) + } +} + +func TestCompile_DestPlusOverridesIntraZone(t *testing.T) { + state := mustCompile(t, listCfg(func(c *config.Config) { + c.Zones["lxd"] = config.Zone{Type: config.ZoneIP} + c.Interfaces = append(c.Interfaces, config.Interface{Zone: "lxd", Interface: "lxdbr0"}, config.Interface{Zone: "lxd", Interface: "docker0"}) + c.Policy = []config.Policy{{Source: "lxd", Dest: "all+", Action: config.PolicyDrop}} + })) + if got := taggedRules(state, "forward", "intra:lxd"); len(got) != 0 { + t.Errorf("lxd all+ must override implicit intra-zone accept, got %d rules", len(got)) + } + if got := taggedRules(state, "forward", "policy:0"); len(got) == 0 { + t.Error("lxd all+ emitted no forward rules") + } +} -- 2.47.3