From 019bc1c5b7eb7e6ba94918a4cf18be5c0741511d Mon Sep 17 00:00:00 2001 From: Naredula Janardhana Reddy Date: Wed, 4 Jan 2012 12:32:03 +0530 Subject: [PATCH] Bug 12140: Blocking ICMP timestamp request to system vm's (only console and ssvm). --- .../systemvm/debian/config/etc/iptables/iptables-consoleproxy | 1 + patches/systemvm/debian/config/etc/iptables/iptables-secstorage | 1 + 2 files changed, 2 insertions(+) diff --git a/patches/systemvm/debian/config/etc/iptables/iptables-consoleproxy b/patches/systemvm/debian/config/etc/iptables/iptables-consoleproxy index dbd092cb269..5dd39c3006b 100644 --- a/patches/systemvm/debian/config/etc/iptables/iptables-consoleproxy +++ b/patches/systemvm/debian/config/etc/iptables/iptables-consoleproxy @@ -12,6 +12,7 @@ COMMIT -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT +-A INPUT -p icmp --icmp-type 13 -j DROP -A INPUT -p icmp -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 3922 -j ACCEPT -A INPUT -i eth1 -p tcp -m state --state NEW -m tcp --dport 3922 -j ACCEPT diff --git a/patches/systemvm/debian/config/etc/iptables/iptables-secstorage b/patches/systemvm/debian/config/etc/iptables/iptables-secstorage index 5326589d5ea..5709d804547 100755 --- a/patches/systemvm/debian/config/etc/iptables/iptables-secstorage +++ b/patches/systemvm/debian/config/etc/iptables/iptables-secstorage @@ -13,6 +13,7 @@ COMMIT -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT +-A INPUT -p icmp --icmp-type 13 -j DROP -A INPUT -p icmp -j ACCEPT -A INPUT -i eth0 -p tcp -m state --state NEW --dport 3922 -j ACCEPT -A INPUT -i eth1 -p tcp -m state --state NEW --dport 3922 -j ACCEPT