From a6bd1385ab5aff5c8bd83cfd4258f90f22341a49 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 11:27:33 +0000 Subject: [PATCH] fix(P18): nftables ruleset hardening (REQ-133, F21) ---ci--- project: orca phase: 18 milestone: v0.12 status: execute ---/ci--- nft input chain hardened: ct state invalid drop + ct state established,related accept (conntrack bounds + defense-in-depth). Tests pass. Build green. --- internal/emitter/nft.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/internal/emitter/nft.go b/internal/emitter/nft.go index 4eebe1b..872e876 100644 --- a/internal/emitter/nft.go +++ b/internal/emitter/nft.go @@ -107,6 +107,8 @@ func renderNftRuleset(cfg NftClusterConfig) string { b.WriteString("\t}\n\n") b.WriteString("\tchain input {\n") b.WriteString("\t\ttype filter hook input priority filter; policy accept;\n") + b.WriteString("\t\tct state invalid drop\n") + b.WriteString("\t\tct state established,related accept\n") b.WriteString("\t\ttcp dport 443 tcp-flags != syn,rst,ack,fin notrack drop\n") b.WriteString("\t}\n\n") b.WriteString("\tchain prerouting {\n")