systemvm: allow link-local ssh in the VR IPv6 firewall

The nftables ip6_firewall and ip6_acl tables created on VRs with
IPv6 networking have an input hook chain with policy drop, which
applies to all interfaces including the control NIC. Accept TCP 3922
between link-local addresses so sshd remains reachable on the IPv6
link-local address of the control interface. Restricting both saddr
and daddr to fe80::/10 ensures no global address can reach sshd.

Author: wido

systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py

@@ -232,6 +232,10 @@ def add_ip6_chain(self, address_family, table, chain, hook, action):
         if hook == "input" or hook == "output":
             CsHelper.execute("nft add rule %s %s %s icmpv6 type { echo-request, echo-reply, \
                 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept" % (address_family, table, chain))
+        if hook == "input":
+            # sshd listens on the IPv6 link-local address of the control interface,
+            # only allow this over link-local so no global address can reach it
+            CsHelper.execute("nft add rule %s %s %s ip6 saddr fe80::/10 ip6 daddr fe80::/10 tcp dport 3922 accept" % (address_family, table, chain))
         if hook == "input" or hook == "forward":
             CsHelper.execute("nft add rule %s %s %s ct state established,related accept" % (address_family, table, chain))