From b8d7ccfb5cc4309cda49b59a4073b6cf214f8b79 Mon Sep 17 00:00:00 2001 From: Roy Marples Date: Tue, 13 Mar 2007 14:36:29 +0000 Subject: [PATCH] Scrap the supplied ipfw script and replace with my own ipfw stateful firewall script. Package-Manager: portage-2.1.2.2 --- sys-freebsd/freebsd-sbin/ChangeLog | 7 +- sys-freebsd/freebsd-sbin/Manifest | 28 ++-- sys-freebsd/freebsd-sbin/files/ipfw.confd | 7 + sys-freebsd/freebsd-sbin/files/ipfw.initd | 134 +++++++++++------- .../freebsd-sbin/freebsd-sbin-6.2.ebuild | 3 +- 5 files changed, 112 insertions(+), 67 deletions(-) create mode 100644 sys-freebsd/freebsd-sbin/files/ipfw.confd diff --git a/sys-freebsd/freebsd-sbin/ChangeLog b/sys-freebsd/freebsd-sbin/ChangeLog index 7194765730b1..f25de4e9bd11 100644 --- a/sys-freebsd/freebsd-sbin/ChangeLog +++ b/sys-freebsd/freebsd-sbin/ChangeLog @@ -1,6 +1,11 @@ # ChangeLog for sys-freebsd/freebsd-sbin # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/ChangeLog,v 1.33 2007/02/23 13:56:05 uberlord Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/ChangeLog,v 1.34 2007/03/13 14:36:29 uberlord Exp $ + + 13 Mar 2007; Roy Marples +files/ipfw.confd, + files/ipfw.initd, freebsd-sbin-6.2.ebuild: + Scrap the supplied ipfw script and replace with my own ipfw stateful + firewall script. 23 Feb 2007; Roy Marples files/devd.initd, files/ipfw.initd, files/sysctl.initd: diff --git a/sys-freebsd/freebsd-sbin/Manifest b/sys-freebsd/freebsd-sbin/Manifest index b424f74b93e6..3428143aafcd 100644 --- a/sys-freebsd/freebsd-sbin/Manifest +++ b/sys-freebsd/freebsd-sbin/Manifest @@ -26,10 +26,14 @@ AUX freebsd-sbin-zlib.patch 793 RMD160 ba321e563ba92e73c4183740e425d50471fbffcf MD5 ae8e21abde36bcbc19d3464d1e368033 files/freebsd-sbin-zlib.patch 793 RMD160 ba321e563ba92e73c4183740e425d50471fbffcf files/freebsd-sbin-zlib.patch 793 SHA256 a02a2f8dda23952f6d90100fd1dddc3a3a5048653a74fb1f4b52ceb18bedb448 files/freebsd-sbin-zlib.patch 793 -AUX ipfw.initd 2027 RMD160 15773f3a44ec9aae2ecd077e711993d0aa003f4c SHA1 f420e5f1263f7c0cebd9e38d844be415c78dbacc SHA256 67500ebd22d39ae7ba575a7093ba81eef0d70081ca169e2a731f180858f0cd46 -MD5 4e78b4aa4962059870010c2526695db5 files/ipfw.initd 2027 -RMD160 15773f3a44ec9aae2ecd077e711993d0aa003f4c files/ipfw.initd 2027 -SHA256 67500ebd22d39ae7ba575a7093ba81eef0d70081ca169e2a731f180858f0cd46 files/ipfw.initd 2027 +AUX ipfw.confd 292 RMD160 78901ec3b3dbd67da089c2a9cd40d6b6457ffa06 SHA1 a67c0d7edcf116460413b6fc8dcedffa209ca79d SHA256 8e09c8c290b9323e9e7125329886d1f8514e00165500080723f788eec5dae733 +MD5 18215c72775a2311d20176188be16525 files/ipfw.confd 292 +RMD160 78901ec3b3dbd67da089c2a9cd40d6b6457ffa06 files/ipfw.confd 292 +SHA256 8e09c8c290b9323e9e7125329886d1f8514e00165500080723f788eec5dae733 files/ipfw.confd 292 +AUX ipfw.initd 2424 RMD160 3b95ab5045493cf723d1eba7fbca43d6c65fb661 SHA1 0cf7941ca6d29579b5768d6f0ecdb223b3c84a9b SHA256 3b0d52a221210fda64faeccd2e48abfe4f50f83018d9c273f96ff089e527482e +MD5 b78c1d8cae8707de42a7729416a3f3b5 files/ipfw.initd 2424 +RMD160 3b95ab5045493cf723d1eba7fbca43d6c65fb661 files/ipfw.initd 2424 +SHA256 3b0d52a221210fda64faeccd2e48abfe4f50f83018d9c273f96ff089e527482e files/ipfw.initd 2424 AUX sysctl.initd 664 RMD160 e07440c9cc9fb4aa36dd724ffd7e01bdcdb7658f SHA1 9928928c154eaba070e75c5c99cee539a0c9875a SHA256 3f58694d02a1cd57e02e28d51b3e598e9edb022ba52c64be352bc392604de717 MD5 edc2fd562e52937c9b100df106b39d1a files/sysctl.initd 664 RMD160 e07440c9cc9fb4aa36dd724ffd7e01bdcdb7658f files/sysctl.initd 664 @@ -41,14 +45,14 @@ DIST freebsd-libexec-6.2.tar.bz2 277231 RMD160 423490cb7c888bfce7edcf473d77868c6 DIST freebsd-sbin-6.2.tar.bz2 1162548 RMD160 f7d5f4ea5e4b5e03910a44a127b5670f8d6ebf2c SHA1 be082439c7ed657a1f188af93837f7c34677eddf SHA256 aef424c07686bb72fbd06e4fd66a01b00bd36b70fec02ebdc228061cd4b435dd DIST freebsd-sys-6.2.tar.bz2 18344936 RMD160 784230e22ccaf09933ef3f053ff29cc3e579786a SHA1 161b7a4d165665deb1c4434c356b5f610a72a83a SHA256 a754371d88601aaab7152bb3d127bd3777db912e13a26a866e13ba34934c5e5b DIST freebsd-usbin-6.2.tar.bz2 2695872 RMD160 ea6104fcfbf6c0be511a80d0475e5a8f716292be SHA1 4772ed5fdc591273887fc7a2e97bddf7a1669b5d SHA256 6195301d39e7bc7fa00f6dec71479b1800ea5c3dc9d3ea375dafe4e71e6485f0 -EBUILD freebsd-sbin-6.2.ebuild 2714 RMD160 e83ac29b0c2e78cea45813af116cdaef1f5fb68b SHA1 82e2c0bb796ac9b8aa2b49edecaffef8cce1add1 SHA256 3ab64a94253ab482a43ecc3ba83ef87f5d5866fb0ef9dd920eb51bbc114cdf64 -MD5 ebed02e9fb1f2832976dc2c4ce85b98b freebsd-sbin-6.2.ebuild 2714 -RMD160 e83ac29b0c2e78cea45813af116cdaef1f5fb68b freebsd-sbin-6.2.ebuild 2714 -SHA256 3ab64a94253ab482a43ecc3ba83ef87f5d5866fb0ef9dd920eb51bbc114cdf64 freebsd-sbin-6.2.ebuild 2714 -MISC ChangeLog 8214 RMD160 faa8afa4d1a7a94d6e0a76f5ab3e7dafd6cdfd38 SHA1 0d819c65071cbcf2e1218a23d9f1ebc3758f1367 SHA256 fe153a3c5186332ed7d14eedb56dff0764fc99b1440004c170b2d524aee371c2 -MD5 707eef30bd1bfbe3c9deb47a812431e2 ChangeLog 8214 -RMD160 faa8afa4d1a7a94d6e0a76f5ab3e7dafd6cdfd38 ChangeLog 8214 -SHA256 fe153a3c5186332ed7d14eedb56dff0764fc99b1440004c170b2d524aee371c2 ChangeLog 8214 +EBUILD freebsd-sbin-6.2.ebuild 2756 RMD160 248395564ee560c18166c075e95b25bd48308159 SHA1 a3e099442d7e7757c70e3556875a93b5aebe6c2f SHA256 bed2cca5e89e0210e5d41f1f731d17fe6ef234cc32e9557d04c108bcb9c2d560 +MD5 896bd762d6714ae266a8af3dd16fc929 freebsd-sbin-6.2.ebuild 2756 +RMD160 248395564ee560c18166c075e95b25bd48308159 freebsd-sbin-6.2.ebuild 2756 +SHA256 bed2cca5e89e0210e5d41f1f731d17fe6ef234cc32e9557d04c108bcb9c2d560 freebsd-sbin-6.2.ebuild 2756 +MISC ChangeLog 8418 RMD160 bc665efac8b9ab42295f5f7b1859e76d1cd872eb SHA1 9187e63afde81aafa6fd1d3a832d2a72f06b0c45 SHA256 2d643df2c1c67bd037b2dde76bb0d7e9241e737f108ea0dba0e16e41c8195e86 +MD5 59cd7b343169944761a655e13922af01 ChangeLog 8418 +RMD160 bc665efac8b9ab42295f5f7b1859e76d1cd872eb ChangeLog 8418 +SHA256 2d643df2c1c67bd037b2dde76bb0d7e9241e737f108ea0dba0e16e41c8195e86 ChangeLog 8418 MISC metadata.xml 156 RMD160 60b5820a08275f307e5bd936d78f5afd1f141086 SHA1 d9d9d4f2b5afc58339ea3e562fca490156935f1f SHA256 30ab515d6ac492d3d6c36ac3c675511742c2149e56a6b3228c8d22ab8edb3ff7 MD5 2bd48a5ae413433cbb36110b219ce97c metadata.xml 156 RMD160 60b5820a08275f307e5bd936d78f5afd1f141086 metadata.xml 156 diff --git a/sys-freebsd/freebsd-sbin/files/ipfw.confd b/sys-freebsd/freebsd-sbin/files/ipfw.confd new file mode 100644 index 000000000000..78864eef549e --- /dev/null +++ b/sys-freebsd/freebsd-sbin/files/ipfw.confd @@ -0,0 +1,7 @@ +# ipfw provides a stateful firewall. +# This means we allow everything out, and if we have a connection we allow it +# back in. This is very flexable and quite secure. + +# For ease of use, we allow auth and ssh ports through as well. +# To override the list of allowed ports +#PORTS_IN="auth ssh" diff --git a/sys-freebsd/freebsd-sbin/files/ipfw.initd b/sys-freebsd/freebsd-sbin/files/ipfw.initd index 71118e7bea22..b0bd26f82fc2 100644 --- a/sys-freebsd/freebsd-sbin/files/ipfw.initd +++ b/sys-freebsd/freebsd-sbin/files/ipfw.initd @@ -1,73 +1,101 @@ #!/sbin/runscript -# Copyright 1999-2005 Gentoo Foundation +# Copyright 2007 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/files/ipfw.initd,v 1.2 2007/02/23 13:56:05 uberlord Exp $ + +# This is a nice client firewall script which should suit most desktop users. +# We allow auth and ssh in by default. + +PORTS_IN=${PORTS_IN:-auth ssh} + +opts="panic showstatus" depend() { - before net + before net + provide firewall } -start() { - ebegin "Starting firewall" - - retval=0 - - if ! sysctl net.inet.ip.fw.enable &>/dev/null; then - if ! kldload ipfwl then +ipfw() { + /sbin/ipfw -f -q "$@" +} + +init() { + # Load the kernel module + if ! sysctl net.inet.ip.fw.enable=1 >/dev/null 2>/dev/null ; then + if ! kldload ipfw ; then eend 1 "Unable to load firewall module" return 1 fi fi - if [ -z "${firewall_script}" ] || [ ! -f "${firewall_script}" ]; then - firewall_script=/etc/rc.firewall - fi + ipfw flush - if [ -r "${firewall_script}" ]; then - source "${firewall_script}" - einfo "Loaded firewall rules; starting daemons" - - if [ "${natd_enable}" = "yes" ]; then - # Find out whether $natd_interface is using dhcp - ifconfig_natd_iface=$( - eval source /etc/conf.d/net\; - echo \$\{ifconfig_${natd_interface}\}) - if [ "${ifconfig_natd_iface}" = "dhcp" ]; then - natd_flags="${natd_flags} -dynamic" - fi - - if [ -n "${natd_interface}" ]; then - # Yes, this is ugly. - if grep -q -E '^[0-9]+(\.[0-9]+){0,3}$' \ - <<<${natd_interface}; then - natd_flags="${natd_flags} -a ${natd_interface}" - else - natd_flags="${natd_flags} -n ${natd_interface}" - fi - fi - start-stop-daemon --start --exec \ - ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg} || retval=1 - fi - elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then - ewarn "Kernel has firewall functionality, but firewall rules aren't enabled!" - ewarn "All ip services are disabled. + ipfw add allow all from any to any via lo0 + ipfw add allow all from any to 127.0.0.0/8 + ipfw add deny ip from 127.0.0.0/8 to any + + ipfw add allow ipv6-icmp from :: to ff02::/16 + ipfw add allow ipv6-icmp from fe80::/10 to fe80::/10 + ipfw add allow ipv6-icmp from fe80::/10 to ff02::/16 +} + +start() { + local x= + ebegin "Starting firewall rules" + if ! init ; then + eend 1 "Failed to flush firewall ruleset" + return 1 fi - # Logging - if [ "${firewall_logging}" = "yes" ]; then - einfo "Enabling firewall logging" - sysctl net.inet.ip.fw.verbose=1 >/dev/null + # Use a statefull firewall + ipfw add check-state + + # Open our configured ports + if [ -n "${PORTS_IN}" ] ; then + local pin= + for x in ${PORTS_IN} ; do + [ -n "${pin}" ] && pin="${pin}," + pin="${pin}${x}" + done + ipfw add allow tcp from any to me ${pin} setup keep-state + ipfw add allow tcp from any to me6 ${pin} setup keep-state + ipfw add allow udp from any to me ${pin} keep-state + ipfw add allow udp from any to me6 ${pin} keep-state fi - # And enable the firewall. - sysctl -w net.inet.ip.fw.enable=1 - - eend $retval "Failed to properly start firewall" + # Nice flexable rules that disallow incoming except for stuff we + # have asked for, and allow all outgoing. + ipfw add allow tcp from me to any setup keep-state + ipfw add allow tcp from me6 to any setup keep-state + ipfw add deny tcp from any to any + ipfw add allow udp from me to any keep-state + ipfw add allow udp from me6 to any keep-state + ipfw add deny udp from any to any + + # Be a good firewall and allow some ICMP traffic. + # Remove 8 if you really want to disallow ping. + ipfw add allow icmp from any to any icmptypes 0,3,8,11,12 + ipfw add allow ip6 from any to any proto ipv6-icmp + + eend 0 } stop() { - ebegin "Stopping the firewall" - sysctl -w net.inet.ip.fw.enable=0 - start-stop-daemon --stop --name "$(basename ${natd_program:-/sbin/natd})" - eend $? "Failed to properly stop the firewall" + ebegin "Stopping firewall rules" + # We don't unload the kernel module as that action + # can cause memory leaks as of FreeBSD 6.x + sysctl net.inet.ip.fw.enable=0 >/dev/null + eend $? +} + +panic() { + ebegin "Stopping firewall rules - hard" + if ! init ; then + eend 1 "Failed to flush firewall ruleset" + return 1 + fi + eend 0 +} + +showstatus() { + ipfw show } diff --git a/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild b/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild index f04d59a96e2c..a65ebe627453 100644 --- a/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild +++ b/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2007 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild,v 1.1 2007/01/15 21:38:54 drizzt Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild,v 1.2 2007/03/13 14:36:29 uberlord Exp $ inherit flag-o-matic bsdmk freebsd @@ -64,6 +64,7 @@ src_install() { newinitd "${FILESDIR}/devd.initd" devd newinitd "${FILESDIR}/ipfw.initd" ipfw + newconfd "${FILESDIR}/ipfw.confd" ipfw newinitd "${FILESDIR}/sysctl.initd" sysctl # Gentoo devd.conf -- 2.26.2