Date: Sun, 06 Jun 2021 09:04:19 +0000 From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 256410] pf: Add pf_default_rules option Message-ID: <bug-256410-16861-bY72qNa3Zr@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-256410-16861@https.bugs.freebsd.org/bugzilla/> References: <bug-256410-16861@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410 --- Comment #6 from Thomas Steen Rasmussen / Tykling <thomas@gibfest.dk> --- Hello Kristof :) Proposed commit message:=20 ----------------------------------------------------------------------- pf: Support loading small default pf ruleset in case of invalid pf.conf usi= ng pf_default_rules and pf_default_rules_enable When no pf rules are loaded pf will pass/allow all traffic if the kernel is compiled without PF_DEFAULT_TO_DROP, which is the case in GENERIC. This com= mit introduces a "pf default rules" concept to minimise the impact if a typo in pf.conf makes loading the firewall rules impossible on boot. The change checks the exit code of the $pf_program (pfctl) command when loa= ding pf.conf inside pf_start() in /etc/rc.d/pf. After this commit, if the exit c= ode is 1 and pf_default_rules_enable is set to YES, then the rules defined in $pf_default_rules are loaded instead. $pf_default_rules defaults to a single rule: "block drop log all". This commit also introduces new warn() calls when /etc/rc.d/pf fails to load the pf ruleset in pf_start(). If $pf_default_rules_enable is NO (which is t= he default) then the following messages are logged: /etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable = is NO. /etc/rc.d/pf: WARNING: No pf rules are loaded, this means all traffic is permitted. If pf_default_rules_enable is YES then the following messages are logged, a= nd the rules defined in $pf_default_rules are loaded: /etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable = is set to YES. /etc/rc.d/pf: WARNING: Loading pf_default_rules: block drop log all pf_default_rules can include multiple rules, for example to permit traffic = on a management interface. Seperate multiple rules with \n: $ sudo sysrc pf_default_rules pf_default_rules: block drop log all\npass quick on em0 $ The $pf_default_rules and $pf_default_rules_enable variables are defined in /etc/defaults/rc.conf with the following lines, preserving the existing functionality (apart from the new log messages): pf_default_rules_enable=3D"NO" # fallback to $pf_default_rules if loading ruleset fails pf_default_rules=3D"block drop log all" # block and drop everything if loa= ding pf ruleset fails PR: 256410 Reported by: Thomas Steen Rasmussen Reviewed by: kp@ Sponsored by: semaphor.dk ----------------------------------------------------------------------- Feel free to edit as you see fit :) Thank you! --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-256410-16861-bY72qNa3Zr>