Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 06 Jun 2021 09:04:19 +0000
From:      bugzilla-noreply@freebsd.org
To:        pf@FreeBSD.org
Subject:   [Bug 256410] pf: Add pf_default_rules option
Message-ID:  <bug-256410-16861-bY72qNa3Zr@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-256410-16861@https.bugs.freebsd.org/bugzilla/>
References:  <bug-256410-16861@https.bugs.freebsd.org/bugzilla/>

next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256410

--- Comment #6 from Thomas Steen Rasmussen / Tykling <thomas@gibfest.dk> ---
Hello Kristof :)

Proposed commit message:=20
-----------------------------------------------------------------------
pf: Support loading small default pf ruleset in case of invalid pf.conf usi=
ng
pf_default_rules and pf_default_rules_enable

When no pf rules are loaded pf will pass/allow all traffic if the kernel is
compiled without PF_DEFAULT_TO_DROP, which is the case in GENERIC. This com=
mit
introduces a "pf default rules" concept to minimise the impact if a typo in
pf.conf makes loading the firewall rules impossible on boot.

The change checks the exit code of the $pf_program (pfctl) command when loa=
ding
pf.conf inside pf_start() in /etc/rc.d/pf. After this commit, if the exit c=
ode
is 1 and pf_default_rules_enable is set to YES, then the rules defined in
$pf_default_rules are loaded instead. $pf_default_rules defaults to a single
rule: "block drop log all".

This commit also introduces new warn() calls when /etc/rc.d/pf fails to load
the pf ruleset in pf_start(). If $pf_default_rules_enable is NO (which is t=
he
default) then the following messages are logged:

/etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable =
is
NO.
/etc/rc.d/pf: WARNING: No pf rules are loaded, this means all traffic is
permitted.

If pf_default_rules_enable is YES then the following messages are logged, a=
nd
the rules defined in $pf_default_rules are loaded:

/etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable =
is
set to YES.
/etc/rc.d/pf: WARNING: Loading pf_default_rules: block drop log all

pf_default_rules can include multiple rules, for example to permit traffic =
on a
management interface. Seperate multiple rules with \n:

$ sudo sysrc pf_default_rules
pf_default_rules: block drop log all\npass quick on em0
$

The $pf_default_rules and $pf_default_rules_enable variables are defined in
/etc/defaults/rc.conf with the following lines, preserving the existing
functionality (apart from the new log messages):

pf_default_rules_enable=3D"NO"   # fallback to $pf_default_rules if loading
ruleset fails
pf_default_rules=3D"block drop log all"  # block and drop everything if loa=
ding
pf ruleset fails

PR:                     256410
Reported by:            Thomas Steen Rasmussen
Reviewed by:            kp@
Sponsored by:           semaphor.dk
-----------------------------------------------------------------------

Feel free to edit as you see fit :) Thank you!

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-256410-16861-bY72qNa3Zr>