Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 24 Aug 2015 03:51:19 +0000 (UTC)
From:      Julian Elischer <julian@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r287091 - stable/10/etc
Message-ID:  <201508240351.t7O3pJB2089858@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: julian
Date: Mon Aug 24 03:51:18 2015
New Revision: 287091
URL: https://svnweb.freebsd.org/changeset/base/287091

Log:
  MFH: r284691
  MFH: r284920
  
    Remove 16 rules and replace by 2 by using a table.
    I've been doing this ever since there were tables.
    I could make more efficient by using "in recv"  and "out xmit" instead of via
    but I'll leave that.

Modified:
  stable/10/etc/rc.firewall
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/etc/rc.firewall
==============================================================================
--- stable/10/etc/rc.firewall	Mon Aug 24 03:41:14 2015	(r287090)
+++ stable/10/etc/rc.firewall	Mon Aug 24 03:51:18 2015	(r287091)
@@ -266,6 +266,7 @@ case ${firewall_type} in
 	#  firewall_simple_oif_ipv6:	Outside IPv6 network interface.
 	#  firewall_simple_onet_ipv6:	Outside IPv6 network prefix.
 	############
+	BAD_ADDR_TBL=13
 
 	# set these to your outside interface network
 	oif="$firewall_simple_oif"
@@ -290,19 +291,23 @@ case ${firewall_type} in
 		fi
 	fi
 
+	# Define stuff we should never send out or receive in.
 	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
-	${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} flush
+	${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
 
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
+	# And stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
 	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
 	# on the outside interface
-	${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
-	${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
-	${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
-	${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+	${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+	${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+
+	${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
 
 	# Network Address Translation.  This rule is placed here deliberately
 	# so that it does not interfere with the surrounding address-checking
@@ -319,20 +324,7 @@ case ${firewall_type} in
 		;;
 	esac
 
-	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
-	${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
-	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
-	# on the outside interface
-	${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
-	${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
-	${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
-	${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+	${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
 	if [ -n "$inet6" ]; then
 		# Stop unique local unicast address on the outside interface
 		${fwcmd} add deny all from fc00::/7 to any via ${oif6}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201508240351.t7O3pJB2089858>