From nobody Tue Jul 7 06:38:45 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gvWlT6Tkkz6l0jf for ; Tue, 07 Jul 2026 06:38:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gvWlT5S5sz41mM for ; Tue, 07 Jul 2026 06:38:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783406325; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=whgOpJVcbO36ZbUZEGjog4DjTF2LfTN9mbrW2oPRo7s=; b=i04djPG4q4xi9nGLofcAlOYbLlSH8oP5n5I0Mi03uCROqDKBoxoKi3U4P2x8p6S9d7u/8y jW6ekRz1UjBa1UdtlG/DGD3Ifg0n/sIfbYBRD/072FbrKKMTn83fc9aL+OY0IKmhJRvgfH ZlcRPfiP7JvqQUIp2EY9gLJWUDsOt1e0F82UOGZrB1peloZdCKsZfdwcpiYCUfuLb5xh2J 9+Ru97+bDOt4uHQ0p/MssYTCBj8yYZRO5V/ZpN34bOsoQLExHl6K9AUo68AsSXPaaEXAfa 7H470TJ8QrUO65eW4AfL7InewKm2lmVTzDbZztIksm7qq/njGXzh0XvfLTkBKA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783406325; a=rsa-sha256; cv=none; b=iOly/grOv9wz3+4a4JOPx/myB9najr6atimQ0LogH+GOiN/XnGn/xSKRp2bxNE9JZFzOSV W8Imj+Gn7zfpLokDJrnJPzUNl5Sz8VCT0bBU+LQ7GnlkDLZxThFdIEnhEnB03S5m7sbm+K On56dh/2WNdHOslzKluDql1X5dgOfbhqPNBD4/sw4dGB5zLkckvIbzaBdlVQc6Fbe1KUnV bH9xqOfGWXHTxWepbAmv/jxZkRqIi8kAlWMkFrlzH41cwcEB9mjgOaOXhVckmkYqHoJ26Z TKpyy4U5SAMqB4J7QBcvyjbct+fLoUHO5M5jyUnxSLb8cy65+DPFCkpphEvZTQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783406325; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=whgOpJVcbO36ZbUZEGjog4DjTF2LfTN9mbrW2oPRo7s=; b=b8BcxF1MUAaKv34vumhNAF1N8+BkeRZHzsZeqwlyPm4l+LFagjyDZ3NpJLDJUz/i1B2kly 47MsBD4LWqzrXKGptOXXJm1NTemsWL1WdwLdxenk47ltPL5XQ0F0lnAf8LMAclvuGrF82R e/iagT1p7sYKh16THijEEFsrL7SqSkB6Lm3SioG1NcXom9COYIfr38nHF7ZmXMVGOoO+3b 6gqBxCV3S8H5PqZIb5xQ7WAZQZx/Wvzer1H8Ztea6azX2Ui9Cjis1qO3G4fjzGlkk0acON kPg80TQKCdTFEVvAT61l+AT8OVhEnJ/N3lJmJsiQrjRMzHHUvtqfsxyLXF+ypA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gvWlT30l6z7rF for ; Tue, 07 Jul 2026 06:38:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3664a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 07 Jul 2026 06:38:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav Subject: git: 3aec74070b0d - stable/15 - rc.firewall: Support on-disk lists List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3aec74070b0db7cb4d7f3277037531918074175d Auto-Submitted: auto-generated Date: Tue, 07 Jul 2026 06:38:45 +0000 Message-Id: <6a4c9ef5.3664a.1c6fa784@gitrepo.freebsd.org> The branch stable/15 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=3aec74070b0db7cb4d7f3277037531918074175d commit 3aec74070b0db7cb4d7f3277037531918074175d Author: Dag-Erling Smørgrav AuthorDate: 2026-06-26 14:38:53 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2026-07-07 06:38:10 +0000 rc.firewall: Support on-disk lists For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679 (cherry picked from commit a71abf38e2b46c02965f3224c62bb6ef1971996e) --- libexec/rc/rc.conf | 11 +++++++---- libexec/rc/rc.firewall | 43 ++++++++++++++++++++++++++++++++----------- 2 files changed, 39 insertions(+), 15 deletions(-) diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index fdf6a24db119..7fe5ffcd96cf 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -183,11 +183,14 @@ firewall_simple_onet="192.0.2.0/28" # Outside network address for "simple" # for "simple" firewall. firewall_myservices="" # List of ports/protocols on which this host # offers services for "workstation" firewall. -firewall_allowservices="" # List of IPs which have access to +firewall_allowservices="" # List of IPs or subnets which have access to # $firewall_myservices for "workstation" - # firewall. -firewall_trusted="" # List of IPs which have full access to this - # host for "workstation" firewall. + # firewall, or of files containing lists of + # IPs or subnets, one per line. +firewall_trusted="" # List of IPs or subnets which have full access + # to this host for "workstation" firewall, or + # of files containing lists of IPs or subnets, + # one per line. firewall_logdeny="NO" # Set to YES to log default denied incoming # packets for "workstation" firewall. firewall_nologports="135-139,445 1026,1027 1433,1434" # List of TCP/UDP ports diff --git a/libexec/rc/rc.firewall b/libexec/rc/rc.firewall index 65bf1cc54f85..f3e1ea116522 100644 --- a/libexec/rc/rc.firewall +++ b/libexec/rc/rc.firewall @@ -406,10 +406,14 @@ case ${firewall_type} in # firewall_myservices: List of ports/protocols on which this # host offers services. # firewall_allowservices: List of IPv4 and/or IPv6 addresses - # that have access to - # $firewall_myservices. + # or subnets that have access to + # $firewall_myservices, or files + # containing such address or subnets, + # one per line. # firewall_trusted: List of IPv4 and/or IPv6 addresses - # that have full access to this host. + # or subnets that have full access to + # this host, or files containing such + # addresses or subnets, one per line. # Be very careful when setting this. # This option can seriously degrade # the level of protection provided by @@ -467,25 +471,33 @@ case ${firewall_type} in # workstation won't be a problem. # for i in ${firewall_allowservices} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _; do for j in ${firewall_myservices} ; do case $j in [0-9A-Za-z]*/[Pp][Rr][Oo][Tt][Oo]) ${fwcmd} add pass ${j%/[Pp][Rr][Oo][Tt][Oo]} from $i to me - ;; + ;; [0-9A-Za-z]*/[Tt][Cc][Pp]) ${fwcmd} add pass tcp from $i to me ${j%/[Tt][Cc][Pp]} - ;; + ;; [0-9A-Za-z]*/[Uu][Dd][Pp]) ${fwcmd} add pass udp from $i to me ${j%/[Uu][Dd][Pp]} - ;; + ;; *[0-9A-Za-z]) - echo "Consider using ${j}/tcp in firewall_myservices." \ - > /dev/stderr + echo "Consider using ${j}/tcp in firewall_myservices." >&2 ${fwcmd} add pass tcp from $i to me $j - ;; + ;; *) - echo "Invalid port in firewall_myservices: $j" > /dev/stderr - ;; + echo "Invalid port in firewall_myservices: $j" >&2 + ;; esac done done @@ -494,6 +506,15 @@ case ${firewall_type} in # Playing with the content of firewall_trusted could seriously # degrade the level of protection provided by the firewall. for i in ${firewall_trusted} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _ ; do ${fwcmd} add pass ip from $i to me done