From nobody Tue Jul 7 06:38:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gvWld6gqyz6l19d for ; Tue, 07 Jul 2026 06:38:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gvWld2sPqz42Db for ; Tue, 07 Jul 2026 06:38:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783406333; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LKuTVMZsfT8+j8sh2NMLPs0eAKKbtPV/HC+fue8hNFE=; b=jhKwcWqklPl8zRAELh1sMysP6JhQhNrdizZ60TpJv4Y8Q+pmEqpyLeEvncIEMGASkRB8Jo sIwsbc+Ao0C063bk34FLluBiMGbTBHam8nCWgTChD5KADbwnJenXI/GxFN1S3GEmg3bZ2+ w1eUMgrHawATjK75qdGY9k1/xcYuRqRthTbzyPehdRUbkAJkvyOOCBQVWY8rG5AMt1bHul IzR7UJp4wMRpMDzuvAcVOaltKrzNibPfsAbxX8xtY/A6D1faEO0i2Xm6pvy1OgoOnlbq/N qEOIuaOpGp+xtkRA2ftfqgp224gkc/LXSRaxuOeMZ6q1igtXCQkkebzD4205nA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783406333; a=rsa-sha256; cv=none; b=hq71nc7g0VdI+swlkdCg0m5r98xj2AIzGfYufFH1uJC8xrwlfl/5aHH732BYkioMJhT4XQ wKe7kddJ7GEn36Z/Ov27kMXQc5T8BjG0w/1vO3MJpd83HyLQWKGAOI3wqVDFh32ffHD/WU 9zFHnyDwcaGO5/lxYWvf5KUqCeROdVG1XjtMxd67xIcMlATJQb9VVFNKnGd1+DaFy2sqIp EmS4iPaIRQP5iPLUI5tFSIKgE7bOi+GUTmhWWxpLRWvOVXkB1cryUpGdiJf/nhosKlFPfY /TybVWKtP4JzN+AVizSuzgleR/rLJcPifBjH+160oINT9kHLMhDmnNsXi60QLA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783406333; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LKuTVMZsfT8+j8sh2NMLPs0eAKKbtPV/HC+fue8hNFE=; b=iTZ/j0dgZEobKu1aNhT9i6ziC3TIlPwisAG0CloH9HZ0O09pIljxlgjQ4pOQE+erwLPcaP KKt65N8jp6I9SZiVckI77qKr4AAlX6bd+7Rt1pvE1WDnaLIlQzdX8jtIrjjYyswFWLLFX2 jNPfpXVHrsp9q75FDBkUEHpSuPJfwm0zL1GMc0c6+N6ixdYDPkAWtJnh4qaiBufidDIZxa f/V8cJ0Tvqe22srJ09hUKYeW5LkQ4uvK4xQTX3/zCINhurygBrXMftpnYqSWHpF6F3qrPO obh9GCWwZjpLK1RPIi40LMgSuFKMYmU5X829+NYNews/ok3IxWcDZ5n0imVUtg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gvWld1tvxz85d for ; Tue, 07 Jul 2026 06:38:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37701 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 07 Jul 2026 06:38:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav Subject: git: 10075baae2c1 - stable/14 - rc.firewall: Support on-disk lists List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 10075baae2c1151945bc13a478560e4d4a1aacf1 Auto-Submitted: auto-generated Date: Tue, 07 Jul 2026 06:38:53 +0000 Message-Id: <6a4c9efd.37701.21a18b3@gitrepo.freebsd.org> The branch stable/14 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=10075baae2c1151945bc13a478560e4d4a1aacf1 commit 10075baae2c1151945bc13a478560e4d4a1aacf1 Author: Dag-Erling Smørgrav AuthorDate: 2026-06-26 14:38:53 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2026-07-07 06:38:16 +0000 rc.firewall: Support on-disk lists For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679 (cherry picked from commit a71abf38e2b46c02965f3224c62bb6ef1971996e) --- libexec/rc/rc.conf | 11 +++++++---- libexec/rc/rc.firewall | 43 ++++++++++++++++++++++++++++++++----------- 2 files changed, 39 insertions(+), 15 deletions(-) diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 2fbd0c4280de..7797df17be81 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -189,11 +189,14 @@ firewall_simple_onet="192.0.2.0/28" # Outside network address for "simple" # for "simple" firewall. firewall_myservices="" # List of ports/protocols on which this host # offers services for "workstation" firewall. -firewall_allowservices="" # List of IPs which have access to +firewall_allowservices="" # List of IPs or subnets which have access to # $firewall_myservices for "workstation" - # firewall. -firewall_trusted="" # List of IPs which have full access to this - # host for "workstation" firewall. + # firewall, or of files containing lists of + # IPs or subnets, one per line. +firewall_trusted="" # List of IPs or subnets which have full access + # to this host for "workstation" firewall, or + # of files containing lists of IPs or subnets, + # one per line. firewall_logdeny="NO" # Set to YES to log default denied incoming # packets for "workstation" firewall. firewall_nologports="135-139,445 1026,1027 1433,1434" # List of TCP/UDP ports diff --git a/libexec/rc/rc.firewall b/libexec/rc/rc.firewall index 65bf1cc54f85..f3e1ea116522 100644 --- a/libexec/rc/rc.firewall +++ b/libexec/rc/rc.firewall @@ -406,10 +406,14 @@ case ${firewall_type} in # firewall_myservices: List of ports/protocols on which this # host offers services. # firewall_allowservices: List of IPv4 and/or IPv6 addresses - # that have access to - # $firewall_myservices. + # or subnets that have access to + # $firewall_myservices, or files + # containing such address or subnets, + # one per line. # firewall_trusted: List of IPv4 and/or IPv6 addresses - # that have full access to this host. + # or subnets that have full access to + # this host, or files containing such + # addresses or subnets, one per line. # Be very careful when setting this. # This option can seriously degrade # the level of protection provided by @@ -467,25 +471,33 @@ case ${firewall_type} in # workstation won't be a problem. # for i in ${firewall_allowservices} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _; do for j in ${firewall_myservices} ; do case $j in [0-9A-Za-z]*/[Pp][Rr][Oo][Tt][Oo]) ${fwcmd} add pass ${j%/[Pp][Rr][Oo][Tt][Oo]} from $i to me - ;; + ;; [0-9A-Za-z]*/[Tt][Cc][Pp]) ${fwcmd} add pass tcp from $i to me ${j%/[Tt][Cc][Pp]} - ;; + ;; [0-9A-Za-z]*/[Uu][Dd][Pp]) ${fwcmd} add pass udp from $i to me ${j%/[Uu][Dd][Pp]} - ;; + ;; *[0-9A-Za-z]) - echo "Consider using ${j}/tcp in firewall_myservices." \ - > /dev/stderr + echo "Consider using ${j}/tcp in firewall_myservices." >&2 ${fwcmd} add pass tcp from $i to me $j - ;; + ;; *) - echo "Invalid port in firewall_myservices: $j" > /dev/stderr - ;; + echo "Invalid port in firewall_myservices: $j" >&2 + ;; esac done done @@ -494,6 +506,15 @@ case ${firewall_type} in # Playing with the content of firewall_trusted could seriously # degrade the level of protection provided by the firewall. for i in ${firewall_trusted} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _ ; do ${fwcmd} add pass ip from $i to me done