From nobody Fri Jun 26 14:40:15 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gmyy81KSxz6jbCm for ; Fri, 26 Jun 2026 14:40:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gmyy7583qz3Wnr for ; Fri, 26 Jun 2026 14:40:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782484815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ven7yJAFEm/g/JHEhk0zwcypKk/5wRAaM/bO+Nh27Tk=; b=dpuIqaQaABbw2ZNn5FgsTCbaQK3+hFMQNI9D85W7deKPO6EnU2sHqE+Bg+xku52czCjlSt cSe+kRlARXfjJR+HUabgR8GWQjX1uY9iTjhzlFTvlHhbwuQt5YWklmp7nHSpPeBkMdH84G b4JWbYoLxyBJ/3YYK12/kyvpcUhdHdoLBO0UnISsRKFRnANbmgKpb5fJ8G5yBQHxozx04W 15XCwip6lxR0Gzu8g7F521hXzbRGETZdzt8euXSabDxqG2viDA5AnD2bCZYUdQn06UaGJr V/x+CRXHA0b1ssRTdWfGN0t4tEWUeOUToMNA6S21BDPwYyuCtHO7dOkWM+9Z1w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782484815; a=rsa-sha256; cv=none; b=ig6HN995PFEWaNyd7AX9DQCedY6b22xlNpGQvo1glmLAsnN2/vWHyB+pNJpFKQnDXqpBNi RBUfsApkygQ7L4hu3VMArJy2fmPayMDYb0IBy3vx10Va1BaP6J1qSww7NgkBeTpWrL4rne TYKZiQv8n2ilaGnKLjlUISHpmEZJxSoGG6Xjb7hXXqexoW+3J5I5iqO+F62rlR12OM6fSc CCAmprnbpEQ3hSzpMKBZWwtz7HCwxCuwoqteTcPMhx0h6el6gGAt6SJT/LAjSXQrx+1EG+ W/N3reMBAOq2Jt3lG8wuXKbkznPBYXUp4bQmRQg3cho9P0r913bWtRE6xevbtA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782484815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ven7yJAFEm/g/JHEhk0zwcypKk/5wRAaM/bO+Nh27Tk=; b=n0GtOXULt2S+6rHm26e3ZutDqlLRZa9Rug5KolX0r7r2MO5gWbnT8JLFAR25WE9w3NVvi6 bkTFx/DbQGlq1Nrs9247kt9XSKo0u5UDXy9qF9YgbUoKA8A3UuvpvSO9EuqiXD/eANbB9A 45RjUHbqDy3n1Brz+frsrDVpcONQyajOuJSmq08O5u18l56qY1/KHgr9bP2TH70/98WNHt ARU/0XcDFIsD1IzyeVmiKyT2zFo/9JMMxpA5/xBjkP24G2HYuGeLQKlXC0uJ8V6ewfe/Dr HVbD1e/8zLGPlGRZ+Mome2IjmqTwOvhITzZpm+tdf7ZaqGNW4NsM89toR/Ptsw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gmyy73gW3zhVh for ; Fri, 26 Jun 2026 14:40:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f1e2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 26 Jun 2026 14:40:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav Subject: git: a71abf38e2b4 - main - rc.firewall: Support on-disk lists List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a71abf38e2b46c02965f3224c62bb6ef1971996e Auto-Submitted: auto-generated Date: Fri, 26 Jun 2026 14:40:15 +0000 Message-Id: <6a3e8f4f.1f1e2.17cad796@gitrepo.freebsd.org> The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=a71abf38e2b46c02965f3224c62bb6ef1971996e commit a71abf38e2b46c02965f3224c62bb6ef1971996e Author: Dag-Erling Smørgrav AuthorDate: 2026-06-26 14:38:53 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2026-06-26 14:38:53 +0000 rc.firewall: Support on-disk lists For firewall_allowservices and firewall_trusted, if an element of the list looks like an absolute path, read the file, skipping comments and blank lines, and treat the first word on each line as an address or subnet to be added to the list. We should probably be using tables instead, but this is still an improvement over the status quo ante. MFC after: 1 week Relnotes: yes Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D57679 --- libexec/rc/rc.conf | 11 +++++++---- libexec/rc/rc.firewall | 43 ++++++++++++++++++++++++++++++++----------- 2 files changed, 39 insertions(+), 15 deletions(-) diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 6e70baccac98..ab92a464b133 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -183,11 +183,14 @@ firewall_simple_onet="192.0.2.0/28" # Outside network address for "simple" # for "simple" firewall. firewall_myservices="" # List of ports/protocols on which this host # offers services for "workstation" firewall. -firewall_allowservices="" # List of IPs which have access to +firewall_allowservices="" # List of IPs or subnets which have access to # $firewall_myservices for "workstation" - # firewall. -firewall_trusted="" # List of IPs which have full access to this - # host for "workstation" firewall. + # firewall, or of files containing lists of + # IPs or subnets, one per line. +firewall_trusted="" # List of IPs or subnets which have full access + # to this host for "workstation" firewall, or + # of files containing lists of IPs or subnets, + # one per line. firewall_logdeny="NO" # Set to YES to log default denied incoming # packets for "workstation" firewall. firewall_nologports="135-139,445 1026,1027 1433,1434" # List of TCP/UDP ports diff --git a/libexec/rc/rc.firewall b/libexec/rc/rc.firewall index 65bf1cc54f85..f3e1ea116522 100644 --- a/libexec/rc/rc.firewall +++ b/libexec/rc/rc.firewall @@ -406,10 +406,14 @@ case ${firewall_type} in # firewall_myservices: List of ports/protocols on which this # host offers services. # firewall_allowservices: List of IPv4 and/or IPv6 addresses - # that have access to - # $firewall_myservices. + # or subnets that have access to + # $firewall_myservices, or files + # containing such address or subnets, + # one per line. # firewall_trusted: List of IPv4 and/or IPv6 addresses - # that have full access to this host. + # or subnets that have full access to + # this host, or files containing such + # addresses or subnets, one per line. # Be very careful when setting this. # This option can seriously degrade # the level of protection provided by @@ -467,25 +471,33 @@ case ${firewall_type} in # workstation won't be a problem. # for i in ${firewall_allowservices} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _; do for j in ${firewall_myservices} ; do case $j in [0-9A-Za-z]*/[Pp][Rr][Oo][Tt][Oo]) ${fwcmd} add pass ${j%/[Pp][Rr][Oo][Tt][Oo]} from $i to me - ;; + ;; [0-9A-Za-z]*/[Tt][Cc][Pp]) ${fwcmd} add pass tcp from $i to me ${j%/[Tt][Cc][Pp]} - ;; + ;; [0-9A-Za-z]*/[Uu][Dd][Pp]) ${fwcmd} add pass udp from $i to me ${j%/[Uu][Dd][Pp]} - ;; + ;; *[0-9A-Za-z]) - echo "Consider using ${j}/tcp in firewall_myservices." \ - > /dev/stderr + echo "Consider using ${j}/tcp in firewall_myservices." >&2 ${fwcmd} add pass tcp from $i to me $j - ;; + ;; *) - echo "Invalid port in firewall_myservices: $j" > /dev/stderr - ;; + echo "Invalid port in firewall_myservices: $j" >&2 + ;; esac done done @@ -494,6 +506,15 @@ case ${firewall_type} in # Playing with the content of firewall_trusted could seriously # degrade the level of protection provided by the firewall. for i in ${firewall_trusted} ; do + case $i in + /*) + grep '^[^#]' "$i" + ;; + *) + echo "$i" + ;; + esac + done | while read i _ ; do ${fwcmd} add pass ip from $i to me done