From owner-freebsd-bugs@FreeBSD.ORG Mon Nov 15 04:20:25 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 89E5B16A4CE for ; Mon, 15 Nov 2004 04:20:25 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 604B043D1F for ; Mon, 15 Nov 2004 04:20:25 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.11/8.12.11) with ESMTP id iAF4KPoj090575 for ; Mon, 15 Nov 2004 04:20:25 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id iAF4KPUV090574; Mon, 15 Nov 2004 04:20:25 GMT (envelope-from gnats) Resent-Date: Mon, 15 Nov 2004 04:20:25 GMT Resent-Message-Id: <200411150420.iAF4KPUV090574@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Clive Lin Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 157A516A4CE for ; Mon, 15 Nov 2004 04:17:14 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id EB62E43D2D for ; Mon, 15 Nov 2004 04:17:13 +0000 (GMT) (envelope-from clive@FreeBSD.org) Received: from freefall.freebsd.org (clive@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.11/8.12.11) with ESMTP id iAF4HDUf090427 for ; Mon, 15 Nov 2004 04:17:13 GMT (envelope-from clive@freefall.freebsd.org) Received: (from clive@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id iAF4HDbB090426; Mon, 15 Nov 2004 04:17:13 GMT (envelope-from clive) Message-Id: <200411150417.iAF4HDbB090426@freefall.freebsd.org> Date: Mon, 15 Nov 2004 04:17:13 GMT From: Clive Lin To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: misc/73959: Teach periodic(8) to understand pf(4) denied packets X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Clive Lin List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Nov 2004 04:20:25 -0000 >Number: 73959 >Category: misc >Synopsis: Teach periodic(8) to understand pf(4) denied packets >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Nov 15 04:20:24 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Clive Lin >Release: FreeBSD 6.0-CURRENT i386 >Organization: FreeBSD.org >Environment: System: FreeBSD trex 5.3-RELEASE FreeBSD 5.3-RELEASE #1: Sun Nov 14 03:37:41 CST 2004 root@builder:/usr/obj/usr/src/sys/I686UP i386 >Description: periodic(8) security output could display ipfw and ipf denied packets, but not pf. Teach it to understand pf output. >How-To-Repeat: Read periodic mails, subject "${hostname} security run output." Number of denied packets by ipfw and ipf could be displayed, but not pf. >Fix: diff -ruN --exclude *CVS* /usr/src/etc/defaults/periodic.conf ./defaults/periodic.conf --- /usr/src/etc/defaults/periodic.conf Thu Sep 23 17:10:05 2004 +++ ./defaults/periodic.conf Mon Nov 15 12:01:20 2004 @@ -150,6 +150,9 @@ # 510.ipfdenied daily_status_security_ipfdenied_enable="YES" +# 520.pfdenied +daily_status_security_pfdenied_enable="YES" + # 550.ipfwlimit daily_status_security_ipfwlimit_enable="YES" diff -ruN --exclude *CVS* /usr/src/etc/periodic/security/520.pfdenied ./periodic/security/520.pfdenied --- /usr/src/etc/periodic/security/520.pfdenied Thu Jan 1 08:00:00 1970 +++ ./periodic/security/520.pfdenied Mon Nov 15 12:00:12 2004 @@ -0,0 +1,53 @@ +#!/bin/sh - +# +# Copyright (c) 2001 The FreeBSD Project +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +# If there is a global system configuration file, suck it in. +# +if [ -r /etc/defaults/periodic.conf ] +then + . /etc/defaults/periodic.conf + source_periodic_confs +fi + +. /etc/periodic/security/security.functions + +rc=0 + +case "$daily_status_security_pfdenied_enable" in + [Yy][Ee][Ss]) + TMP=`mktemp -t security` + if pfctl -sr -v 2>/dev/null | nawk '{if (/^block/) {print $0;getline;print $0} }' > ${TMP}; then + check_diff new_only pf ${TMP} "${host} pf denied packets:" + fi + rc=$? + rm -f ${TMP};; + *) rc=0;; +esac + +exit $rc diff -ruN --exclude *CVS* /usr/src/etc/periodic/security/Makefile ./periodic/security/Makefile --- /usr/src/etc/periodic/security/Makefile Sun Oct 27 02:19:21 2002 +++ ./periodic/security/Makefile Mon Nov 15 12:00:56 2004 @@ -6,6 +6,7 @@ 400.passwdless \ 500.ipfwdenied \ 510.ipfdenied \ + 520.pfdenied \ 550.ipfwlimit \ 600.ip6fwdenied \ 650.ip6fwlimit \ >Release-Note: >Audit-Trail: >Unformatted: