From owner-freebsd-bugs Thu Mar 20 16:20: 9 2003 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0BF4137B401 for ; Thu, 20 Mar 2003 16:20:06 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0547543F93 for ; Thu, 20 Mar 2003 16:20:05 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id h2L0K4NS090278 for ; Thu, 20 Mar 2003 16:20:04 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.6/8.12.6/Submit) id h2L0K4Ee090277; Thu, 20 Mar 2003 16:20:04 -0800 (PST) Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 355CC37B401 for ; Thu, 20 Mar 2003 16:14:39 -0800 (PST) Received: from t-mta7.odn.ne.jp (mfep7.odn.ne.jp [143.90.131.185]) by mx1.FreeBSD.org (Postfix) with ESMTP id 277DE43F93 for ; Thu, 20 Mar 2003 16:14:38 -0800 (PST) (envelope-from fuyuki@hadaly.org) Received: from hadaly.dyndns.org ([61.123.32.121]) by t-mta7.odn.ne.jp with ESMTP id <20030321001437180.KVHO.21631.t-mta7.odn.ne.jp@mta7.odn.ne.jp> for ; Fri, 21 Mar 2003 09:14:37 +0900 Received: from hadaly.dyndns.org (localhost [127.0.0.1]) by hadaly.dyndns.org (Postfix) with ESMTP id 34A7420C0 for ; Fri, 21 Mar 2003 09:14:36 +0900 (JST) Message-Id: <867katr2xg.wl%fuyuki@hadaly.org> Date: Fri, 21 Mar 2003 09:14:35 +0900 From: Kimura Fuyuki To: FreeBSD-gnats-submit@FreeBSD.org Subject: misc/50154: Add /etc/periodic/security/610.ipf6denied Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 50154 >Category: misc >Synopsis: Add /etc/periodic/security/610.ipf6denied >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Mar 20 16:20:04 PST 2003 >Closed-Date: >Last-Modified: >Originator: Kimura Fuyuki >Release: FreeBSD 5.0-RELEASE-p4 i386 >Organization: >Environment: System: FreeBSD hadaly.dyndns.org 5.0-RELEASE-p4 FreeBSD 5.0-RELEASE-p4 #2: Fri Mar 7 13:26:51 JST 2003 root@hadaly.dyndns.org:/.2/obj/usr/src/sys/NS i386 >Description: Please add /etc/periodic/security/610.ipf6denied. This is very natural because we have - ipv6_ipfilter_rules (rc.conf option) - 500.ipfwdenied - 510.ipfdenied - 600.ip6fwdenied >How-To-Repeat: >Fix: diff -ruN etc.orig/defaults/periodic.conf etc/defaults/periodic.conf --- etc.orig/defaults/periodic.conf Fri Mar 21 09:02:57 2003 +++ etc/defaults/periodic.conf Thu Mar 20 12:59:50 2003 @@ -165,6 +166,9 @@ # 600.ip6fwdenied daily_status_security_ip6fwdenied_enable="YES" + +# 610.ipf6denied +daily_status_security_ipf6denied_enable="YES" # 650.ip6fwlimit daily_status_security_ip6fwlimit_enable="YES" diff -ruN etc.orig/periodic/security/610.ipf6denied etc/periodic/security/610.ipf6denied --- etc.orig/periodic/security/610.ipf6denied Thu Jan 1 09:00:00 1970 +++ etc/periodic/security/610.ipf6denied Tue Mar 18 12:39:29 2003 @@ -0,0 +1,53 @@ +#!/bin/sh - +# +# Copyright (c) 2001 The FreeBSD Project +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +# If there is a global system configuration file, suck it in. +# +if [ -r /etc/defaults/periodic.conf ] +then + . /etc/defaults/periodic.conf + source_periodic_confs +fi + +. /etc/periodic/security/security.functions + +rc=0 + +case "$daily_status_security_ipf6denied_enable" in + [Yy][Ee][Ss]) + TMP=`mktemp ${TMPDIR:-/tmp}/security.XXXXXXXXXX` + if ipfstat -nhio6 2>/dev/null | grep block > ${TMP}; then + check_diff new_only ipf6 ${TMP} "${host} ipf6 denied packets:" + fi + rc=$? + rm -f ${TMP};; + *) rc=0;; +esac + +exit $rc >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message