Bug 6937
| Summary: | [PATCH] rc.firewall can't be run from network - fix | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Adrian Steinmann <ast> |
| Component: | bin | Assignee: | freebsd-bugs (Nobody) <bugs> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | 2.2.6-RELEASE | ||
| Hardware: | Any | ||
| OS: | Any | ||
> Could we put this into the distributed /etc/rc.firewall?
I find your intentions here somewhat hard to follow, however. Could
you please resubmit your changes as context or unidiffs to the distributed
rc.firewall? Thanks!
State Changed From-To: open->closed It could be done from network, for example: # sh /etc/rc.firewall >/dev/null 2>&1 Refer to the ``BUGS'' section of ipfw(8) manpage. |
The file /etc/rc.firewall reloads the ipfw rules but may not complete if it is started on a network connection. Fix: I have been using this additional code in /etc/rc.firewall with good results: if, by chance, you run sh /etc/rc.firewall on a pty via the network, you will albeit lose your session but the script will finish completely and (unless you made changes which are faulty) you will be able to log back in agains (because it ignores the HUP signal). It also takes down and brings up all interfaces, making any ongoing connections cut cleaner (and usually continue) than when the rules are loaded while the interfaces are up. The real paranoid might also argue this way there is no window where the interfaces are up and the FW rules are incomplete... Could we put this into the distributed /etc/rc.firewall? ... PATH=/sbin:/usr/sbin:/bin:/usr/bin export PATH ... # routine to set interfaces down and up interfaces () { case "x$1" in xup|xdown) ifconfig -a | sed -n -e '/BROADCAST,/ s/:.*//p' | \ while read i; do ifconfig $i $1; done ;; *) echo "USAGE: interfaces [up|down]" >&2 ;; esac } ############ # START trap '' 1 interfaces down ... all the ipfw rules ... ############ # DONE interfaces up Adrian _________________________________________________________________________ Dr. Adrian Steinmann Steinmann Consulting Apollostrasse 21 8032 Zurich Tel +41 1 380 30 83 Fax +41 1 380 30 85 Mailto:ast@marabu.ch How-To-Repeat: Run sh /etc/rc.firewall on a network connection, if /etc/rc.firewall is sufficientlyu complex, you will lose your connection and may not be able to contact the machine again until /etc/rc.firewall is run completely.