Scrap the supplied ipfw script and replace with my own ipfw stateful

  firewall script.

Package-Manager: portage-2.1.2.2

5 files changed, 112 insertions, 67 deletions

diff --git a/sys-freebsd/freebsd-sbin/ChangeLog b/sys-freebsd/freebsd-sbin/ChangeLog
index 7194765730b1..f25de4e9bd11 100644
--- a/sys-freebsd/freebsd-sbin/ChangeLog
+++ b/sys-freebsd/freebsd-sbin/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for sys-freebsd/freebsd-sbin
 # Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/ChangeLog,v 1.33 2007/02/23 13:56:05 uberlord Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/ChangeLog,v 1.34 2007/03/13 14:36:29 uberlord Exp $
+
+  13 Mar 2007; Roy Marples <uberlord@gentoo.org> +files/ipfw.confd,
+  files/ipfw.initd, freebsd-sbin-6.2.ebuild:
+  Scrap the supplied ipfw script and replace with my own ipfw stateful
+  firewall script.
 
   23 Feb 2007; Roy Marples <uberlord@gentoo.org> files/devd.initd,
   files/ipfw.initd, files/sysctl.initd:
diff --git a/sys-freebsd/freebsd-sbin/Manifest b/sys-freebsd/freebsd-sbin/Manifest
index b424f74b93e6..3428143aafcd 100644
--- a/sys-freebsd/freebsd-sbin/Manifest
+++ b/sys-freebsd/freebsd-sbin/Manifest
@@ -26,10 +26,14 @@ AUX freebsd-sbin-zlib.patch 793 RMD160 ba321e563ba92e73c4183740e425d50471fbffcf
 MD5 ae8e21abde36bcbc19d3464d1e368033 files/freebsd-sbin-zlib.patch 793
 RMD160 ba321e563ba92e73c4183740e425d50471fbffcf files/freebsd-sbin-zlib.patch 793
 SHA256 a02a2f8dda23952f6d90100fd1dddc3a3a5048653a74fb1f4b52ceb18bedb448 files/freebsd-sbin-zlib.patch 793
-AUX ipfw.initd 2027 RMD160 15773f3a44ec9aae2ecd077e711993d0aa003f4c SHA1 f420e5f1263f7c0cebd9e38d844be415c78dbacc SHA256 67500ebd22d39ae7ba575a7093ba81eef0d70081ca169e2a731f180858f0cd46
-MD5 4e78b4aa4962059870010c2526695db5 files/ipfw.initd 2027
-RMD160 15773f3a44ec9aae2ecd077e711993d0aa003f4c files/ipfw.initd 2027
-SHA256 67500ebd22d39ae7ba575a7093ba81eef0d70081ca169e2a731f180858f0cd46 files/ipfw.initd 2027
+AUX ipfw.confd 292 RMD160 78901ec3b3dbd67da089c2a9cd40d6b6457ffa06 SHA1 a67c0d7edcf116460413b6fc8dcedffa209ca79d SHA256 8e09c8c290b9323e9e7125329886d1f8514e00165500080723f788eec5dae733
+MD5 18215c72775a2311d20176188be16525 files/ipfw.confd 292
+RMD160 78901ec3b3dbd67da089c2a9cd40d6b6457ffa06 files/ipfw.confd 292
+SHA256 8e09c8c290b9323e9e7125329886d1f8514e00165500080723f788eec5dae733 files/ipfw.confd 292
+AUX ipfw.initd 2424 RMD160 3b95ab5045493cf723d1eba7fbca43d6c65fb661 SHA1 0cf7941ca6d29579b5768d6f0ecdb223b3c84a9b SHA256 3b0d52a221210fda64faeccd2e48abfe4f50f83018d9c273f96ff089e527482e
+MD5 b78c1d8cae8707de42a7729416a3f3b5 files/ipfw.initd 2424
+RMD160 3b95ab5045493cf723d1eba7fbca43d6c65fb661 files/ipfw.initd 2424
+SHA256 3b0d52a221210fda64faeccd2e48abfe4f50f83018d9c273f96ff089e527482e files/ipfw.initd 2424
 AUX sysctl.initd 664 RMD160 e07440c9cc9fb4aa36dd724ffd7e01bdcdb7658f SHA1 9928928c154eaba070e75c5c99cee539a0c9875a SHA256 3f58694d02a1cd57e02e28d51b3e598e9edb022ba52c64be352bc392604de717
 MD5 edc2fd562e52937c9b100df106b39d1a files/sysctl.initd 664
 RMD160 e07440c9cc9fb4aa36dd724ffd7e01bdcdb7658f files/sysctl.initd 664
@@ -41,14 +45,14 @@ DIST freebsd-libexec-6.2.tar.bz2 277231 RMD160 423490cb7c888bfce7edcf473d77868c6
 DIST freebsd-sbin-6.2.tar.bz2 1162548 RMD160 f7d5f4ea5e4b5e03910a44a127b5670f8d6ebf2c SHA1 be082439c7ed657a1f188af93837f7c34677eddf SHA256 aef424c07686bb72fbd06e4fd66a01b00bd36b70fec02ebdc228061cd4b435dd
 DIST freebsd-sys-6.2.tar.bz2 18344936 RMD160 784230e22ccaf09933ef3f053ff29cc3e579786a SHA1 161b7a4d165665deb1c4434c356b5f610a72a83a SHA256 a754371d88601aaab7152bb3d127bd3777db912e13a26a866e13ba34934c5e5b
 DIST freebsd-usbin-6.2.tar.bz2 2695872 RMD160 ea6104fcfbf6c0be511a80d0475e5a8f716292be SHA1 4772ed5fdc591273887fc7a2e97bddf7a1669b5d SHA256 6195301d39e7bc7fa00f6dec71479b1800ea5c3dc9d3ea375dafe4e71e6485f0
-EBUILD freebsd-sbin-6.2.ebuild 2714 RMD160 e83ac29b0c2e78cea45813af116cdaef1f5fb68b SHA1 82e2c0bb796ac9b8aa2b49edecaffef8cce1add1 SHA256 3ab64a94253ab482a43ecc3ba83ef87f5d5866fb0ef9dd920eb51bbc114cdf64
-MD5 ebed02e9fb1f2832976dc2c4ce85b98b freebsd-sbin-6.2.ebuild 2714
-RMD160 e83ac29b0c2e78cea45813af116cdaef1f5fb68b freebsd-sbin-6.2.ebuild 2714
-SHA256 3ab64a94253ab482a43ecc3ba83ef87f5d5866fb0ef9dd920eb51bbc114cdf64 freebsd-sbin-6.2.ebuild 2714
-MISC ChangeLog 8214 RMD160 faa8afa4d1a7a94d6e0a76f5ab3e7dafd6cdfd38 SHA1 0d819c65071cbcf2e1218a23d9f1ebc3758f1367 SHA256 fe153a3c5186332ed7d14eedb56dff0764fc99b1440004c170b2d524aee371c2
-MD5 707eef30bd1bfbe3c9deb47a812431e2 ChangeLog 8214
-RMD160 faa8afa4d1a7a94d6e0a76f5ab3e7dafd6cdfd38 ChangeLog 8214
-SHA256 fe153a3c5186332ed7d14eedb56dff0764fc99b1440004c170b2d524aee371c2 ChangeLog 8214
+EBUILD freebsd-sbin-6.2.ebuild 2756 RMD160 248395564ee560c18166c075e95b25bd48308159 SHA1 a3e099442d7e7757c70e3556875a93b5aebe6c2f SHA256 bed2cca5e89e0210e5d41f1f731d17fe6ef234cc32e9557d04c108bcb9c2d560
+MD5 896bd762d6714ae266a8af3dd16fc929 freebsd-sbin-6.2.ebuild 2756
+RMD160 248395564ee560c18166c075e95b25bd48308159 freebsd-sbin-6.2.ebuild 2756
+SHA256 bed2cca5e89e0210e5d41f1f731d17fe6ef234cc32e9557d04c108bcb9c2d560 freebsd-sbin-6.2.ebuild 2756
+MISC ChangeLog 8418 RMD160 bc665efac8b9ab42295f5f7b1859e76d1cd872eb SHA1 9187e63afde81aafa6fd1d3a832d2a72f06b0c45 SHA256 2d643df2c1c67bd037b2dde76bb0d7e9241e737f108ea0dba0e16e41c8195e86
+MD5 59cd7b343169944761a655e13922af01 ChangeLog 8418
+RMD160 bc665efac8b9ab42295f5f7b1859e76d1cd872eb ChangeLog 8418
+SHA256 2d643df2c1c67bd037b2dde76bb0d7e9241e737f108ea0dba0e16e41c8195e86 ChangeLog 8418
 MISC metadata.xml 156 RMD160 60b5820a08275f307e5bd936d78f5afd1f141086 SHA1 d9d9d4f2b5afc58339ea3e562fca490156935f1f SHA256 30ab515d6ac492d3d6c36ac3c675511742c2149e56a6b3228c8d22ab8edb3ff7
 MD5 2bd48a5ae413433cbb36110b219ce97c metadata.xml 156
 RMD160 60b5820a08275f307e5bd936d78f5afd1f141086 metadata.xml 156
diff --git a/sys-freebsd/freebsd-sbin/files/ipfw.confd b/sys-freebsd/freebsd-sbin/files/ipfw.confd
new file mode 100644
index 000000000000..78864eef549e
--- /dev/null
+++ b/sys-freebsd/freebsd-sbin/files/ipfw.confd
@@ -0,0 +1,7 @@
+# ipfw provides a stateful firewall.
+# This means we allow everything out, and if we have a connection we allow it
+# back in. This is very flexable and quite secure.
+
+# For ease of use, we allow auth and ssh ports through as well.
+# To override the list of allowed ports
+#PORTS_IN="auth ssh"
diff --git a/sys-freebsd/freebsd-sbin/files/ipfw.initd b/sys-freebsd/freebsd-sbin/files/ipfw.initd
index 71118e7bea22..b0bd26f82fc2 100644
--- a/sys-freebsd/freebsd-sbin/files/ipfw.initd
+++ b/sys-freebsd/freebsd-sbin/files/ipfw.initd
@@ -1,73 +1,101 @@
 #!/sbin/runscript
-# Copyright 1999-2005 Gentoo Foundation
+# Copyright 2007 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/files/ipfw.initd,v 1.2 2007/02/23 13:56:05 uberlord Exp $
+
+# This is a nice client firewall script which should suit most desktop users.
+# We allow auth and ssh in by default.
+
+PORTS_IN=${PORTS_IN:-auth ssh}
+
+opts="panic showstatus"
 
 depend() {
-	 before net
+	before net
+	provide firewall
 }
 
-start() {
-	ebegin "Starting firewall"
-	
-	retval=0
-	
-	if ! sysctl net.inet.ip.fw.enable &>/dev/null; then
-		if ! kldload ipfwl then
+ipfw() {
+	/sbin/ipfw -f -q "$@"
+}
+
+init() {
+	# Load the kernel module
+	if ! sysctl net.inet.ip.fw.enable=1 >/dev/null 2>/dev/null ; then
+		if ! kldload ipfw ; then
 			eend 1 "Unable to load firewall module"
 			return 1
 		fi
 	fi
 
-	if [ -z "${firewall_script}" ] || [ ! -f "${firewall_script}" ]; then
-		firewall_script=/etc/rc.firewall
-	fi
+	ipfw flush
 
-	if [ -r "${firewall_script}" ]; then
-		source "${firewall_script}"
-		einfo "Loaded firewall rules; starting daemons"
-
-		if [ "${natd_enable}" = "yes" ]; then
-			# Find out whether $natd_interface is using dhcp
-			ifconfig_natd_iface=$(
-				eval source /etc/conf.d/net\;
-				echo \$\{ifconfig_${natd_interface}\})
-			if [ "${ifconfig_natd_iface}" = "dhcp" ]; then
-				natd_flags="${natd_flags} -dynamic"
-			fi
-
-			if [ -n "${natd_interface}" ]; then
-				# Yes, this is ugly.
-				if grep -q -E '^[0-9]+(\.[0-9]+){0,3}$' \
-						 <<<${natd_interface}; then
-					natd_flags="${natd_flags} -a ${natd_interface}"
-				else
-					natd_flags="${natd_flags} -n ${natd_interface}"
-				fi
-			fi
-			start-stop-daemon --start --exec \
-				${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg} || retval=1
-		fi
-	elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
-		ewarn "Kernel has firewall functionality, but firewall rules aren't enabled!"
-		ewarn "All ip services are disabled.
+	ipfw add allow all from any to any via lo0
+	ipfw add allow all from any to 127.0.0.0/8
+	ipfw add deny ip from 127.0.0.0/8 to any
+
+	ipfw add allow ipv6-icmp from :: to ff02::/16
+	ipfw add allow ipv6-icmp from fe80::/10 to fe80::/10
+	ipfw add allow ipv6-icmp from fe80::/10 to ff02::/16
+}
+
+start() {
+	local x=
+	ebegin "Starting firewall rules"
+	if ! init ; then
+		eend 1 "Failed to flush firewall ruleset"
+		return 1
 	fi
 
-	# Logging
-	if [ "${firewall_logging}" = "yes" ]; then
-		einfo "Enabling firewall logging"
-		sysctl net.inet.ip.fw.verbose=1 >/dev/null
+	# Use a statefull firewall
+	ipfw add check-state
+
+	# Open our configured ports
+	if [ -n "${PORTS_IN}" ] ; then
+		local pin=
+		for x in ${PORTS_IN} ; do
+		    [ -n "${pin}" ] && pin="${pin},"
+		    pin="${pin}${x}"
+		done
+		ipfw add allow tcp from any to me ${pin} setup keep-state
+		ipfw add allow tcp from any to me6 ${pin} setup keep-state
+		ipfw add allow udp from any to me ${pin} keep-state
+		ipfw add allow udp from any to me6 ${pin} keep-state
 	fi
 
-	# And enable the firewall.
-	sysctl -w net.inet.ip.fw.enable=1
-	
-	eend $retval "Failed to properly start firewall"
+	# Nice flexable rules that disallow incoming except for stuff we
+	# have asked for, and allow all outgoing.
+	ipfw add allow tcp from me to any setup keep-state
+	ipfw add allow tcp from me6 to any setup keep-state 
+	ipfw add deny tcp from any to any
+	ipfw add allow udp from me to any keep-state
+	ipfw add allow udp from me6 to any keep-state
+	ipfw add deny udp from any to any
+
+	# Be a good firewall and allow some ICMP traffic.
+	# Remove 8 if you really want to disallow ping.
+	ipfw add allow icmp from any to any icmptypes 0,3,8,11,12
+	ipfw add allow ip6 from any to any proto ipv6-icmp 
+
+	eend 0
 }
 
 stop() {
-	ebegin "Stopping the firewall"
-	sysctl -w net.inet.ip.fw.enable=0
-	start-stop-daemon --stop --name "$(basename ${natd_program:-/sbin/natd})"
-	eend $? "Failed to properly stop the firewall"
+	ebegin "Stopping firewall rules"
+	# We don't unload the kernel module as that action
+	# can cause memory leaks as of FreeBSD 6.x
+	sysctl net.inet.ip.fw.enable=0 >/dev/null
+	eend $?
+}
+
+panic() {
+	ebegin "Stopping firewall rules - hard"
+	if ! init ; then
+		eend 1 "Failed to flush firewall ruleset"
+		return 1
+	fi
+	eend 0
+}
+
+showstatus() {
+	ipfw show
 }
diff --git a/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild b/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild
index f04d59a96e2c..a65ebe627453 100644
--- a/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild
+++ b/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2007 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild,v 1.1 2007/01/15 21:38:54 drizzt Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-freebsd/freebsd-sbin/freebsd-sbin-6.2.ebuild,v 1.2 2007/03/13 14:36:29 uberlord Exp $
 
 inherit flag-o-matic bsdmk freebsd
 
@@ -64,6 +64,7 @@ src_install() {
 
 	newinitd "${FILESDIR}/devd.initd" devd
 	newinitd "${FILESDIR}/ipfw.initd" ipfw
+	newconfd "${FILESDIR}/ipfw.confd" ipfw
 	newinitd "${FILESDIR}/sysctl.initd" sysctl
 
 	# Gentoo devd.conf