misc/96247: 550.ipfwlimit reports logs even if log size is not limited.

Tsurutani Naoki turutani at scphys.kyoto-u.ac.jp
Mon Apr 24 05:10:19 UTC 2006

>Number:         96247
>Category:       misc
>Synopsis:       550.ipfwlimit reports logs even if log size is not limited.
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 24 05:10:13 GMT 2006
>Originator:     Tsurutani Naoki
>Release:        FreeBSD 5.5-PRERELEASE i386
System: FreeBSD polymer3.scphys.kyoto-u.ac.jp 5.5-PRERELEASE FreeBSD 5.5-PRERELEASE #19: Thu Mar 23 12:05:35 JST 2006 turutani at polymer3.scphys.kyoto-u.ac.jp:/usr/local/work/usr/obj/usr/src/sys/POLYMER i386

	report via periodic daily may contain reports about ipfw.
	this report is created by 550.ipfwlimit even if log size is unlimited.
	% grep daily_status_security_ipfwlimit_enable /etc/defaults/periodic.conf
	% grep daily_status_security_ipfwlimit_enable /etc/periodic.conf
	% sysctl -n net.inet.ip.fw.verbose_limit
	% sh /etc/periodic/security/550.ipfwlimit
	ipfw log limit reached:
	00510       1          70 deny log ip from any to via xl0
	00520      27        3937 deny log ip from any to via xl0
	00600      57        7222 deny log ip from any to via sis0
	"options IPFIREWALL_VERBOSE_LIMIT=0" in kernel configuration file set
	sysctl variable "net.inet.ip.fw.verbose_limit" to 0.
	this means limit of log file is not set, according to the message printed
	in system boot sequence.
	if this is true, message "ipfw log limit reached" is curious.
	apply next patch to src/etc/periodic/security/550.ipfwlimit:

	--- 550.ipfwlimit	Mon Apr 24 13:27:57 2006
	+++ 550.ipfwlimit.orig	Mon Apr 24 13:27:37 2006
	@@ -43,7 +43,7 @@
	 case "$daily_status_security_ipfwlimit_enable" in
	 	IPFW_LOG_LIMIT=`sysctl -n net.inet.ip.fw.verbose_limit 2> /dev/null`
	-	if [ $? -ne 0 ] || [ "${IPFW_LOG_LIMIT}" -eq 0 ]; then
	+	if [ $? -ne 0 ]; then
	 		exit 0
	 	TMP=`mktemp -t security`

	this fix is not necessary about ip6fw, and is necessary on 6-STABLE.


More information about the freebsd-bugs mailing list