kern/165939: [ipw] security bug: incomplete firewall rules
loaded if tables are used in ipfw.conf
Chris Rees
utisoft at gmail.com
Sat Jul 14 17:59:56 UTC 2012
On 14 Jul 2012 18:49, "Ian Smith" <smithi at nimnet.asn.au> wrote:
>
> On Sat, 14 Jul 2012, crees at freebsd.org wrote:
> > http://www.freebsd.org/cgi/query-pr.cgi?pr=165939
>
> > Description
> > If user has tables used in /etc/ipfw.conf for example:
> >
> > table 1 add 64.6.108.239
> >
> > then firewall restart:
> >
> > /etc/rc.d/ipfw start
> >
> > fails with:
> > Line 8: setsockopt(IP_FW_TABLE_ADD): File exists
> > Firewall rules loaded.
> >
> > and incomplete ruleset is loaded. This is serious security problem.
> >
> > How-To-Repeat
> > Fix
> > in /etc/rc.firewall
> >
> > after ${fwcmd} -f flush
> > you need to flush tables too with command
> >
> > ipfw table all flush
>
> Yes, to such a ruleset you'd need to add 'table all flush' too.
>
> ipfw flush specifically does not flush tables. I've long relied upon
> that, using mostly static tables only reloaded from a file saved hourly
> by cron, when $firewall_script finds tables are not loaded - ie at boot.
Not A Bug then?
Chris
More information about the freebsd-bugs
mailing list