[Bug 256410] pf: Add pf_default_rules option

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256410

--- Comment #6 from Thomas Steen Rasmussen / Tykling <thomas@gibfest.dk> ---
Hello Kristof :)

Proposed commit message: 
-----------------------------------------------------------------------
pf: Support loading small default pf ruleset in case of invalid pf.conf using
pf_default_rules and pf_default_rules_enable

When no pf rules are loaded pf will pass/allow all traffic if the kernel is
compiled without PF_DEFAULT_TO_DROP, which is the case in GENERIC. This commit
introduces a "pf default rules" concept to minimise the impact if a typo in
pf.conf makes loading the firewall rules impossible on boot.

The change checks the exit code of the $pf_program (pfctl) command when loading
pf.conf inside pf_start() in /etc/rc.d/pf. After this commit, if the exit code
is 1 and pf_default_rules_enable is set to YES, then the rules defined in
$pf_default_rules are loaded instead. $pf_default_rules defaults to a single
rule: "block drop log all".

This commit also introduces new warn() calls when /etc/rc.d/pf fails to load
the pf ruleset in pf_start(). If $pf_default_rules_enable is NO (which is the
default) then the following messages are logged:

/etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable is
NO.
/etc/rc.d/pf: WARNING: No pf rules are loaded, this means all traffic is
permitted.

If pf_default_rules_enable is YES then the following messages are logged, and
the rules defined in $pf_default_rules are loaded:

/etc/rc.d/pf: WARNING: Unable to load pf.conf, and pf_default_rules_enable is
set to YES.
/etc/rc.d/pf: WARNING: Loading pf_default_rules: block drop log all

pf_default_rules can include multiple rules, for example to permit traffic on a
management interface. Seperate multiple rules with \n:

$ sudo sysrc pf_default_rules
pf_default_rules: block drop log all\npass quick on em0
$

The $pf_default_rules and $pf_default_rules_enable variables are defined in
/etc/defaults/rc.conf with the following lines, preserving the existing
functionality (apart from the new log messages):

pf_default_rules_enable="NO"   # fallback to $pf_default_rules if loading
ruleset fails
pf_default_rules="block drop log all"  # block and drop everything if loading
pf ruleset fails

PR:                     256410
Reported by:            Thomas Steen Rasmussen
Reviewed by:            kp@
Sponsored by:           semaphor.dk
-----------------------------------------------------------------------

Feel free to edit as you see fit :) Thank you!

-- 
You are receiving this mail because:
You are the assignee for the bug.