rc.firewall: Support on-disk lists
Needs ReviewPublic
Actions

Authored by des on Fri, Jun 19, 6:54 PM.

Details

Reviewers

None

Group Reviewers

Summary

For firewall_allowservices and firewall_trusted, if an element of the
list looks like an absolute path, read the file, skipping comments and
blank lines, and treat the first word on each line as an address or
subnet to be added to the list.

We should probably be using tables instead, but this is still an
improvement over the status quo ante.

MFC after: 1 week
Relnotes: yes

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 74021
Build 70904: arc lint + arc unit

Event Timeline

des created this revision.Fri, Jun 19, 6:54 PM

Herald added a subscriber: imp. · View Herald TranscriptFri, Jun 19, 6:54 PM

des requested review of this revision.Fri, Jun 19, 6:54 PM

Harbormaster completed remote builds in B74021: Diff 180089.Fri, Jun 19, 6:54 PM

des added a parent revision: D57678: rc.firewall: Use checkyesno for boolean variables.Fri, Jun 19, 6:54 PM

des added a reviewer: rc.Sat, Jun 20, 11:19 AM

allanjude added a subscriber: allanjude.Thu, Jun 25, 12:47 PM

allanjude added inline comments.

libexec/rc/rc.firewall
474	Should we require that files be absolute paths, so that there isn't the chance of "accidentally" loading a file that happens to have a name collision with an hostname or ip address?