From andrea@netfence.it  Sun Mar 13 13:50:46 2005
Return-Path: <andrea@netfence.it>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C3CEC16A4CE
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 13 Mar 2005 13:50:46 +0000 (GMT)
Received: from parrot.aev.net (host29-15.pool8174.interbusiness.it [81.74.15.29])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5D95143D41
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 13 Mar 2005 13:50:45 +0000 (GMT)
	(envelope-from andrea@netfence.it)
Received: from soth.ventu (adsl-125-24.37-151.net24.it [151.37.24.125])
	(authenticated bits=128)
	by parrot.aev.net (8.13.1/8.13.1) with ESMTP id j2DE8jmi089855
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 13 Mar 2005 15:08:52 +0100 (CET)
	(envelope-from andrea@netfence.it)
Received: from soth.ventu (localhost [127.0.0.1])
	by soth.ventu (8.13.3/8.13.1) with ESMTP id j2DDnIc5018240
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 13 Mar 2005 14:49:18 +0100 (CET)
	(envelope-from andrea@soth.ventu)
Received: (from andrea@localhost)
	by soth.ventu (8.13.1/8.13.1/Submit) id j2DDnIZY018239;
	Sun, 13 Mar 2005 14:49:18 +0100 (CET)
	(envelope-from andrea)
Message-Id: <200503131349.j2DDnIZY018239@soth.ventu>
Date: Sun, 13 Mar 2005 14:49:18 +0100 (CET)
From: Andrea Venturoli <freebsd@netfenece.it>
Reply-To: Andrea Venturoli <freebsd@netfence.it>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [patch] ipfw verbosity locks machine if /etc/rc.firewall is run remotely
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         78785
>Category:       bin
>Synopsis:       [patch] ipfw(8) verbosity locks machine if /etc/rc.firewall is run remotely
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ipfw
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 13 14:00:06 GMT 2005
>Closed-Date:    
>Last-Modified:  Sat May 24 23:11:40 UTC 2008
>Originator:     Andrea Venturoli
>Release:        FreeBSD 5.3-RELEASE-p5 i386
>Organization:
NetFence
>Environment:
System: FreeBSD soth.ventu 5.3-RELEASE-p5 FreeBSD 5.3-RELEASE-p5 #1: Mon Feb 28 00:34:36 CET 2005 root@soth.ventu:/usr/obj/usr/src/sys/SOTH i386


	
>Description:
	Running "sh /etc/rc.firewall" remotely (e.g. over ssh) locks the machine out if a preprocessor is used.
	First, rules are flushed, then they should be reloaded, but -p option outputs "command is ..." even if -q option is used. This result in session disconnection *before* rules are actually reloaded, so only the default deny will be there. It is then oviously impossible to login again.
	Notice that using screen (from the port tree) is a viable workaround, when no console access is possible.
	4.x machines are not affected, unless ipfw2 is used instead of ipfw; all 5.x and later boxes use ipfw2, so should exhibit this problem, though I can only confirm this for 5.3.

>How-To-Repeat:
	(Be sure either to have console access or to schedule a reboot before you begin).
	Put the following line in /etc/rc.conf:
		firewall_flags="-q -p /usr/bin/somepreprocessor"
	Login remotely and issue "sh /etc/rc.firewall".
>Fix:
	As said above, use /usr/ports/misc/screen.
	Alternatively, here is a patch for /usr/src/sbin/ipfw/ipfw2.c (this is for 5.3p5 (ipfw2.c,v 1.54.2.3), but so simple that it should not be difficult to adapt it to newer revisions):

4031c4031,4032
<                       fprintf(stderr, "command is %s\n", av[0]);
---
>                       if (!do_quiet)
>                               fprintf(stderr, "command is %s\n", av[0]);

	You will need to specify -q *before* -p. (This again would not too be difficult to fix).
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-ipfw 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Oct 24 05:11:22 GMT 2005 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=78785 
>Unformatted:
