From danger@tomas.elvandar.org  Thu Feb 23 19:16:30 2006
Return-Path: <danger@tomas.elvandar.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F306516A420
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 23 Feb 2006 19:16:29 +0000 (GMT)
	(envelope-from danger@tomas.elvandar.org)
Received: from tomas.elvandar.org (tomas.elvandar.org [217.148.169.60])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A52B343D45
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 23 Feb 2006 19:16:26 +0000 (GMT)
	(envelope-from danger@tomas.elvandar.org)
Received: by tomas.elvandar.org (Postfix, from userid 1002)
	id 9620D483F6A; Thu, 23 Feb 2006 19:16:20 +0000 (UTC)
Message-Id: <20060223191620.9620D483F6A@tomas.elvandar.org>
Date: Thu, 23 Feb 2006 19:16:20 +0000 (UTC)
From: Daniel Gerzo <danger@rulez.sk>
Reply-To: Daniel Gerzo <danger@rulez.sk>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [patch] addition to firewalls section - ipfw
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         93764
>Category:       docs
>Synopsis:       [patch] addition to firewalls section - ipfw
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    danger
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          doc-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Feb 23 19:20:04 GMT 2006
>Closed-Date:    Sat Aug 26 00:14:22 GMT 2006
>Last-Modified:  Sat Aug 26 00:14:22 GMT 2006
>Originator:     Daniel Gerzo
>Release:        FreeBSD 6.1-PRERELEASE i386
>Organization:
rulez.sk
>Environment:
System: FreeBSD 6.1-PRERELEASE #0: Wed Feb 15 02:22:30 CET 2006 root@redqueen.elvandar.org:/usr/obj/usr/src/sys/REDQUEEN i386
>Description:
>How-To-Repeat:
>Fix:

--- ipfw.diff begins here ---
--- /usr/home/danger/doc/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml.orig	Wed Feb 15 18:10:07 2006
+++ /usr/home/danger/doc/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml	Wed Feb 22 10:00:23 2006
@@ -2283,7 +2283,50 @@
 
       <para>Set the script to run to activate your rules:</para>
 
-      <programlisting>firewall_script="/etc/ipfw.rules"</programlisting>
+      <programlisting>firewall_script="/etc/rc.firewall"</programlisting>
+
+      <para>Set the type of firewall.  This enables a simple pre-set
+	ruleset for <application>IPFW</application>:</para>
+      
+      <programlisting>firewall_type="open"</programlisting>
+
+      <para>Available values for this setting are:</para>
+
+      <itemizedlist>
+	<listitem>
+	  <para><literal>open</literal> &mdash; allow anyone in.</para>
+	</listitem>
+	<listitem>
+	  <para><literal>client</literal> &mdash; will protect only this
+	    machine.</para>
+	</listitem>
+	<listitem>
+	  <para><literal>simple</literal> &mdash; protect the whole
+	    network.</para>
+	</listitem>
+	<listitem>
+	  <para><literal>closed</literal> &mdash; entirely disables IP
+	    services except via lo0 interface.</para>
+	</listitem>
+	<listitem>
+	  <para><literal>UNKNOWN</literal> &mdash; disables the loading
+	    of firewall rules.</para>
+	</listitem>
+	<listitem>
+	  <para><replaceable>filename</replaceable> &mdash; will load the rules
+	    in the given filename (full path required).</para>
+	</listitem>
+      </itemizedlist>
+
+      <note>
+	<para>If <literal>firewall_type</literal> is set either to
+	  <literal>client</literal> or <literal>simple</literal>, the
+	  default rules found in <filename>/etc/rc.firewall</filename>
+	  should be reviewed to fit to the setup of the given machine.
+	  Also note, that the examples used in this chapter expect that
+	  the <literal>firewall_type</literal> is set to
+	  <filename>/etc/ipfw.rules</filename>.</para>
+      </note>
 
       <para>Enable logging:</para>
 
--- ipfw.diff ends here ---
>Release-Note:
>Audit-Trail:

From: Ceri Davies <ceri@submonkey.net>
To: Daniel Gerzo <danger@rulez.sk>,
	<FreeBSD-gnats-submit@FreeBSD.org>
Cc:  
Subject: Re: docs/93764: [patch] addition to firewalls section - ipfw
Date: Fri, 24 Feb 2006 10:52:24 +0000

 On 23/2/06 19:16, "Daniel Gerzo" <danger@rulez.sk> wrote:
 
 Daniel,
 
 Welcome to your first proper review by me.  We hope that you don't squirm
 too much. :)
 
 > @@ -2283,7 +2283,50 @@
 >  
 >        <para>Set the script to run to activate your rules:</para>
 >  
 > -      <programlisting>firewall_script="/etc/ipfw.rules"</programlisting>
 > +      <programlisting>firewall_script="/etc/rc.firewall"</programlisting>
 
 That's the default, so perhaps we can get away with not specifying this all.
 
 > +
 > +      <para>Set the type of firewall.  This enables a simple pre-set
 > + ruleset for <application>IPFW</application>:</para>
 > +      
 > +      <programlisting>firewall_type="open"</programlisting>
 > +
 > +      <para>Available values for this setting are:</para>
 
 This is the handbook.  We can get away with an actual paragraph explaining
 this pre-set ruleset thing.  I think that the above is too brief and
 presupposes that I know what you're saying already.
 
 
 > +      <itemizedlist>
 > + <listitem>
 > +   <para><literal>open</literal> &mdash; allow anyone in.</para>
 > + </listitem>
 
 That text isn't good.  "Pass all traffic" perhaps?
 
 > + <listitem>
 > +   <para><literal>client</literal> &mdash; will protect only this
 > +     machine.</para>
 > + </listitem>
 > + <listitem>
 > +   <para><literal>simple</literal> &mdash; protect the whole
 > +     network.</para>
 
 Do what now?  So I can run this on a FreeBSD machine and do without a
 firewall?  Sweet!  Seriously though, "protect the whole network" is
 misleading in the absence of context.
 
 > + </listitem>
 > + <listitem>
 > +   <para><literal>closed</literal> &mdash; entirely disables IP
 > +     services except via lo0 interface.</para>
 
 s/services/traffic/, s/via/via the/
 
 > + </listitem>
 > + <listitem>
 > +   <para><literal>UNKNOWN</literal> &mdash; disables the loading
 > +     of firewall rules.</para>
 > + </listitem>
 > + <listitem>
 > +   <para><replaceable>filename</replaceable> &mdash; will load the rules
 > +     in the given filename (full path required).</para>
 
 s/full/absolute/
 
 > + </listitem>
 > +      </itemizedlist>
 > +
 > +      <note>
 > + <para>If <literal>firewall_type</literal> is set either to
 > +   <literal>client</literal> or <literal>simple</literal>, the
 > +   default rules found in <filename>/etc/rc.firewall</filename>
 > +   should be reviewed to fit to the setup of the given machine.
 
 Try to avoid the word "setup" if you can.  Try one of "purpose",
 "configuration", "services", "function", etc.
 
 > +   Also note, that the examples used in this chapter expect that
 
 That comma doesn't belong there.
 
 > +   the <literal>firewall_type</literal> is set to
 > +   <filename>/etc/ipfw.rules</filename>.</para>
 > +      </note>
 
 Ceri
 -- 
 That must be wonderful!  I don't understand it at all.
                                       -- Moliere
 
 
 
Responsible-Changed-From-To: freebsd-doc->jcamou  
Responsible-Changed-By: jcamou 
Responsible-Changed-When: Fri Mar 3 14:30:50 UTC 2006 
Responsible-Changed-Why:  
Grab pr. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=93764 
Responsible-Changed-From-To: jcamou->danger  
Responsible-Changed-By: jcamou 
Responsible-Changed-When: Mon Aug 21 13:37:51 UTC 2006 
Responsible-Changed-Why:  
Over to submitter now that he's got a commit bit. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=93764 
State-Changed-From-To: open->closed 
State-Changed-By: danger 
State-Changed-When: Fri Aug 25 23:55:03 UTC 2006 
State-Changed-Why:  
I commited a slightly modified diff into our tree. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=93764 
>Unformatted:
