From fuyuki@hadaly.org  Thu Mar 20 16:14:39 2003
Return-Path: <fuyuki@hadaly.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 355CC37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 20 Mar 2003 16:14:39 -0800 (PST)
Received: from t-mta7.odn.ne.jp (mfep7.odn.ne.jp [143.90.131.185])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 277DE43F93
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 20 Mar 2003 16:14:38 -0800 (PST)
	(envelope-from fuyuki@hadaly.org)
Received: from hadaly.dyndns.org ([61.123.32.121]) by t-mta7.odn.ne.jp
          with ESMTP
          id <20030321001437180.KVHO.21631.t-mta7.odn.ne.jp@mta7.odn.ne.jp>
          for <FreeBSD-gnats-submit@freebsd.org>;
          Fri, 21 Mar 2003 09:14:37 +0900
Received: from hadaly.dyndns.org (localhost [127.0.0.1])
	by hadaly.dyndns.org (Postfix) with ESMTP id 34A7420C0
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 21 Mar 2003 09:14:36 +0900 (JST)
Message-Id: <867katr2xg.wl%fuyuki@hadaly.org>
Date: Fri, 21 Mar 2003 09:14:35 +0900
From: Kimura Fuyuki <fuyuki@hadaly.org>
To: FreeBSD-gnats-submit@freebsd.org
Subject: Add /etc/periodic/security/610.ipf6denied

>Number:         50154
>Category:       misc
>Synopsis:       Add /etc/periodic/security/610.ipf6denied
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    darrenr
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar 20 16:20:04 PST 2003
>Closed-Date:    Tue Apr 20 06:45:31 PDT 2004
>Last-Modified:  Tue Apr 20 06:45:31 PDT 2004
>Originator:     Kimura Fuyuki
>Release:        FreeBSD 5.0-RELEASE-p4 i386
>Organization:
>Environment:
System: FreeBSD hadaly.dyndns.org 5.0-RELEASE-p4 FreeBSD 5.0-RELEASE-p4 #2: Fri Mar 7 13:26:51 JST 2003 root@hadaly.dyndns.org:/.2/obj/usr/src/sys/NS i386


	
>Description:
Please add /etc/periodic/security/610.ipf6denied. This is very natural
because we have

- ipv6_ipfilter_rules (rc.conf option)
- 500.ipfwdenied
- 510.ipfdenied
- 600.ip6fwdenied
	
>How-To-Repeat:
	
>Fix:
diff -ruN etc.orig/defaults/periodic.conf etc/defaults/periodic.conf
--- etc.orig/defaults/periodic.conf	Fri Mar 21 09:02:57 2003
+++ etc/defaults/periodic.conf	Thu Mar 20 12:59:50 2003
@@ -165,6 +166,9 @@
 
 # 600.ip6fwdenied
 daily_status_security_ip6fwdenied_enable="YES"
+
+# 610.ipf6denied
+daily_status_security_ipf6denied_enable="YES"
 
 # 650.ip6fwlimit
 daily_status_security_ip6fwlimit_enable="YES"
diff -ruN etc.orig/periodic/security/610.ipf6denied etc/periodic/security/610.ipf6denied
--- etc.orig/periodic/security/610.ipf6denied	Thu Jan  1 09:00:00 1970
+++ etc/periodic/security/610.ipf6denied	Tue Mar 18 12:39:29 2003
@@ -0,0 +1,53 @@
+#!/bin/sh -
+#
+# Copyright (c) 2001  The FreeBSD Project
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+# $FreeBSD$
+#
+
+# If there is a global system configuration file, suck it in.
+#
+if [ -r /etc/defaults/periodic.conf ]
+then
+    . /etc/defaults/periodic.conf
+    source_periodic_confs
+fi
+
+. /etc/periodic/security/security.functions
+
+rc=0
+
+case "$daily_status_security_ipf6denied_enable" in
+    [Yy][Ee][Ss])
+	TMP=`mktemp ${TMPDIR:-/tmp}/security.XXXXXXXXXX`
+	if ipfstat -nhio6 2>/dev/null | grep block > ${TMP}; then
+	  check_diff new_only ipf6 ${TMP} "${host} ipf6 denied packets:"
+	fi
+	rc=$?
+	rm -f ${TMP};;
+    *)	rc=0;;
+esac
+
+exit $rc
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->darrenr 
Responsible-Changed-By: kris 
Responsible-Changed-When: Mon Jul 14 04:44:04 PDT 2003 
Responsible-Changed-Why:  
Assign to ipfilter author 

http://www.freebsd.org/cgi/query-pr.cgi?pr=50154 
State-Changed-From-To: open->closed 
State-Changed-By: darrenr 
State-Changed-When: Tue Apr 20 06:43:58 PDT 2004 
State-Changed-Why:  
patches merged from pr to -curent 

http://www.freebsd.org/cgi/query-pr.cgi?pr=50154 
>Unformatted:
