firewall.local

firewall.local

[Bob Brewer]

[-- Attachment #1: Type: text/plain, Size: 1843 bytes --]

I have a comprehensive blocklist which is loaded and unloaded from 
/etc/sysconfig/firewall.local by a script (blacklist.sh) at startup which 
creates drop rules in the CUSTOMFORWARD and CUSTOMINPUT tables.

*********************************************
!/bin/sh
# Used for private firewall rules

# See how we were called.
case "$1" in
  start)
        ## add your 'start' rules here

        /usr/local/bin/blacklist.sh INPUT append
        ;;
  stop)
        ## add your 'stop' rules here

        /usr/local/bin/blacklist.sh INPUT delete
        ;;
  reload)
        $0 stop
        $0 start
        ## add your 'reload' rules here
        ;;
  *)
        echo "Usage: $0 {start|stop|reload}"
        ;;
esac
*********************************************

It would appear that firewall.local script is called from 
/usr/lib/firewall/rules.pl with

        #Reload firewall.local if present
        if ( -f '/etc/sysconfig/firewall.local'){
                run("/etc/sysconfig/firewall.local reload");

which calls "reload" to the firewall.local script which at boot first runs 
"stop" and tries to unload the blacklist firewall rules before they have 
been created causing many errors to be generated in the logs before the 
rules are then created with "start".

Changing rules.pl to:

run("/etc/sysconfig/firewall.local start");

overcomes the boot problem but I can't then find out how my blacklist rules 
would then be deleted and potentially multiple copies of the blacklist rules 
being created.

Maybe I don't fully understand the way the firewall.local rules are 
controlled but to me there does seem to be an illogical way that the rules 
are created and deleted by firewall.local. 

To me it looks like a bug but if I have understood the process incorrectly, 
I would appreciate an explanation of the process.

Regards

Rob