From 5d7dc80481399c6a5fc6f53f9dacd5ea6b86104d Mon Sep 17 00:00:00 2001 From: Roland Smith Date: Mon, 27 Apr 2015 11:32:09 +0200 Subject: [PATCH 1/3] Initial version of IPFW test (FreeBSD). --- include/tests_firewalls | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index 5a529d35..1d3a7061 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -274,7 +274,24 @@ ################################################################################# # # Test : FIRE-4530 - # Description : Check ipfw + # Description : Check ipfw (FreeBSD) + Register --test-no FIRE-4530 --os FreeBSD --weight L --network NO --description "Check ipfw status" + if [ ! "${SYSCTLBINARY}" = "" ]; then + # For now, only check for IPv4. + FIND=`${SYSCTLBINARY} net.inet.ip.fw.enable | awk '{ print $2 }'` + if [ "${FIND}" = "1" ]; then + Display --indent 4 --text "- Checking ipfw status" --result RUNNING --color GREEN + logtext "Result: ipfw is enabled and running for IPv4" + FIREWALL_ACTIVE=1 + FIREWALL_SOFTWARE="ipfw" + else + Display --indent 4 --text "- Checking ipfw status" --result "NOT RUNNING" --color YELLOW + logtext "Result: ipfw is not running for IPv4" + fi + else + Display --indent 2 --text "- Checking ipfw" --result SKIPPED --color YELLOW + ReportException "${TEST_NO}:4" "No IPFW test available (sysctl missing)" + fi # ################################################################################# # From ded7e95a14207bec2206ae3a896cae074daf87a8 Mon Sep 17 00:00:00 2001 From: Roland Smith Date: Mon, 27 Apr 2015 12:00:58 +0200 Subject: [PATCH 2/3] Check if ipfw is enabled in rc.conf. --- include/tests_firewalls | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index 1d3a7061..3e23fb95 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -280,12 +280,20 @@ # For now, only check for IPv4. FIND=`${SYSCTLBINARY} net.inet.ip.fw.enable | awk '{ print $2 }'` if [ "${FIND}" = "1" ]; then - Display --indent 4 --text "- Checking ipfw status" --result RUNNING --color GREEN - logtext "Result: ipfw is enabled and running for IPv4" + Display --indent 2 --text "- Checking ipfw status" --result RUNNING --color GREEN + logtext "Result: ipfw is running for IPv4" FIREWALL_ACTIVE=1 FIREWALL_SOFTWARE="ipfw" + IPFW_ENABLED=`service -e | grep -o ipfw` + if [ "${IPFW_ENABLED}" = "ipfw" ]; then + Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result YES --color GREEN + logtext "Result: ipfw is enabled at start-up for IPv4" + else + Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result NO --color YELLOW + logtext "Result: ipfw is disabled at start-up for IPv4" + fi else - Display --indent 4 --text "- Checking ipfw status" --result "NOT RUNNING" --color YELLOW + Display --indent 2 --text "- Checking ipfw status" --result "NOT RUNNING" --color YELLOW logtext "Result: ipfw is not running for IPv4" fi else From a0b20fcfe352a913054f3ba95d660142c69402ec Mon Sep 17 00:00:00 2001 From: Roland Smith Date: Mon, 27 Apr 2015 18:26:39 +0200 Subject: [PATCH 3/3] Wrap ipfw test in SKIPTEST block. --- include/tests_firewalls | 42 +++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index 3e23fb95..28143f1f 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -276,29 +276,31 @@ # Test : FIRE-4530 # Description : Check ipfw (FreeBSD) Register --test-no FIRE-4530 --os FreeBSD --weight L --network NO --description "Check ipfw status" - if [ ! "${SYSCTLBINARY}" = "" ]; then - # For now, only check for IPv4. - FIND=`${SYSCTLBINARY} net.inet.ip.fw.enable | awk '{ print $2 }'` - if [ "${FIND}" = "1" ]; then - Display --indent 2 --text "- Checking ipfw status" --result RUNNING --color GREEN - logtext "Result: ipfw is running for IPv4" - FIREWALL_ACTIVE=1 - FIREWALL_SOFTWARE="ipfw" - IPFW_ENABLED=`service -e | grep -o ipfw` - if [ "${IPFW_ENABLED}" = "ipfw" ]; then - Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result YES --color GREEN - logtext "Result: ipfw is enabled at start-up for IPv4" + if [ ${SKIPTEST} -eq 0 ]; then + if [ ! "${SYSCTLBINARY}" = "" ]; then + # For now, only check for IPv4. + FIND=`${SYSCTLBINARY} net.inet.ip.fw.enable | awk '{ print $2 }'` + if [ "${FIND}" = "1" ]; then + Display --indent 2 --text "- Checking ipfw status" --result RUNNING --color GREEN + logtext "Result: ipfw is running for IPv4" + FIREWALL_ACTIVE=1 + FIREWALL_SOFTWARE="ipfw" + IPFW_ENABLED=`service -e | grep -o ipfw` + if [ "${IPFW_ENABLED}" = "ipfw" ]; then + Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result YES --color GREEN + logtext "Result: ipfw is enabled at start-up for IPv4" + else + Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result NO --color YELLOW + logtext "Result: ipfw is disabled at start-up for IPv4" + fi else - Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result NO --color YELLOW - logtext "Result: ipfw is disabled at start-up for IPv4" + Display --indent 2 --text "- Checking ipfw status" --result "NOT RUNNING" --color YELLOW + logtext "Result: ipfw is not running for IPv4" fi - else - Display --indent 2 --text "- Checking ipfw status" --result "NOT RUNNING" --color YELLOW - logtext "Result: ipfw is not running for IPv4" + else + Display --indent 2 --text "- Checking ipfw" --result SKIPPED --color YELLOW + ReportException "${TEST_NO}:4" "No IPFW test available (sysctl missing)" fi - else - Display --indent 2 --text "- Checking ipfw" --result SKIPPED --color YELLOW - ReportException "${TEST_NO}:4" "No IPFW test available (sysctl missing)" fi # #################################################################################