From 5511dd203b05a6589083674078932d0b2563e775 Mon Sep 17 00:00:00 2001 From: Clinton Ebadi Date: Sat, 29 Aug 2020 17:06:08 -0400 Subject: [PATCH 1/1] fwtool: allow udp/tcp for all user rules Ideally, we'd have separate tcp and udp support, but ... we need udp now (e.g. for lightweight game servers such as bzflag), and I don't want to invest more time into this code without fully refactoring it, as I've just kludged new things onto it for years. --- src/plugins/firewall.sml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/plugins/firewall.sml b/src/plugins/firewall.sml index 642379d..4c10f24 100644 --- a/src/plugins/firewall.sml +++ b/src/plugins/firewall.sml @@ -212,7 +212,7 @@ fun generateFirewallConfig rules = let val _ = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname))) in - TextIO.output (tcp_inf, "proto tcp mod comment comment \"user:" ^ uname ^ "\" {\n"); + TextIO.output (tcp_inf, "proto (tcp udp) mod comment comment \"user:" ^ uname ^ "\" {\n"); TextIO.output (tcp_inf, concat lines); TextIO.output (tcp_inf, "\n}\n\n") end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") (* no sense in opening ports for bad users *) @@ -221,7 +221,7 @@ fun generateFirewallConfig rules = let val uid = SysWord.toInt (Posix.ProcEnv.uidToWord (Posix.SysDB.Passwd.uid (Posix.SysDB.getpwnam uname))) in - TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto tcp {\n"); + TextIO.output (tcp_outf, "mod owner uid-owner " ^ (Int.toString uid) ^ " mod comment comment \"user:" ^ uname ^ "\" proto (tcp udp) {\n"); TextIO.output (tcp_outf, concat lines); TextIO.output (tcp_outf, "\nDROP;\n}\n\n") end handle OS.SysErr _ => print ("Invalid user " ^ uname ^ " in firewall config, skipping.\n") -- 2.20.1