Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/etc/rc.d/pf_boot

38 lines
676 B
Plaintext
Raw Normal View History

pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security
2005-08-23 16:12:56 +04:00
#!/bin/sh
#
Remove LKMs and switch to the module framework, pass 1. Proposed on tech-kern@.
2008-11-12 15:35:50 +03:00
# $NetBSD: pf_boot,v 1.3 2008/11/12 12:35:52 ad Exp $
pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security
2005-08-23 16:12:56 +04:00
#
# PROVIDE: pf_boot
Remove LKMs and switch to the module framework, pass 1. Proposed on tech-kern@.
2008-11-12 15:35:50 +03:00
# REQUIRE: root mountcritlocal tty
pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security
2005-08-23 16:12:56 +04:00
# BEFORE: network
$_rc_subr_loaded . /etc/rc.subr
name="pf_boot"
rcvar="pf"
start_cmd="pf_boot_start"
stop_cmd=":"
pf_boot_start()
{
if [ "$autoboot" != "yes" ]; then
err 1 "This script should only be executed at boot time."
fi
if [ -f /etc/pf.boot.conf ]; then
/sbin/pfctl -q -f /etc/pf.boot.conf
elif [ -f /etc/defaults/pf.boot.conf ]; then
/sbin/pfctl -q -f /etc/defaults/pf.boot.conf
else
warn "can't load initial pf rules; pf start aborted."
* Add a stop_boot() function in rc.subr, to terminate a multi-user boot by killing the parent process. The parent's PID is saved in $RC_PID. * In all rc.d/* scripts that previously tried to stop the boot, replace in-line code with "stop_boot". * Document this. This should fix PR 29822.
2007-04-06 18:20:08 +04:00
stop_boot
pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security
2005-08-23 16:12:56 +04:00
exit 1
fi
/sbin/pfctl -q -e
}
load_rc_config $name
run_rc_command "$1"