6 Commits

Author	SHA1	Message	Date
peter	9c1da17e90	pf needs to be started after the network is up, because some pf rules ... derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security	2005-08-23 12:12:56 +00:00
peter	ad9c34ce5c	Changes suggested by lukem: ... 1. Order pf to start before the network is configured. 2. If the pf_rules cannot be found at boot time, abort the boot (from the ipfilter script).	2005-08-10 13:52:05 +00:00
peter	d0b18db569	Allow to change the location of the pf ruleset with the variable $pf_rules.	2005-08-07 01:03:39 +00:00
peter	80f533ce07	Do a "flush all" when disabling pf. This also changes the restart case ... to do a "flush all", while the reload case will only reload the rules without flushing anything. Suggested by Miles Nordin.	2005-03-15 18:22:03 +00:00
mycroft	7d2e1537c5	Add an _rc_subr_loaded variable, set to ":" by rc.subr. Scripts can use this ... for a speedup by doing: $_rc_subr_loaded . /etc/rc.subr	2004-08-13 18:08:03 +00:00
itojun	de1993c88e	rc.d fragment for PF. Peter Postma	2004-06-29 04:48:28 +00:00