Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
170,037 Commits 606 Branches 0 Tags 3.1 GiB
Commit Graph

7 Commits

Author SHA1 Message Date
apb 31edfc6f0f * Add a stop_boot() function in rc.subr, to terminate a multi-user boot 
by killing the parent process.  The parent's PID is saved in $RC_PID.
* In all rc.d/* scripts that previously tried to stop the boot,
  replace in-line code with "stop_boot".
* Document this.

This should fix PR 29822.
 2007-04-06 14:20:08 +00:00
peter 9c1da17e90 pf needs to be started after the network is up, because some pf rules 
derive IP address(es) from the interface (e.g "... from any to fxp0").
This however, creates window for possible attacks from the network.

Implement the solution proposed by YAMAMOTO Takashi:
Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot
script before starting the network. People who don't like the default
rules can override it with their own /etc/pf.boot.conf.
The default rules have been obtained from OpenBSD.

No objections on: tech-security
 2005-08-23 12:12:56 +00:00
peter ad9c34ce5c Changes suggested by lukem: 
1. Order pf to start before the network is configured.

2. If the pf_rules cannot be found at boot time, abort the boot (from the
   ipfilter script).
 2005-08-10 13:52:05 +00:00
peter d0b18db569 Allow to change the location of the pf ruleset with the variable $pf_rules. 2005-08-07 01:03:39 +00:00
peter 80f533ce07 Do a "flush all" when disabling pf. This also changes the restart case 
to do a "flush all", while the reload case will only reload the rules without
flushing anything.

Suggested by Miles Nordin.
 2005-03-15 18:22:03 +00:00
mycroft 7d2e1537c5 Add an _rc_subr_loaded variable, set to ":" by rc.subr. Scripts can use this 
for a speedup by doing:
$_rc_subr_loaded . /etc/rc.subr
 2004-08-13 18:08:03 +00:00
itojun de1993c88e rc.d fragment for PF. Peter Postma 2004-06-29 04:48:28 +00:00