The NetBSD Project

CVS log for src/etc/rc.d/pf

[BACK] Up to [cvs.netbsd.org] / src / etc / rc.d

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.9.8.1 / (download) - annotate - [select for diffs], Tue Apr 17 00:02:59 2012 UTC (5 weeks, 4 days ago) by yamt
Branch: yamt-pagecache
Changes since 1.9: +6 -6 lines
Diff to previous 1.9 (colored) next main 1.10 (colored)

sync with head

Revision 1.10 / (download) - annotate - [select for diffs], Mon Nov 21 20:56:21 2011 UTC (6 months ago) by darcy
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, netbsd-6-base, netbsd-6, HEAD
Changes since 1.9: +6 -6 lines
Diff to previous 1.9 (colored)

Allow pf flags to be specified in rc.conf.
Add default to defaults/rc.d as suggested by lukem@

Revision 1.7.12.1 / (download) - annotate - [select for diffs], Sat Jan 17 20:43:44 2009 UTC (3 years, 4 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored) next main 1.8 (colored)

Sync with HEAD.

Revision 1.9 / (download) - annotate - [select for diffs], Sat Nov 22 20:23:33 2008 UTC (3 years, 6 months ago) by tsutsui
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, mjf-devfs2-base2, matt-premerge-20091211, matt-mips64-premerge-20101231, jym-xensuspend-nbase, jym-xensuspend-base, jym-xensuspend, cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2
Branch point for: yamt-pagecache
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored)

Add "bootconf" to REQUIRE: lines which had beforenetlkm
since removed beforenetlkm required bootconf.

Revision 1.8 / (download) - annotate - [select for diffs], Wed Nov 12 12:35:52 2008 UTC (3 years, 6 months ago) by ad
Branch: MAIN
Changes since 1.7: +2 -2 lines
Diff to previous 1.7 (colored)

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

Revision 1.7 / (download) - annotate - [select for diffs], Fri Apr 6 14:20:18 2007 UTC (5 years, 1 month ago) by apb
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-pf42-base, yamt-pf42, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, wrstuden-revivesa, netbsd-5-base, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, netbsd-5, mjf-devfs2-base, mjf-devfs-base, mjf-devfs, matt-nb5-pq3-base, matt-nb5-pq3, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-premerge-20091211, matt-nb5-mips64-k15, matt-nb5-mips64, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, matt-armv6-nbase, matt-armv6-base, matt-armv6, keiichi-mipv6-base, keiichi-mipv6, hpcarm-cleanup-nbase, hpcarm-cleanup-base, hpcarm-cleanup, cube-autoconf-base, cube-autoconf
Branch point for: mjf-devfs2
Changes since 1.6: +2 -8 lines
Diff to previous 1.6 (colored)

* Add a stop_boot() function in rc.subr, to terminate a multi-user boot
  by killing the parent process.  The parent's PID is saved in $RC_PID.
* In all rc.d/* scripts that previously tried to stop the boot,
  replace in-line code with "stop_boot".
* Document this.

This should fix PR 29822.

Revision 1.3.2.3 / (download) - annotate - [select for diffs], Fri Sep 2 12:29:37 2005 UTC (6 years, 8 months ago) by tron
Branch: netbsd-3
CVS Tags: netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-1, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, netbsd-3-0
Changes since 1.3.2.2: +8 -3 lines
Diff to previous 1.3.2.2 (colored) to branchpoint 1.3 (colored) next main 1.4 (colored)

Pull up following revision(s) (requested by peter in ticket #717):
	usr.sbin/pf/man/man5/pf.boot.conf.5: revision 1.1
	usr.sbin/postinstall/postinstall: revision 1.4
	etc/rc.d/pf: revision 1.6
	etc/rc.d/pf_boot: revision 1.1
	usr.sbin/pf/etc/defaults/pf.boot.conf: revision 1.1
	usr.sbin/pf/Makefile: revision 1.7
	etc/rc.d/Makefile: revision 1.52
	etc/mtree/special: revision 1.89
	usr.sbin/pf/man/man5/Makefile: revision 1.5
	usr.sbin/pf/etc/defaults/Makefile: revision 1.1
pf needs to be started after the network is up, because some pf rules
derive IP address(es) from the interface (e.g "... from any to fxp0").
This however, creates window for possible attacks from the network.
Implement the solution proposed by YAMAMOTO Takashi:
Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot
script before starting the network. People who don't like the default
rules can override it with their own /etc/pf.boot.conf.
The default rules have been obtained from OpenBSD.
No objections on: tech-security

Revision 1.3.2.2 / (download) - annotate - [select for diffs], Fri Sep 2 12:19:27 2005 UTC (6 years, 8 months ago) by tron
Branch: netbsd-3
Changes since 1.3.2.1: +20 -2 lines
Diff to previous 1.3.2.1 (colored) to branchpoint 1.3 (colored)

Pull up following revision(s) (requested by peter in ticket #717):
	etc/rc.d/pf: revision 1.5
Changes suggested by lukem:
1. Order pf to start before the network is configured.
2. If the pf_rules cannot be found at boot time, abort the boot (from the
   ipfilter script).

Revision 1.6 / (download) - annotate - [select for diffs], Tue Aug 23 12:12:56 2005 UTC (6 years, 9 months ago) by peter
Branch: MAIN
CVS Tags: wrstuden-fixsa-newbase, wrstuden-fixsa-base-1, wrstuden-fixsa-base, wrstuden-fixsa, netbsd-4-base, netbsd-4-0-RELEASE, netbsd-4-0-RC5, netbsd-4-0-RC4, netbsd-4-0-RC3, netbsd-4-0-RC2, netbsd-4-0-RC1, netbsd-4-0-1-RELEASE, netbsd-4-0, netbsd-4, abandoned-netbsd-4-base, abandoned-netbsd-4
Changes since 1.5: +9 -4 lines
Diff to previous 1.5 (colored)

pf needs to be started after the network is up, because some pf rules
derive IP address(es) from the interface (e.g "... from any to fxp0").
This however, creates window for possible attacks from the network.

Implement the solution proposed by YAMAMOTO Takashi:
Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot
script before starting the network. People who don't like the default
rules can override it with their own /etc/pf.boot.conf.
The default rules have been obtained from OpenBSD.

No objections on: tech-security

Revision 1.3.2.1 / (download) - annotate - [select for diffs], Mon Aug 15 19:02:49 2005 UTC (6 years, 9 months ago) by tron
Branch: netbsd-3
Changes since 1.3: +7 -7 lines
Diff to previous 1.3 (colored)

Pull up revision 1.4 (requested by peter in ticket #660):
Allow to change the location of the pf ruleset with the variable $pf_rules.

Revision 1.5 / (download) - annotate - [select for diffs], Wed Aug 10 13:52:05 2005 UTC (6 years, 9 months ago) by peter
Branch: MAIN
Changes since 1.4: +21 -3 lines
Diff to previous 1.4 (colored)

Changes suggested by lukem:

1. Order pf to start before the network is configured.

2. If the pf_rules cannot be found at boot time, abort the boot (from the
   ipfilter script).

Revision 1.4 / (download) - annotate - [select for diffs], Sun Aug 7 01:03:39 2005 UTC (6 years, 9 months ago) by peter
Branch: MAIN
Changes since 1.3: +7 -7 lines
Diff to previous 1.3 (colored)

Allow to change the location of the pf ruleset with the variable $pf_rules.

Revision 1.3 / (download) - annotate - [select for diffs], Tue Mar 15 18:22:03 2005 UTC (7 years, 2 months ago) by peter
Branch: MAIN
CVS Tags: netbsd-3-base
Branch point for: netbsd-3
Changes since 1.2: +2 -2 lines
Diff to previous 1.2 (colored)

Do a "flush all" when disabling pf.  This also changes the restart case
to do a "flush all", while the reload case will only reload the rules without
flushing anything.

Suggested by Miles Nordin.

Revision 1.2 / (download) - annotate - [select for diffs], Fri Aug 13 18:08:03 2004 UTC (7 years, 9 months ago) by mycroft
Branch: MAIN
Changes since 1.1: +2 -2 lines
Diff to previous 1.1 (colored)

Add an _rc_subr_loaded variable, set to ":" by rc.subr.  Scripts can use this
for a speedup by doing:
$_rc_subr_loaded . /etc/rc.subr

Revision 1.1 / (download) - annotate - [select for diffs], Tue Jun 29 04:48:28 2004 UTC (7 years, 10 months ago) by itojun
Branch: MAIN

rc.d fragment for PF.  Peter Postma

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>