Date: Mon, 17 Jul 2006 08:22:53 +1200 From: Andrew Thompson <thompsa@freebsd.org> To: Ari Suutari <ari@suutari.iki.fi> Cc: freebsd-security@freebsd.org, freebsd-pf@freebsd.org Subject: Re: Any ongoing effort to port /etc/rc.d/pf_boot, /etc/pf.boot.conf from NetBSD ? Message-ID: <20060716202253.GF29207@heff.fud.org.nz> In-Reply-To: <44BA9ECA.6090607@suutari.iki.fi> References: <44B7715E.8050906@suutari.iki.fi> <20060714154729.GA8616@psconsult.nl> <44B7D8B8.3090403@suutari.iki.fi> <20060716182315.GC3240@insomnia.benzedrine.cx> <44BA8A95.10300@suutari.iki.fi> <20060716191732.GD3240@insomnia.benzedrine.cx> <44BA9ECA.6090607@suutari.iki.fi>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jul 16, 2006 at 11:17:14PM +0300, Ari Suutari wrote:
> Hi,
>
>
> Daniel Hartmeier wrote:
> >You claimed there was a hole. If you can't explain what it consists of
> >("thing X might get exposed prior to rc.d/pf due to the following
> >sequence of events..."),
>
>
> On FreeBSD 6.1, run rcorder /etc/rc.d/*. You'll notice that
> pf is run after netif so if one is using only pf as firewall,
> there is a window between run of "netif" and "pf" where network
> interfaces are up but there is no firewall loaded. Adding
> pf_boot, which runs before "netif" would fix this, woudn't it ?
But.. pf runs before any userland daemons are loaded so how does it
matter if there is a short window between netif and pf if nothing is
listening?
Andrew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060716202253.GF29207>