Date: Mon, 17 Jul 2006 00:16:57 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Cc: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no>, freebsd-security@freebsd.org Subject: Re: Any ongoing effort to port /etc/rc.d/pf_boot, /etc/pf.boot.conf from NetBSD ? Message-ID: <200607170017.05241.max@love2party.net> In-Reply-To: <20060716214456.GE3240@insomnia.benzedrine.cx> References: <44B7715E.8050906@suutari.iki.fi> <86y7utgt0o.fsf@xps.des.no> <20060716214456.GE3240@insomnia.benzedrine.cx>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1233698.PquWgbKCin
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Sunday 16 July 2006 23:44, Daniel Hartmeier wrote:
> On Sun, Jul 16, 2006 at 11:05:27PM +0200, Dag-Erling Sm=F8rgrav wrote:
> > > Hence, a "default block" switch or compile time option _within_ pf is
> > > not going to make any difference.
> >
> > Sure it will, if pf is compiled into the kernel or loaded by the BTX
> > loader.
>
> Ok, in that case I guess you want to enable pf by default, too.
>
> I haven't tried it in this mode, but the default block can be achieved
> by simply changing sys/contrib/pf/pf_ioctl.c pf_attach()
>
> - pf_default_rule.action =3D PF_PASS;
> + pf_default_rule.action =3D PF_DROP;
>
> bzero(&pf_status, sizeof(pf_status));
> + pf_status.running =3D 1;
You will also need this (just one line below):
pf_pfil_hooked =3D 0;
+ error =3D hook_pf();
+ if (error || !pf_pfil_hooked)
+ panic("Unable to protect you from the scary internet!");
> That would then block all packets on all interfaces, until a ruleset is
> loaded. If anything started through the startup scripts needs unblocked
> packets (including the production ruleset loading requiring name
> resolution over network), you'd need to first load a simpler temporary
> ruleset to pass that, and finally replace it with the production
> ruleset.
>
> And, of course, if the boot sequence for any reason doesn't reach that
> point, you can only fix stuff with local access... :)
>
> I'm not sure the average user _really_ is worried enough about that
> half a second period on boot. But I DO know there will be people locking
> themselves out from far-away remote hosts (on updates, for instance) if
> this becomes the default.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1233698.PquWgbKCin
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (FreeBSD)
iD8DBQBEurrhXyyEoT62BG0RAgAnAJ9d4AeS7swmGE9FeY9KeouULCvfBwCeJ7wq
CvP7kzmkx0Ek/ateDa039dg=
=pQS2
-----END PGP SIGNATURE-----
--nextPart1233698.PquWgbKCin--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607170017.05241.max>