Date: Thu, 8 Oct 2020 19:17:51 -0700 (PDT) From: "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net> To: Pawel Biernacki <kaktus@freebsd.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r366537 - head/libexec/rc/rc.d Message-ID: <202010090217.0992HpT9009694@gndrsh.dnsmgr.net> In-Reply-To: <202010081145.098BjBun018733@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> Author: kaktus > Date: Thu Oct 8 11:45:10 2020 > New Revision: 366537 > URL: https://svnweb.freebsd.org/changeset/base/366537 > > Log: > [pf] /etc/rc.d/pf should REQUIRE routing > > When a system with pf_enable="YES" in /etc/rc.conf uses hostnames in > /etc/pf.conf, these hostnames cannot be resolved via external nameservers > because the default route is not yet set. This results in an empty > (all open) ruleset. Use of hostnames in pf, or any firewall for that mater tends to make my hair stand on end, unless those hostnames resolve via /etc/hosts or a link local resolver. > > Since r195026 already put netif back to REQUIRE, this change does not affect > the issue that the firewall should rather have been setup before any > network traffic can occur. This well cause any system that requires pf rules before routing can work to fail, aka almost any real router running a real routing protocol well now fail or have issues during route daemon start up as without firewall rules the default is to deny the routing protocol packets. This should be reverted, or at least made knobable in some way. > > PR: 211928 > Submitted by: Robert Schulze > Reported by: Robert Schulze > Tested by: Mateusz Kwiatkowski > No objections from: kp > MFC after: 3 days > > Modified: > head/libexec/rc/rc.d/pf > > Modified: head/libexec/rc/rc.d/pf > ============================================================================== > --- head/libexec/rc/rc.d/pf Thu Oct 8 11:30:22 2020 (r366536) > +++ head/libexec/rc/rc.d/pf Thu Oct 8 11:45:10 2020 (r366537) > @@ -4,8 +4,7 @@ > # > > # PROVIDE: pf > -# REQUIRE: FILESYSTEMS netif pflog pfsync > -# BEFORE: routing > +# REQUIRE: FILESYSTEMS netif pflog pfsync routing > # KEYWORD: nojailvnet > > . /etc/rc.subr > -- Rod Grimes rgrimes@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202010090217.0992HpT9009694>