Re: Any ongoing effort to port /etc/rc.d/pf_boot,
--nextPart1233698.PquWgbKCin
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Sunday 16 July 2006 23:44, Daniel Hartmeier wrote:
> On Sun, Jul 16, 2006 at 11:05:27PM +0200, Dag-Erling Sm=F8rgrav wrote:
> > > Hence, a "default block" switch or compile time option _within_ pf is
> > > not going to make any difference.
> >
> > Sure it will, if pf is compiled into the kernel or loaded by the BTX
> > loader.
>
> Ok, in that case I guess you want to enable pf by default, too.
>
> I haven't tried it in this mode, but the default block can be achieved
> by simply changing sys/contrib/pf/pf_ioctl.c pf_attach()
>
> - pf_default_rule.action =3D PF_PASS;
> + pf_default_rule.action =3D PF_DROP;
>
> bzero(&pf_status, sizeof(pf_status));
> + pf_status.running =3D 1;
You will also need this (just one line below):
pf_pfil_hooked =3D 0;
+ error =3D hook_pf();
+ if (error || !pf_pfil_hooked)
+ panic("Unable to protect you from the scary internet!");
> That would then block all packets on all interfaces, until a ruleset is
> loaded. If anything started through the startup scripts needs unblocked
> packets (including the production ruleset loading requiring name
> resolution over network), you'd need to first load a simpler temporary
> ruleset to pass that, and finally replace it with the production
> ruleset.
>
> And, of course, if the boot sequence for any reason doesn't reach that
> point, you can only fix stuff with local access... :)
>
> I'm not sure the average user _really_ is worried enough about that
> half a second period on boot. But I DO know there will be people locking
> themselves out from far-away remote hosts (on updates, for instance) if
> this becomes the default.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1233698.PquWgbKCin
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (FreeBSD)
iD8DBQBEurrhXyyEoT62BG0RAgAnAJ9d4AeS7swmGE9FeY9KeouULCvfBwCeJ7wq
CvP7kzmkx0Ek/ateDa039dg=
=pQS2
-----END PGP SIGNATURE-----
--nextPart1233698.PquWgbKCin--
討論串 (同標題文章)
完整討論串 (本文為第 8 之 16 篇)：