Commit Graph

26 Commits

Author SHA1 Message Date
Lars Engels
6c1a5e837d - Add descriptions to most of the rc scripts. Those are mostly taken from their
daemon's manpage and probably improved.
- Consistently use "filesystem" not "file system".

Approved by:	bapt, brueffer
Differential Revision:	D452
2016-04-23 16:10:54 +00:00
Kristof Provost
2f396d3cc3 pf: Friendly error message for status if pf.ko is not loaded
Check if pf.ko is loaded (i.e. /dev/pf exists) before trying to use it. This
means that '/etc/rc.d/pf status' will no longer return 'pfctl: /dev/pf: No such
file or directory' but 'pf.ko is not loaded'.

PR:		205671
Submitted by:	Johannes Jost Meixner <xmj@FreeBSD.org>
2016-03-27 17:22:27 +00:00
Doug Barton
801c438304 Prepare for the removal of set_rcvar() by changing the rcvar=
assignments to the literal values it would have returned.

The concept of set_rcvar() was nice in theory, but the forks
it creates are a drag on the startup process, which is especially
noticeable on slower systems, such as embedded ones.

During the discussion on freebsd-rc@ a preference was expressed for
using ${name}_enable instead of the literal values. However the
code portability concept doesn't really apply since there are so
many other places where the literal name has to be searched for
and replaced. Also, using the literal value is also a tiny bit
faster than dereferencing the variables, and every little bit helps.
2012-01-14 02:18:41 +00:00
Hiroki Sato
88492dfb20 Remove redundant keywords.
Submitted by:	wxs
2011-05-17 07:40:13 +00:00
Kevin Lo
1fd114b406 Add pf in quiet mode 2010-12-17 09:38:55 +00:00
Doug Barton
70d4ef1ea1 In regards to the "Starting foo:" type messages at boot time, create and
employ a more generic solution, and use it in the individual rc.d scripts
that also have an $rc_quiet test:

1. Add check_startmsgs() to rc.subr.
2. In the rc.d scripts that use rc_quiet (and rc.subr) substitute
variations of [ -z "$rc_quiet" ] with check_startmsgs
3. In savecore add a trailing '.' to the end of the message to make it
more consistent with other scripts.
4. In newsyslog remove a : before the terminal '.' since we do not expect
there to be anything printed out in between to make it more consistent.
5. In the following scripts change "quotes" to 'quotes' where no variables
exist in the message: savecore pf newsyslog
6. In the following scripts substitute if/then/fi for the simpler (and
more consistent) check_startmsgs &&: faith stf
7. In the following scripts separate the "Starting foo:" from the terminal
'.' to make them more consistent: moused hostname pf
8. In nfsclient move the message to its own line to avoid a style bug
9. In pf rc_quiet does not apply to the _stop method, so remove the
test there.
10. In motd add 'quotes' around the terminal '.' for consistency
2009-10-10 22:17:03 +00:00
Doug Barton
5ca51aad69 Reverse the effect of r193198 for pf and ipfw which will once again
allow them to start after netif. There were too many problems reported
with this change in the short period of time that it lived in HEAD, and
we are too late in the release cycle to properly shake it out.

IMO the issue of having the firewalls up before the network is still a
valid concern, particularly for pf whose default state is wide open.
However properly solving this issue is going to take some investment
on the part of the people who actually use those tools.

This is not a strict reversion of all the changes for r193198 since it
also included some simplification of the BEFORE/REQUIRE logic which is
still valid for ipfilter and ip6fw.
2009-06-26 01:04:50 +00:00
Doug Barton
a3f6188b53 Make the pf and ipfw firewalls start before netif, just like ipfilter
already does. This eliminates a logical inconsistency, and a small
window where the system is open after the network comes up.
2009-06-01 05:35:03 +00:00
Doug Barton
2b9851690c As previously discussed, add the svn:executable property to all scripts 2008-07-16 19:22:48 +00:00
Mike Makonnen
5692c36098 The pfctl(8) program is already pretty verbose, so don't print extra
information in quiet mode.
2008-07-11 08:11:49 +00:00
Dag-Erling Smørgrav
255d327cc5 FILESYSTEMS requires root, so requiring both of them is redundant. 2007-04-09 08:53:40 +00:00
Dag-Erling Smørgrav
7bd5b79de4 Add a dummy script, FILESYSTEMS, which depends on root and mountcritlocal
and takes over mountcritlocal's role as the early / late divider.  This
makes it far easier to add rc scripts which need to run early, such as a
startup script for zfs, which is right around the corner.

This change should be a no-op; I have verified that the only change in
rcorder's output is the insertion of FILESYSTEMS immediately after
mountcritlocal.

MFC after:	3 weeks
2007-04-02 22:53:07 +00:00
Yaroslav Tykhiy
0c30639059 Use $required_modules wherever suitable. Use load_kld() in special
cases.  So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
David E. O'Brien
991d907d3e Use an option form better matching the manual. 2006-06-05 03:47:14 +00:00
Ralf S. Engelschall
b89ad281dc Backout r1.11...
> >   There is no need to explicitly add "status" to $extra_commands in
> >   the /etc/rc.d/pf script as it is implicitly added by /etc/rc.subr's
> >   run_rc_command() because of the existing $pf_program.
> >
> >   Submitted by:   Christoph Schug <chris@schug.net>

...because as yar@ points out: "[...] you were relying on evil
side-effects of the variable being named *_program. hose side-effect
have been eliminated since rc.subr rev. 1.42. [...] The point is that
the default "status" method is for rc.d scripts that handle startup and
shutdown of conventional daemons, and not for custom tasks like the pf
case."

The change is still valid in RELENG_6 (and still doesn't have to be
backed out) as long as rc.subr:r1.42 is not MFC'ed to RELENG_6, too.
2005-11-10 10:40:15 +00:00
Ralf S. Engelschall
9d14a9a235 There is no need to explicitly add "status" to $extra_commands in
the /etc/rc.d/pf script as it is implicitly added by /etc/rc.subr's
run_rc_command() because of the existing $pf_program.

Submitted by:	Christoph Schug <chris@schug.net>
MFC after:	1 week
2005-11-03 13:17:49 +00:00
Yaroslav Tykhiy
22124484e2 Use available rc.subr features.
Reduce code duplication.
Follow the current style of rc.d scripting.
2005-10-02 19:17:49 +00:00
Yaroslav Tykhiy
b3470f8c82 Record dependency on the newly introduced pfsync.
Start before routing for better system protection.
(pf used to start late during system boot, after
many a network daemon have started already, which
sucked from security POV.)

Remark: For maximum security, pf should start before
netif, but it would create a dependency loop because
pfsync has to start after netif, yet before pf.

Discussed with: mlaier on -pf
MFC after:	5 days
2005-10-02 19:12:42 +00:00
Pawel Jakub Dawidek
9d503e9def Simplify the code by making use of 'kldstat -q -m <mod>'.
No objections from:	mlaier
2005-09-24 15:57:17 +00:00
Sean Chittenden
47accd603c When reloading rules via rc.d/pf, flush everything but existing state
entries that way when rules are read in, it doesn't break established
connections.

Approved by:	mlaier
Reviewed by:	rc
MFC after:	3 weeks
2005-04-04 23:06:10 +00:00
Pawel Jakub Dawidek
4fda9f547d - Add 'check' command for checking rules syntax.
- Before flushing rules in 'reload' command, check first if rules are
  correct.
- Do not duplicate checking if $pf_rules file exists.
2004-10-25 08:12:28 +00:00
Mike Makonnen
337338ee00 Remove the requirement for the FreeBSD keyword as it no longer
makes any sense.

Discussed with: dougb, brooks
MFC after: 3 days
2004-10-07 13:55:26 +00:00
Giorgos Keramidas
a73af104ef We don't have any providers of `beforenetlkm' in FreeBSD. Remove the
dependency to it from our rc.d scripts.

Approved by:	mtm
2004-09-16 17:04:20 +00:00
Max Laier
b78518bb34 Swap order of ruleset load and enabling pf to work around a problem on altq
startup. Moreover, this is the "more logic" order.
2004-06-23 01:42:06 +00:00
Max Laier
6cd9ebedd7 Add rc.d script to start pflogd and add rcvars etc. Also document vars in
rc.conf(5) and put a sample entry to newsyslog.conf

Reviewed by:	-current
Approved by:	bms(mentor)
2004-04-02 19:25:27 +00:00
Max Laier
1f4408f321 Add rc.d script for pf(4) (more to come once pflogd(8) works as well).
Update defaults and write some lines for rc.conf(5) also.
Mostly dup'ed from ipf

Reviewed by:	-current
Approved by:	bms(mentor)
2004-03-23 22:30:15 +00:00