From 9ef917591248e35efea846d0d743b74503387099 Mon Sep 17 00:00:00 2001 From: Pawel Biernacki Date: Thu, 8 Oct 2020 11:45:10 +0000 Subject: [PATCH] [pf] /etc/rc.d/pf should REQUIRE routing When a system with pf_enable="YES" in /etc/rc.conf uses hostnames in /etc/pf.conf, these hostnames cannot be resolved via external nameservers because the default route is not yet set. This results in an empty (all open) ruleset. Since r195026 already put netif back to REQUIRE, this change does not affect the issue that the firewall should rather have been setup before any network traffic can occur. PR: 211928 Submitted by: Robert Schulze Reported by: Robert Schulze Tested by: Mateusz Kwiatkowski No objections from: kp MFC after: 3 days --- libexec/rc/rc.d/pf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libexec/rc/rc.d/pf b/libexec/rc/rc.d/pf index 57de19218fcf..1f7394007667 100755 --- a/libexec/rc/rc.d/pf +++ b/libexec/rc/rc.d/pf @@ -4,8 +4,7 @@ # # PROVIDE: pf -# REQUIRE: FILESYSTEMS netif pflog pfsync -# BEFORE: routing +# REQUIRE: FILESYSTEMS netif pflog pfsync routing # KEYWORD: nojailvnet . /etc/rc.subr