head 1.6; access; symbols netbsd-11-0-RC6:1.6 netbsd-11-0-RC5:1.6 netbsd-11-0-RC4:1.6 netbsd-11-0-RC3:1.6 netbsd-11-0-RC2:1.6 netbsd-11-0-RC1:1.6 perseant-exfatfs-base-20250801:1.6 netbsd-11:1.6.0.6 netbsd-11-base:1.6 netbsd-10-1-RELEASE:1.6 perseant-exfatfs-base-20240630:1.6 perseant-exfatfs:1.6.0.4 perseant-exfatfs-base:1.6 netbsd-9-4-RELEASE:1.1.4.3 netbsd-10-0-RELEASE:1.6 netbsd-10-0-RC6:1.6 netbsd-10-0-RC5:1.6 netbsd-10-0-RC4:1.6 netbsd-10-0-RC3:1.6 netbsd-10-0-RC2:1.6 netbsd-10-0-RC1:1.6 netbsd-10:1.6.0.2 netbsd-10-base:1.6 netbsd-9-3-RELEASE:1.1.4.3 cjep_sun2x-base1:1.4 cjep_sun2x:1.4.0.4 cjep_sun2x-base:1.4 cjep_staticlib_x-base1:1.4 netbsd-9-2-RELEASE:1.1.4.1 cjep_staticlib_x:1.4.0.2 cjep_staticlib_x-base:1.4 netbsd-9-1-RELEASE:1.1.4.1 phil-wifi-20200421:1.2 phil-wifi-20200411:1.2 is-mlppp:1.2.0.2 is-mlppp-base:1.2 phil-wifi-20200406:1.2 netbsd-9-0-RELEASE:1.1.4.1 netbsd-9-0-RC2:1.1.4.1 netbsd-9-0-RC1:1.1.4.1 phil-wifi-20191119:1.2 netbsd-9:1.1.0.4 netbsd-9-base:1.1 phil-wifi:1.1.0.2 phil-wifi-20190609:1.1; locks; strict; comment @# @; 1.6 date 2021.11.30.11.00.29; author sborrill; state Exp; branches; next 1.5; commitid VZg4O7TqnzlKaOiD; 1.5 date 2021.11.26.13.11.36; author sborrill; state Exp; branches; next 1.4; commitid 3doPlFPfBTvTYiiD; 1.4 date 2020.09.08.12.52.18; author martin; state Exp; branches; next 1.3; commitid IL2vGNw0FVFgcfnC; 1.3 date 2020.07.22.16.50.41; author martin; state Exp; branches; next 1.2; commitid ZlFyZCKhX3U036hC; 1.2 date 2019.10.05.22.21.29; author sevan; state Exp; branches; next 1.1; commitid gG8CRZpJn4FHdJFB; 1.1 date 2019.04.02.01.50.32; author sevan; state Exp; branches 1.1.2.1 1.1.4.1; next ; commitid pY2XzoTzWMMunIhB; 1.1.2.1 date 2019.04.02.01.50.32; author christos; state dead; branches; next 1.1.2.2; commitid jtc8rnCzWiEEHGqB; 1.1.2.2 date 2019.06.10.21.42.45; author christos; state Exp; branches; next 1.1.2.3; commitid jtc8rnCzWiEEHGqB; 1.1.2.3 date 2020.04.13.07.45.46; author martin; state Exp; branches; next ; commitid X01YhRUPVUDaec4C; 1.1.4.1 date 2019.10.06.11.13.35; author martin; state Exp; branches; next 1.1.4.2; commitid SPDdTSZx88P7wNFB; 1.1.4.2 date 2021.11.26.16.50.18; author martin; state Exp; branches; next 1.1.4.3; commitid QE5Y71CjYTibfkiD; 1.1.4.3 date 2021.11.26.18.04.09; author martin; state Exp; branches; next ; commitid f4CtV4pjmHdwEkiD; desc @@ 1.6 log @Revert previous. Explicitly load the value of npf or pf @ text @#!/bin/sh # # $NetBSD: npf_boot,v 1.5 2021/11/26 13:11:36 sborrill Exp $ # # PROVIDE: npf_boot # REQUIRE: root bootconf CRITLOCALMOUNTED tty # BEFORE: network $_rc_subr_loaded . /etc/rc.subr name="npf_boot" rcvar="npf" start_cmd="npf_boot_start" stop_cmd=":" npf_boot_start() { if [ -f /etc/npf.boot.conf ]; then /sbin/npfctl reload /etc/npf.boot.conf elif [ -f /etc/defaults/npf.boot.conf ]; then /sbin/npfctl reload /etc/defaults/npf.boot.conf else warn "can't load initial npf rules; npf start aborted." stop_boot exit 1 fi /sbin/npfctl start } load_rc_config $name load_rc_config_var npf npf run_rc_command "$1" @ 1.5 log @Load rc configuration based on rcvar, not name, so that correct settings in /etc/rc.conf.d are loaded. Usually this does not matter as rcvar and name are set to the same value. For pf_boot and npf_boot, rcvar is set to pf and npf respectively. Prior to the change, if: rc.conf contains nfp=YES rc.conf.d/npf does not exist Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=YES If: rc.conf contains npf=NO (or is not set) rc.conf.d/npf contains npf=YES Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=NO This means that in the latter case, at boot time the npfctl start command is never run and the firewall is not operational. @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.4 2020/09/08 12:52:18 martin Exp $ d32 2 a33 1 load_rc_config $rcvar @ 1.4 log @Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collision on case insensitive file systems @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.3 2020/07/22 16:50:41 martin Exp $ d32 1 a32 1 load_rc_config $name @ 1.3 log @Split the local disk availability step into two phases to allow scripts that pre-populate parts of the system (e.g. a tmpfs based /var) an easy place to plug in like: # REQUIRE: mountcritlocal # BEFORE: MOUNTCRITLOCAL This also cleans up the existing special handling a bit by separating it into new scripts. All later scripts now depend on MOUNTCRITLOCAL. Discussed on tech-userlevel some time ago. @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.2 2019/10/05 22:21:29 sevan Exp $ d7 1 a7 1 # REQUIRE: root bootconf MOUNTCRITLOCAL tty @ 1.2 log @No need to empose the script to be runnable during boot time, it prevents the script from wroking if the system is booted into single user mode & then moved onto multi-user mode. Reported by for NPF but the issue is there in PF too. @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.1 2019/04/02 01:50:32 sevan Exp $ d7 1 a7 1 # REQUIRE: root bootconf mountcritlocal tty @ 1.1 log @Add an initial ruleset and rc script for NPF to protect host during early stage of boot, similar to what is currently available for PF. @ text @d3 1 a3 1 # $NetBSD$ a18 4 if [ "$autoboot" != "yes" ]; then err 1 "This script should only be executed at boot time." fi @ 1.1.4.1 log @Pull up following revision(s) (requested by sevan in ticket #288): etc/rc.d/npf_boot: revision 1.2 etc/rc.d/pf_boot: revision 1.5 No need to empose the script to be runnable during boot time, it prevents the script from wroking if the system is booted into single user mode & then moved onto multi-user mode. Reported by for NPF but the issue is there in PF too. @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.1 2019/04/02 01:50:32 sevan Exp $ d19 4 @ 1.1.4.2 log @Pull up following revision(s) (requested by sborrill in ticket #1377): etc/rc.d/npf_boot: revision 1.5 etc/rc.d/pf_boot: revision 1.8 Load rc configuration based on rcvar, not name, so that correct settings in /etc/rc.conf.d are loaded. Usually this does not matter as rcvar and name are set to the same value. For pf_boot and npf_boot, rcvar is set to pf and npf respectively. Prior to the change, if: rc.conf contains nfp=YES rc.conf.d/npf does not exist Then: /etc/rc.d/npf_boot rcvar outputs: $npf=YES If: rc.conf contains npf=NO (or is not set) rc.conf.d/npf contains npf=YES Then: /etc/rc.d/npf_boot rcvar outputs: $npf=NO This means that in the latter case, at boot time the npfctl start command is never run and the firewall is not operational. @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.1.4.1 2019/10/06 11:13:35 martin Exp $ d32 1 a32 1 load_rc_config $rcvar @ 1.1.4.3 log @Backout previous pullup from ticket #1377: etc/rc.d/npf_boot: revision 1.5 etc/rc.d/pf_boot: revision 1.8 @ text @d3 1 a3 1 # $NetBSD: npf_boot,v 1.1.4.2 2021/11/26 16:50:18 martin Exp $ d32 1 a32 1 load_rc_config $name @ 1.1.2.1 log @file npf_boot was added on branch phil-wifi on 2019-06-10 21:42:45 +0000 @ text @d1 37 @ 1.1.2.2 log @Sync with HEAD @ text @a0 37 #!/bin/sh # # $NetBSD: npf_boot,v 1.1 2019/04/02 01:50:32 sevan Exp $ # # PROVIDE: npf_boot # REQUIRE: root bootconf mountcritlocal tty # BEFORE: network $_rc_subr_loaded . /etc/rc.subr name="npf_boot" rcvar="npf" start_cmd="npf_boot_start" stop_cmd=":" npf_boot_start() { if [ "$autoboot" != "yes" ]; then err 1 "This script should only be executed at boot time." fi if [ -f /etc/npf.boot.conf ]; then /sbin/npfctl reload /etc/npf.boot.conf elif [ -f /etc/defaults/npf.boot.conf ]; then /sbin/npfctl reload /etc/defaults/npf.boot.conf else warn "can't load initial npf rules; npf start aborted." stop_boot exit 1 fi /sbin/npfctl start } load_rc_config $name run_rc_command "$1" @ 1.1.2.3 log @Mostly merge changes from HEAD upto 20200411 @ text @d3 1 a3 1 # $NetBSD$ d19 4 @