head 1.9; access; symbols netbsd-11-0-RC6:1.9 netbsd-11-0-RC5:1.9 netbsd-11-0-RC4:1.9 netbsd-11-0-RC3:1.9 netbsd-11-0-RC2:1.9 netbsd-11-0-RC1:1.9 perseant-exfatfs-base-20250801:1.9 netbsd-11:1.9.0.6 netbsd-11-base:1.9 netbsd-10-1-RELEASE:1.9 perseant-exfatfs-base-20240630:1.9 perseant-exfatfs:1.9.0.4 perseant-exfatfs-base:1.9 netbsd-8-3-RELEASE:1.4 netbsd-9-4-RELEASE:1.4.52.3 netbsd-10-0-RELEASE:1.9 netbsd-10-0-RC6:1.9 netbsd-10-0-RC5:1.9 netbsd-10-0-RC4:1.9 netbsd-10-0-RC3:1.9 netbsd-10-0-RC2:1.9 netbsd-10-0-RC1:1.9 netbsd-10:1.9.0.2 netbsd-10-base:1.9 netbsd-9-3-RELEASE:1.4.52.3 cjep_sun2x-base1:1.7 cjep_sun2x:1.7.0.4 cjep_sun2x-base:1.7 cjep_staticlib_x-base1:1.7 netbsd-9-2-RELEASE:1.4.52.1 cjep_staticlib_x:1.7.0.2 cjep_staticlib_x-base:1.7 netbsd-9-1-RELEASE:1.4.52.1 phil-wifi-20200421:1.5 phil-wifi-20200411:1.5 is-mlppp:1.5.0.2 is-mlppp-base:1.5 phil-wifi-20200406:1.5 netbsd-8-2-RELEASE:1.4 netbsd-9-0-RELEASE:1.4.52.1 netbsd-9-0-RC2:1.4.52.1 netbsd-9-0-RC1:1.4.52.1 phil-wifi-20191119:1.5 netbsd-9:1.4.0.52 netbsd-9-base:1.4 phil-wifi-20190609:1.4 netbsd-8-1-RELEASE:1.4 netbsd-8-1-RC1:1.4 pgoyette-compat-merge-20190127:1.4 pgoyette-compat-20190127:1.4 pgoyette-compat-20190118:1.4 pgoyette-compat-1226:1.4 pgoyette-compat-1126:1.4 pgoyette-compat-1020:1.4 pgoyette-compat-0930:1.4 pgoyette-compat-0906:1.4 netbsd-7-2-RELEASE:1.4 pgoyette-compat-0728:1.4 netbsd-8-0-RELEASE:1.4 phil-wifi:1.4.0.50 phil-wifi-base:1.4 pgoyette-compat-0625:1.4 netbsd-8-0-RC2:1.4 pgoyette-compat-0521:1.4 pgoyette-compat-0502:1.4 pgoyette-compat-0422:1.4 netbsd-8-0-RC1:1.4 pgoyette-compat-0415:1.4 pgoyette-compat-0407:1.4 pgoyette-compat-0330:1.4 pgoyette-compat-0322:1.4 pgoyette-compat-0315:1.4 netbsd-7-1-2-RELEASE:1.4 pgoyette-compat:1.4.0.48 pgoyette-compat-base:1.4 netbsd-7-1-1-RELEASE:1.4 matt-nb8-mediatek:1.4.0.46 matt-nb8-mediatek-base:1.4 perseant-stdc-iso10646:1.4.0.44 perseant-stdc-iso10646-base:1.4 netbsd-8:1.4.0.42 netbsd-8-base:1.4 prg-localcount2-base3:1.4 prg-localcount2-base2:1.4 prg-localcount2-base1:1.4 prg-localcount2:1.4.0.40 prg-localcount2-base:1.4 pgoyette-localcount-20170426:1.4 bouyer-socketcan-base1:1.4 pgoyette-localcount-20170320:1.4 netbsd-7-1:1.4.0.38 netbsd-7-1-RELEASE:1.4 netbsd-7-1-RC2:1.4 netbsd-7-nhusb-base-20170116:1.4 bouyer-socketcan:1.4.0.36 bouyer-socketcan-base:1.4 pgoyette-localcount-20170107:1.4 netbsd-7-1-RC1:1.4 pgoyette-localcount-20161104:1.4 netbsd-7-0-2-RELEASE:1.4 localcount-20160914:1.4 netbsd-7-nhusb:1.4.0.34 netbsd-7-nhusb-base:1.4 pgoyette-localcount-20160806:1.4 pgoyette-localcount-20160726:1.4 pgoyette-localcount:1.4.0.32 pgoyette-localcount-base:1.4 netbsd-7-0-1-RELEASE:1.4 netbsd-7-0:1.4.0.30 netbsd-7-0-RELEASE:1.4 netbsd-7-0-RC3:1.4 netbsd-7-0-RC2:1.4 netbsd-7-0-RC1:1.4 netbsd-5-2-3-RELEASE:1.2 netbsd-5-1-5-RELEASE:1.2 netbsd-6-0-6-RELEASE:1.4 netbsd-6-1-5-RELEASE:1.4 netbsd-7:1.4.0.28 netbsd-7-base:1.4 yamt-pagecache-base9:1.4 yamt-pagecache-tag8:1.4 netbsd-6-1-4-RELEASE:1.4 netbsd-6-0-5-RELEASE:1.4 tls-earlyentropy:1.4.0.26 tls-earlyentropy-base:1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.4 riastradh-drm2-base3:1.4 netbsd-6-1-3-RELEASE:1.4 netbsd-6-0-4-RELEASE:1.4 netbsd-5-2-2-RELEASE:1.2 netbsd-5-1-4-RELEASE:1.2 netbsd-6-1-2-RELEASE:1.4 netbsd-6-0-3-RELEASE:1.4 netbsd-5-2-1-RELEASE:1.2 netbsd-5-1-3-RELEASE:1.2 netbsd-6-1-1-RELEASE:1.4 riastradh-drm2-base2:1.4 riastradh-drm2-base1:1.4 riastradh-drm2:1.4.0.18 riastradh-drm2-base:1.4 netbsd-6-1:1.4.0.24 netbsd-6-0-2-RELEASE:1.4 netbsd-6-1-RELEASE:1.4 khorben-n900:1.4.0.22 netbsd-6-1-RC4:1.4 netbsd-6-1-RC3:1.4 agc-symver:1.4.0.20 agc-symver-base:1.4 netbsd-6-1-RC2:1.4 netbsd-6-1-RC1:1.4 yamt-pagecache-base8:1.4 netbsd-5-2:1.2.0.30 netbsd-6-0-1-RELEASE:1.4 yamt-pagecache-base7:1.4 netbsd-5-2-RELEASE:1.2 netbsd-5-2-RC1:1.2 matt-nb6-plus-nbase:1.4 yamt-pagecache-base6:1.4 netbsd-6-0:1.4.0.16 netbsd-6-0-RELEASE:1.4 netbsd-6-0-RC2:1.4 tls-maxphys:1.4.0.14 tls-maxphys-base:1.4 matt-nb6-plus:1.4.0.12 matt-nb6-plus-base:1.4 netbsd-6-0-RC1:1.4 yamt-pagecache-base5:1.4 yamt-pagecache-base4:1.4 netbsd-6:1.4.0.10 netbsd-6-base:1.4 netbsd-5-1-2-RELEASE:1.2 netbsd-5-1-1-RELEASE:1.2 yamt-pagecache-base3:1.4 yamt-pagecache-base2:1.4 yamt-pagecache:1.4.0.8 yamt-pagecache-base:1.4 cherry-xenmp:1.4.0.6 cherry-xenmp-base:1.4 bouyer-quota2-nbase:1.4 bouyer-quota2:1.4.0.4 bouyer-quota2-base:1.4 matt-mips64-premerge-20101231:1.4 matt-nb5-mips64-premerge-20101231:1.2 matt-nb5-pq3:1.2.0.28 matt-nb5-pq3-base:1.2 netbsd-5-1:1.2.0.26 netbsd-5-1-RELEASE:1.2 netbsd-5-1-RC4:1.2 matt-nb5-mips64-k15:1.2 netbsd-5-1-RC3:1.2 netbsd-5-1-RC2:1.2 netbsd-5-1-RC1:1.2 netbsd-5-0-2-RELEASE:1.2 matt-nb5-mips64-premerge-20091211:1.2 matt-premerge-20091211:1.4 matt-nb5-mips64-u2-k2-k4-k7-k8-k9:1.2 matt-nb4-mips64-k7-u2a-k9b:1.2 matt-nb5-mips64-u1-k1-k5:1.2 matt-nb5-mips64:1.2.0.24 netbsd-5-0-1-RELEASE:1.2 jym-xensuspend-nbase:1.4 netbsd-5-0:1.2.0.22 netbsd-5-0-RELEASE:1.2 netbsd-5-0-RC4:1.2 netbsd-5-0-RC3:1.2 netbsd-5-0-RC2:1.2 jym-xensuspend:1.4.0.2 jym-xensuspend-base:1.4 netbsd-5-0-RC1:1.2 mjf-devfs2-base2:1.4 netbsd-5:1.2.0.20 netbsd-5-base:1.2 matt-mips64-base2:1.2 matt-mips64:1.2.0.18 netbsd-4-0-1-RELEASE:1.1 wrstuden-revivesa-base-3:1.2 wrstuden-revivesa-base-2:1.2 wrstuden-fixsa-newbase:1.1 wrstuden-revivesa-base-1:1.2 yamt-pf42-base4:1.2 yamt-pf42-base3:1.2 hpcarm-cleanup-nbase:1.2 yamt-pf42-baseX:1.2 yamt-pf42-base2:1.2 wrstuden-revivesa:1.2.0.16 wrstuden-revivesa-base:1.2 yamt-pf42:1.2.0.14 yamt-pf42-base:1.2 mjf-devfs2:1.2.0.12 mjf-devfs2-base:1.2 keiichi-mipv6:1.2.0.10 keiichi-mipv6-base:1.2 mjf-devfs:1.2.0.8 mjf-devfs-base:1.2 matt-armv6-nbase:1.2 matt-armv6-prevmlocking:1.2 wrstuden-fixsa-base-1:1.1 netbsd-4-0:1.1.0.10 netbsd-4-0-RELEASE:1.1 cube-autoconf:1.2.0.6 cube-autoconf-base:1.2 netbsd-4-0-RC5:1.1 netbsd-4-0-RC4:1.1 netbsd-4-0-RC3:1.1 netbsd-4-0-RC2:1.1 netbsd-4-0-RC1:1.1 matt-armv6:1.2.0.4 matt-armv6-base:1.2 matt-mips64-base:1.2 hpcarm-cleanup:1.2.0.2 hpcarm-cleanup-base:1.2 netbsd-3-1-1-RELEASE:1.1.2.2 netbsd-3-0-3-RELEASE:1.1.2.2 wrstuden-fixsa:1.1.0.8 wrstuden-fixsa-base:1.1 abandoned-netbsd-4-base:1.1 abandoned-netbsd-4:1.1.0.4 netbsd-3-1:1.1.2.2.0.4 netbsd-3-1-RELEASE:1.1.2.2 netbsd-3-0-2-RELEASE:1.1.2.2 netbsd-3-1-RC4:1.1.2.2 netbsd-3-1-RC3:1.1.2.2 netbsd-3-1-RC2:1.1.2.2 netbsd-3-1-RC1:1.1.2.2 netbsd-4:1.1.0.6 netbsd-4-base:1.1 netbsd-3-0-1-RELEASE:1.1.2.2 netbsd-3-0:1.1.2.2.0.2 netbsd-3-0-RELEASE:1.1.2.2 netbsd-3-0-RC6:1.1.2.2 netbsd-3-0-RC5:1.1.2.2 netbsd-3-0-RC4:1.1.2.2 netbsd-3-0-RC3:1.1.2.2 netbsd-3-0-RC2:1.1.2.2 netbsd-3-0-RC1:1.1.2.2 netbsd-3:1.1.0.2; locks; strict; comment @# @; 1.9 date 2021.11.30.11.00.29; author sborrill; state Exp; branches; next 1.8; commitid VZg4O7TqnzlKaOiD; 1.8 date 2021.11.26.13.11.36; author sborrill; state Exp; branches; next 1.7; commitid 3doPlFPfBTvTYiiD; 1.7 date 2020.09.08.12.52.18; author martin; state Exp; branches; next 1.6; commitid IL2vGNw0FVFgcfnC; 1.6 date 2020.07.22.16.50.41; author martin; state Exp; branches; next 1.5; commitid ZlFyZCKhX3U036hC; 1.5 date 2019.10.05.22.21.29; author sevan; state Exp; branches; next 1.4; commitid gG8CRZpJn4FHdJFB; 1.4 date 2008.11.22.20.23.33; author tsutsui; state Exp; branches 1.4.50.1 1.4.52.1; next 1.3; 1.3 date 2008.11.12.12.35.52; author ad; state Exp; branches; next 1.2; 1.2 date 2007.04.06.14.20.19; author apb; state Exp; branches 1.2.12.1; next 1.1; 1.1 date 2005.08.23.12.12.56; author peter; state Exp; branches 1.1.2.1; next ; 1.4.50.1 date 2020.04.13.07.45.46; author martin; state Exp; branches; next ; commitid X01YhRUPVUDaec4C; 1.4.52.1 date 2019.10.06.11.13.35; author martin; state Exp; branches; next 1.4.52.2; commitid SPDdTSZx88P7wNFB; 1.4.52.2 date 2021.11.26.16.50.18; author martin; state Exp; branches; next 1.4.52.3; commitid QE5Y71CjYTibfkiD; 1.4.52.3 date 2021.11.26.18.04.09; author martin; state Exp; branches; next ; commitid f4CtV4pjmHdwEkiD; 1.2.12.1 date 2009.01.17.20.43.44; author mjf; state Exp; branches; next ; 1.1.2.1 date 2005.08.23.12.12.56; author tron; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2005.09.02.12.29.37; author tron; state Exp; branches; next ; desc @@ 1.9 log @Revert previous. Explicitly load the value of npf or pf @ text @#!/bin/sh # # $NetBSD: pf_boot,v 1.8 2021/11/26 13:11:36 sborrill Exp $ # # PROVIDE: pf_boot # REQUIRE: root bootconf CRITLOCALMOUNTED tty # BEFORE: network $_rc_subr_loaded . /etc/rc.subr name="pf_boot" rcvar="pf" start_cmd="pf_boot_start" stop_cmd=":" pf_boot_start() { if [ -f /etc/pf.boot.conf ]; then /sbin/pfctl -q -f /etc/pf.boot.conf elif [ -f /etc/defaults/pf.boot.conf ]; then /sbin/pfctl -q -f /etc/defaults/pf.boot.conf else warn "can't load initial pf rules; pf start aborted." stop_boot exit 1 fi /sbin/pfctl -q -e } load_rc_config $name load_rc_config_var pf pf run_rc_command "$1" @ 1.8 log @Load rc configuration based on rcvar, not name, so that correct settings in /etc/rc.conf.d are loaded. Usually this does not matter as rcvar and name are set to the same value. For pf_boot and npf_boot, rcvar is set to pf and npf respectively. Prior to the change, if: rc.conf contains nfp=YES rc.conf.d/npf does not exist Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=YES If: rc.conf contains npf=NO (or is not set) rc.conf.d/npf contains npf=YES Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=NO This means that in the latter case, at boot time the npfctl start command is never run and the firewall is not operational. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.7 2020/09/08 12:52:18 martin Exp $ d32 2 a33 1 load_rc_config $rcvar @ 1.7 log @Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collision on case insensitive file systems @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.6 2020/07/22 16:50:41 martin Exp $ d32 1 a32 1 load_rc_config $name @ 1.6 log @Split the local disk availability step into two phases to allow scripts that pre-populate parts of the system (e.g. a tmpfs based /var) an easy place to plug in like: # REQUIRE: mountcritlocal # BEFORE: MOUNTCRITLOCAL This also cleans up the existing special handling a bit by separating it into new scripts. All later scripts now depend on MOUNTCRITLOCAL. Discussed on tech-userlevel some time ago. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.5 2019/10/05 22:21:29 sevan Exp $ d7 1 a7 1 # REQUIRE: root bootconf MOUNTCRITLOCAL tty @ 1.5 log @No need to empose the script to be runnable during boot time, it prevents the script from wroking if the system is booted into single user mode & then moved onto multi-user mode. Reported by for NPF but the issue is there in PF too. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.4 2008/11/22 20:23:33 tsutsui Exp $ d7 1 a7 1 # REQUIRE: root bootconf mountcritlocal tty @ 1.4 log @Add "bootconf" to REQUIRE: lines which had beforenetlkm since removed beforenetlkm required bootconf. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.3 2008/11/12 12:35:52 ad Exp $ a18 4 if [ "$autoboot" != "yes" ]; then err 1 "This script should only be executed at boot time." fi @ 1.4.50.1 log @Mostly merge changes from HEAD upto 20200411 @ text @d3 1 a3 1 # $NetBSD$ d19 4 @ 1.4.52.1 log @Pull up following revision(s) (requested by sevan in ticket #288): etc/rc.d/npf_boot: revision 1.2 etc/rc.d/pf_boot: revision 1.5 No need to empose the script to be runnable during boot time, it prevents the script from wroking if the system is booted into single user mode & then moved onto multi-user mode. Reported by for NPF but the issue is there in PF too. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.4 2008/11/22 20:23:33 tsutsui Exp $ d19 4 @ 1.4.52.2 log @Pull up following revision(s) (requested by sborrill in ticket #1377): etc/rc.d/npf_boot: revision 1.5 etc/rc.d/pf_boot: revision 1.8 Load rc configuration based on rcvar, not name, so that correct settings in /etc/rc.conf.d are loaded. Usually this does not matter as rcvar and name are set to the same value. For pf_boot and npf_boot, rcvar is set to pf and npf respectively. Prior to the change, if: rc.conf contains nfp=YES rc.conf.d/npf does not exist Then: /etc/rc.d/npf_boot rcvar outputs: $npf=YES If: rc.conf contains npf=NO (or is not set) rc.conf.d/npf contains npf=YES Then: /etc/rc.d/npf_boot rcvar outputs: $npf=NO This means that in the latter case, at boot time the npfctl start command is never run and the firewall is not operational. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.4.52.1 2019/10/06 11:13:35 martin Exp $ d32 1 a32 1 load_rc_config $rcvar @ 1.4.52.3 log @Backout previous pullup from ticket #1377: etc/rc.d/npf_boot: revision 1.5 etc/rc.d/pf_boot: revision 1.8 @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.4.52.2 2021/11/26 16:50:18 martin Exp $ d32 1 a32 1 load_rc_config $name @ 1.3 log @Remove LKMs and switch to the module framework, pass 1. Proposed on tech-kern@@. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.2 2007/04/06 14:20:19 apb Exp $ d7 1 a7 1 # REQUIRE: root mountcritlocal tty @ 1.2 log @* Add a stop_boot() function in rc.subr, to terminate a multi-user boot by killing the parent process. The parent's PID is saved in $RC_PID. * In all rc.d/* scripts that previously tried to stop the boot, replace in-line code with "stop_boot". * Document this. This should fix PR 29822. @ text @d3 1 a3 1 # $NetBSD: pf_boot,v 1.1 2005/08/23 12:12:56 peter Exp $ d7 1 a7 1 # REQUIRE: root beforenetlkm mountcritlocal tty @ 1.2.12.1 log @Sync with HEAD. @ text @d3 1 a3 1 # $NetBSD$ d7 1 a7 1 # REQUIRE: root bootconf mountcritlocal tty @ 1.1 log @pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security @ text @d3 1 a3 1 # $NetBSD$ d29 1 a29 2 echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!" kill -TERM $$ @ 1.1.2.1 log @file pf_boot was added on branch netbsd-3 on 2005-09-02 12:29:37 +0000 @ text @d1 38 @ 1.1.2.2 log @Pull up following revision(s) (requested by peter in ticket #717): usr.sbin/pf/man/man5/pf.boot.conf.5: revision 1.1 usr.sbin/postinstall/postinstall: revision 1.4 etc/rc.d/pf: revision 1.6 etc/rc.d/pf_boot: revision 1.1 usr.sbin/pf/etc/defaults/pf.boot.conf: revision 1.1 usr.sbin/pf/Makefile: revision 1.7 etc/rc.d/Makefile: revision 1.52 etc/mtree/special: revision 1.89 usr.sbin/pf/man/man5/Makefile: revision 1.5 usr.sbin/pf/etc/defaults/Makefile: revision 1.1 pf needs to be started after the network is up, because some pf rules derive IP address(es) from the interface (e.g "... from any to fxp0"). This however, creates window for possible attacks from the network. Implement the solution proposed by YAMAMOTO Takashi: Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot script before starting the network. People who don't like the default rules can override it with their own /etc/pf.boot.conf. The default rules have been obtained from OpenBSD. No objections on: tech-security @ text @a0 38 #!/bin/sh # # $NetBSD: pf_boot,v 1.1.2.1 2005/09/02 12:29:37 tron Exp $ # # PROVIDE: pf_boot # REQUIRE: root beforenetlkm mountcritlocal tty # BEFORE: network $_rc_subr_loaded . /etc/rc.subr name="pf_boot" rcvar="pf" start_cmd="pf_boot_start" stop_cmd=":" pf_boot_start() { if [ "$autoboot" != "yes" ]; then err 1 "This script should only be executed at boot time." fi if [ -f /etc/pf.boot.conf ]; then /sbin/pfctl -q -f /etc/pf.boot.conf elif [ -f /etc/defaults/pf.boot.conf ]; then /sbin/pfctl -q -f /etc/defaults/pf.boot.conf else warn "can't load initial pf rules; pf start aborted." echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!" kill -TERM $$ exit 1 fi /sbin/pfctl -q -e } load_rc_config $name run_rc_command "$1" @