diff options
| author | Thomas Steen Rasmussen <thomas@gibfest.dk> | 2021-06-16 18:29:06 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2021-07-08 12:22:04 +0000 |
| commit | 28f47a199cfd8749ab30a0327b0a3f8977ec2b43 (patch) | |
| tree | 95037795b65a05d4501a55a851586e483859e3d5 /libexec | |
| parent | 19d6e29b872232c47190344f3dfded2f73edd8ae (diff) | |
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/rc/rc.conf | 5 | ||||
| -rwxr-xr-x | libexec/rc/rc.d/pf | 19 |
2 files changed, 23 insertions, 1 deletions
diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 9fdc4d9d8636..b392dae9ae6c 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -224,6 +224,11 @@ pf_rules="/etc/pf.conf" # rules definition file for pf (nonexistent # by default) pf_program="/sbin/pfctl" # where the pfctl program lives pf_flags="" # additional flags for pfctl +pf_fallback_rules_enable="NO" # fallback if loading ruleset fails +pf_fallback_rules="block drop log all" # rules to load on pf ruleset failure +#pf_fallback_rules="block drop log all +#pass quick on em4" # multi-rule +pf_fallback_rules_file="/etc/pf-fallback.conf" # rules file on ruleset failure pflog_enable="NO" # Set to YES to enable packet filter logging pflog_logfile="/var/log/pflog" # where pflogd should store the logfile pflog_program="/sbin/pflogd" # where the pflogd program lives diff --git a/libexec/rc/rc.d/pf b/libexec/rc/rc.d/pf index 1f7394007667..fa1b49643cc5 100755 --- a/libexec/rc/rc.d/pf +++ b/libexec/rc/rc.d/pf @@ -23,11 +23,28 @@ extra_commands="check reload resync" required_files="$pf_rules" required_modules="pf" +pf_fallback() +{ + warn "Unable to load $pf_rules." + + if ! checkyesno pf_fallback_rules_enable; then + return + fi + + if [ -f $pf_fallback_rules_file ]; then + warn "Loading fallback rules file: $pf_fallback_rules_file" + $pf_program -f "$pf_fallback_rules_file" $pf_flags + else + warn "Loading fallback rules: $pf_fallback_rules" + echo $pf_fallback_rules | $pf_program -f - $pf_flags + fi +} + pf_start() { check_startmsgs && echo -n 'Enabling pf' $pf_program -F all > /dev/null 2>&1 - $pf_program -f "$pf_rules" $pf_flags + $pf_program -f "$pf_rules" $pf_flags || pf_fallback if ! $pf_program -s info | grep -q "Enabled" ; then $pf_program -eq fi |