Merge ^/head r284644 through r284736.

2 files changed, 17 insertions, 25 deletions

diff --git a/etc/etc.arm/ttys b/etc/etc.arm/ttys
index 501bae6..f5f225e 100644
--- a/etc/etc.arm/ttys
+++ b/etc/etc.arm/ttys
@@ -42,8 +42,8 @@ ttyv7	"/usr/libexec/getty Pc"		xterm	off  secure
 # Serial terminals
 # The 'dialup' keyword identifies dialin lines to login, fingerd etc.
 ttyu0	"/usr/libexec/getty 3wire"	vt100	onifconsole  secure
-ttyu1	"/usr/libexec/getty std.9600"	dialup	off secure
-ttyu2	"/usr/libexec/getty std.9600"	dialup	off secure
-ttyu3	"/usr/libexec/getty std.9600"	dialup	off secure
+ttyu1	"/usr/libexec/getty 3wire"	vt100	onifconsole  secure
+ttyu2	"/usr/libexec/getty 3wire"	vt100	onifconsole  secure
+ttyu3	"/usr/libexec/getty 3wire"	vt100	onifconsole  secure
 # Dumb console
 dcons	"/usr/libexec/getty std.9600"	vt100	off secure
diff --git a/etc/rc.firewall b/etc/rc.firewall
index ee578ef..0c4d220 100644
--- a/etc/rc.firewall
+++ b/etc/rc.firewall
@@ -266,6 +266,7 @@ case ${firewall_type} in
 	#  firewall_simple_oif_ipv6:	Outside IPv6 network interface.
 	#  firewall_simple_onet_ipv6:	Outside IPv6 network prefix.
 	############
+	BAD_ADDR_TBL=13
 
 	# set these to your outside interface network
 	oif="$firewall_simple_oif"
@@ -290,19 +291,23 @@ case ${firewall_type} in
 		fi
 	fi
 
+	# define stuff we should never send out or receive in
 	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
-	${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} flush
+	${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
 
 	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
 	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
 	# on the outside interface
-	${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
-	${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
-	${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
-	${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+	${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+	${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+
+	${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
 
 	# Network Address Translation.  This rule is placed here deliberately
 	# so that it does not interfere with the surrounding address-checking
@@ -319,20 +324,7 @@ case ${firewall_type} in
 		;;
 	esac
 
-	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
-	${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
-	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
-	# on the outside interface
-	${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
-	${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
-	${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
-	${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+	${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
 	if [ -n "$inet6" ]; then
 		# Stop unique local unicast address on the outside interface
 		${fwcmd} add deny all from fc00::/7 to any via ${oif6}