| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
| |
apply to most jails but do apply to vnet jails. This includes adding
a new sysctl "security.jail.vnet" to identify vnet jails.
PR: conf/149050
Submitted by: mdodd
MFC after: 3 days
|
|
|
|
| |
PR: conf/167566
|
|
|
|
|
|
|
| |
by $firewall_logif rc.conf(5) variable at boot time or manually by ifconfig(8)
after a boot.
Discussed on: freebsd-ipfw@
|
|
|
|
|
|
| |
This is a further clean up after r202988.
SYSCTL_W is still initialized in rc.subr as some ports may still use it.
|
| |
|
|
|
|
|
|
|
|
|
| |
specify list of executables and/or rc scripts that should be executed
after firewall starts/stops.
Submitted by: Yuri Kurenkov <y dot kurenkov at init dot ru>
Reviewed by: rhodes, rc@
MFC after: 1 week
|
|
|
|
|
|
|
| |
and rc.d/ip6fw.
Reviewed by: dougb, jhb
MFC after: 1 month
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
allow them to start after netif. There were too many problems reported
with this change in the short period of time that it lived in HEAD, and
we are too late in the release cycle to properly shake it out.
IMO the issue of having the firewalls up before the network is still a
valid concern, particularly for pf whose default state is wide open.
However properly solving this issue is going to take some investment
on the part of the people who actually use those tools.
This is not a strict reversion of all the changes for r193198 since it
also included some simplification of the BEFORE/REQUIRE logic which is
still valid for ipfilter and ip6fw.
|
|
|
|
|
| |
already does. This eliminates a logical inconsistency, and a small
window where the system is open after the network comes up.
|
|
|
|
|
|
|
|
|
|
| |
is set and "natd_enable" is NOT set;
- Accept and pass firewall type to the external firewall script.
Submitted by: Yuri Kurenkov < y -dot- kurenkov -at- init -dot- ru >
MFC after: 3 days
No response from: freebsd-rc
|
| |
|
|
|
|
| |
successfull. Issue a warning if it fails, however.
|
|
|
|
|
|
|
|
| |
is enabled dummynet(4) is added to the list of required modules.
Discussed on: #freebsd-bugbusters (rwatson, trhodes)
PR: conf/79196
MFC after: 1 week
|
|
|
|
| |
start using the quiet prefix (i.e. quietstart, quietstop, etc...).
|
|
|
|
|
|
|
|
| |
If the firewall script is sourced directly from the script, then any
exit statements in it will also terminate the rc.d script prematurely.
PR: conf/78762
MFC-After: 2 weeks
|
|
|
|
| |
cases. So we get rid of quite a few lines of duplicated code.
|
| |
|
|
|
|
|
|
|
| |
printed on system startup).
Approved by: cognet (mentor)
MFC after: 3 days
|
|
|
|
|
|
|
|
|
|
|
| |
The rcorder(8) condition PROVIDE'd by the script
and REQUIRE'd by the others becomes "ppp".
The ultimate goal of the transformation is to reduce
confusion resulting from the fact that $name has been
"ppp" already.
Discussed with: pjd, -rc
|
|
|
|
| |
ipdivert.ko module a chance to load.
|
|
|
|
|
|
|
| |
makes any sense.
Discussed with: dougb, brooks
MFC after: 3 days
|
|
|
|
|
| |
script exists. This allows pruning of rc.d scripts without getting
too many ugly boottime error message
|
|
|
|
|
|
|
| |
(when new natd is started before old natd died) and allows to manage natd
without touching ipfw.
natd should probably be killed with SIGKILL when stopping natd.
|
|
|
|
| |
Some suggestions from: rwatson, Ruben de Groot <mail25@bzerk.org>
|
|
|
|
|
|
| |
Kill natd in stop().
Reviewed by: mtm
|
|
|
|
|
|
|
|
|
|
|
|
| |
stop ipfw, but not enable it again.
Aesthetic changes
o Use positve logic (instead of negative)
o create a 'stop' function, rather than putting the
commands in the stop_cmd variable.
Submitted by: des
Approved by: markm (mentor) (implicit)
|
|
|
|
|
|
|
|
|
|
|
| |
withough the $natd_interface having to be explicitly specified on the
command line.
Approved by: markm (mentor)
Submitted by: Aaron D. Gifford <agifford@infowest.com>
PR: conf/47024
MFC: upon re approval
|
|
|
|
|
|
|
|
|
|
| |
* Space -> tabs conversion.
* Removed blanks before semicolon in "if ... ; then".
* Proper indentation of misindented lines.
* Put a full stop after some comments.
* Removed whitespace at end of line.
Approved by: silence from gordon
|
|
while. This is only the script pieces, the glue for the build comes next.
Submitted by: Mike Makonnen <makonnen@pacbell.net>
Reviewed by: silence on -current and -hackers
Prodded by: rwatson
|