svn commit: r366537 - head/libexec/rc/rc.d

[Rodney W. Grimes]

> Author: kaktus
> Date: Thu Oct  8 11:45:10 2020
> New Revision: 366537
> URL: https://svnweb.freebsd.org/changeset/base/366537
> 
> Log:
>   [pf] /etc/rc.d/pf should REQUIRE routing
>   
>   When a system with pf_enable="YES" in /etc/rc.conf uses hostnames in
>   /etc/pf.conf, these hostnames cannot be resolved via external nameservers
>   because the default route is not yet set. This results in an empty
>   (all open) ruleset.

Use of hostnames in pf, or any firewall for that mater tends to make
my hair stand on end, unless those hostnames resolve via /etc/hosts
or a link local resolver.

>   
>   Since r195026 already put netif back to REQUIRE, this change does not affect
>   the issue that the firewall should rather have been setup before any
>   network traffic can occur.

This well cause any system that requires pf rules
before routing can work to fail, aka almost any real
router running a real routing protocol well now fail
or have issues during route daemon start up as without
firewall rules the default is to deny the routing
protocol packets.

This should be reverted, or at least made knobable in some way.

>   
>   PR:		211928
>   Submitted by:	Robert Schulze
>   Reported by:	Robert Schulze
>   Tested by:	Mateusz Kwiatkowski
>   No objections from:	kp
>   MFC after:	3 days
> 
> Modified:
>   head/libexec/rc/rc.d/pf
> 
> Modified: head/libexec/rc/rc.d/pf
> ==============================================================================
> --- head/libexec/rc/rc.d/pf	Thu Oct  8 11:30:22 2020	(r366536)
> +++ head/libexec/rc/rc.d/pf	Thu Oct  8 11:45:10 2020	(r366537)
> @@ -4,8 +4,7 @@
>  #
>  
>  # PROVIDE: pf
> -# REQUIRE: FILESYSTEMS netif pflog pfsync
> -# BEFORE:  routing
> +# REQUIRE: FILESYSTEMS netif pflog pfsync routing
>  # KEYWORD: nojailvnet
>  
>  . /etc/rc.subr
> 

-- 
Rod Grimes                                                 rgrimes at freebsd.org