opnsense-src/libexec/rc
Thomas Steen Rasmussen fae2a8cad3 pf: fallback if $pf_rules fails to load
Support loading a default pf ruleset in case of invalid pf.conf.

If no pf rules are loaded pf will pass/allow all traffic, assuming the
kernel is compiled without PF_DEFAULT_TO_DROP, as is the case in
GENERIC.

In other words: if there's a typo in the main pf_rules we would allow
all traffic. The new default rules minimise the impact of this.

If $pf_program (i.e. pfctl) fails to set $pf_fules and
$pf_fallback_rules_enable is YES we will load $pf_fallback_rules_file if
set, or $pf_fallback_rules.

$pf_fallback_rules can include multiple rules, for example to permit
traffic on a management interface.

$pf_fallback_rules_enable defaults to "NO", preserving historic behaviour.

man page changes by ceri@.

PR:		256410
Reviewed by:	donner, kp
Sponsored by:	semaphor.dk
Differential Revision:	https://reviews.freebsd.org/D30791

(cherry picked from commit 28f47a199c)
2022-01-24 21:11:02 +01:00
..
rc.d pf: fallback if $pf_rules fails to load 2022-01-24 21:11:02 +01:00
Makefile Revert r359294 per manu's request 2020-03-25 08:35:55 +00:00
netstart
network.subr rc: network.subr improve network6_getladdr() 2021-12-29 16:01:46 +00:00
pccard_ether
rc Replace literal uses of /usr/local with a variable 2020-11-03 12:29:10 +00:00
rc.bsdextended pkgbase: Really move rc.bsdextended 2019-05-22 07:39:59 +00:00
rc.conf pf: fallback if $pf_rules fails to load 2022-01-24 21:11:02 +01:00
rc.firewall rc.firewall: Merge two identical conditions into one. 2020-07-23 15:03:28 +00:00
rc.initdiskless Make mdmfs verbose if diskless boot is verbose. 2019-04-26 14:44:50 +00:00
rc.resume rcorder(8): add support for /etc/rc.resume, so it calls "rcorder -k resume" 2018-10-27 17:21:13 +00:00
rc.sendmail pkgbase: Really move rc.sendmail 2019-05-22 07:40:39 +00:00
rc.shutdown rc.shutdown: kill shutdown process after logging message 2019-12-07 00:33:08 +00:00
rc.subr Remove trailing tab. 2019-10-27 18:27:25 +00:00
rc.suspend