Hi,
Daniel Hartmeier wrote:
You claimed there was a hole. If you can't explain what it consists of
("thing X might get exposed prior to rc.d/pf due to the following
sequence of events..."),
On FreeBSD 6.1, run rcorder /etc/rc.d/*. You'll notice that
pf is run after netif so if one is using only pf as firewall,
there is a window between run of "netif" and "pf" where network
interfaces are up but there is no firewall loaded. Adding
pf_boot, which runs before "netif" would fix this, woudn't it ?
Please correct me if I'm wrong here (that would be nice since
then there wouldn't be any problem at all).
> blindly sticking in pf_boot at some convenient
place in the boot order is not guaranteed to solve more than it can
break.
I don't think I have been talking about blindly sticking pf_boot
into boot order. I would only like to be sure that there *is* no
hole. I have been suggesting about using pf_boot because it
seeems to be the approach used in other bsds (well, I must admit
that I didn't check how OpenBSD does it, but I know that there
is somekind of boot-time ruleset there). I assumed that since
the pf_boot solution is there possible problems with it had been
ironed out on other bsds.
Even Windows XP has boot-time firewall protection today - we
don't want to be worse than them, do we :-)
Ari S.
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
