From owner-freebsd-security@FreeBSD.ORG  Mon Jul 24 09:29:46 2006
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A378F16A4DF;
	Mon, 24 Jul 2006 09:29:46 +0000 (UTC) (envelope-from harald@clef.at)
Received: from stud3.tuwien.ac.at (stud3.tuwien.ac.at [193.170.75.13])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B0C9643D46;
	Mon, 24 Jul 2006 09:29:45 +0000 (GMT) (envelope-from harald@clef.at)
Received: from bluedaemon.clef.test (v209-200.vps.tuwien.ac.at
	[128.131.209.200])
	by stud3.tuwien.ac.at (8.9.3 (PHNE_29774)/8.9.3) with ESMTP id LAA05207;
	Mon, 24 Jul 2006 11:29:43 +0200 (METDST)
To: "Simon L. Nielsen" <simon@nitro.dk>
References: <44B7715E.8050906@suutari.iki.fi>
	<20060714154729.GA8616@psconsult.nl> <44B7D8B8.3090403@suutari.iki.fi>
	<20060716182315.GC3240@insomnia.benzedrine.cx>
	<20060717122127.GC1087@zaphod.nitro.dk>
From: Harald Muehlboeck <home@clef.at>
Date: Mon, 24 Jul 2006 11:32:36 +0200
Message-ID: <86wta3e4az.fsf@tuha.clef.at>
User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/21.3 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailman-Approved-At: Mon, 24 Jul 2006 11:43:26 +0000
Cc: freebsd-security@freebsd.org, freebsd-pf@freebsd.org
Subject: Re: Any ongoing effort to port /etc/rc.d/pf_boot, /etc/pf.boot.conf
 from NetBSD ?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Jul 2006 09:29:46 -0000

Simon L. Nielsen <simon@nitro.dk> writes:
> On 2006.07.16 20:23:15 +0200, Daniel Hartmeier wrote:
>
>> The "hole" being discussed is the time, during boot, before pf is fully
>> functional with the production ruleset. For a comparatively long time,
>> the pf module isn't even loaded yet. 
>> 
>> So, you first need to check the boot sequence for
>> 
>>   - interfaces being brought up before pf is loaded
>>   - addresses assigned to those interfaces
>>   - daemons starting and listening on those addresses
>>   - route table getting set up
>>   - IP forwarding getting enabled
>>   - etc.
>
> Since nobody else seems to have actually done this, I took a look at
> FreeBSD's rcorder (on my -CURRENT laptop) and actually I don't really
> see a hole.  Most importantly pf is enabled before routing.


> # rcorder -s nostart /etc/rc.d/*
[...]
> /etc/rc.d/ipfilter
> [...]
> /etc/rc.d/sysctl
[...]
> /etc/rc.d/pf
> /etc/rc.d/routing
> [...]

But net.inet.ip.forwarding=1 can also be set in sysctl.conf(5), as
well as many other options like bridging, ... (I don't know if it is
usual to do so)