[Bug 256410] pf: Add pf_default_rules option

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256410

--- Comment #12 from Thomas Steen Rasmussen / Tykling <thomas@gibfest.dk> ---
Proposed updated commit message: 
-----------------------------------------------------------------------
pf: Support loading default pf ruleset in case of invalid pf.conf using
pf_default_rules_enable, pf_default_rules and pf_default_rules_file.

When no pf rules are loaded pf will pass/allow all traffic, if the kernel is
compiled without PF_DEFAULT_TO_DROP, which is the case in GENERIC.

This commit introduces a "pf default rules" concept to minimise the impact if a
typo in pf.conf makes loading the primary firewall ruleset impossible on boot
or pf restart.

The new code checks the exit code of the $pf_program (pfctl) command when
loading pf.conf inside pf_start() in /etc/rc.d/pf.

After this commit, if the exit code is 1 and pf_default_rules_enable is YES,
then the default rules are loaded. If the file $pf_default_rules_file exists
the rules in it are loaded, otherwise the rules defined in $pf_default_rules
are loaded instead. $pf_default_rules defaults to a single rule: "block drop
log all", $pf_default_rules_file defaults to the path "/etc/pf-default.conf".

This commit also introduces new warn() calls when /etc/rc.d/pf fails to load
the pf ruleset in pf_start().

pf_default_rules can include multiple rules, for example to permit traffic on a
management interface. Seperate multiple rules with \n:

$ sudo sysrc pf_default_rules
pf_default_rules: block drop log all\npass quick on em0
$

The $pf_default_rules, $pf_default_rules_file and $pf_default_rules_enable
variables are defined in /etc/defaults/rc.conf with the following lines,
preserving the existing functionality (apart from the new log messages):

pf_default_rules_enable="NO"    # fallback to $pf_default_rules if loading
ruleset fails
pf_default_rules="block drop log all"   # block and drop everything if loading
pf ruleset fails
pf_default_rules_file="/etc/pf-default.conf"    # use this file if it exists
and loading the primary fails

PR:                     256410
Reported by:            Thomas Steen Rasmussen
Reviewed by:            kp@
Sponsored by:           semaphor.dk
-----------------------------------------------------------------------

:)

-- 
You are receiving this mail because:
You are the assignee for the bug.