svn commit: r331289 - stable/10/etc/rc.d
Kristof Provost
kp at FreeBSD.org
Wed Mar 21 09:57:30 UTC 2018
Author: kp
Date: Wed Mar 21 09:57:29 2018
New Revision: 331289
URL: https://svnweb.freebsd.org/changeset/base/331289
Log:
MFC 330105:
pf: Do not flush on reload
pfctl only takes the last '-F' argument into account, so this never did what
was intended.
Moreover, there is no reason to flush rules before reloading, because pf keeps
track of the rule which created a given state. That means that existing
connections will keep being processed according to the rule which originally
created them. Simply reloading the (new) rules suffices. The new rules will
apply to new connections.
PR: 127814
Submitted by: Andreas Longwitz <longwitz at incore.de>
Modified:
stable/10/etc/rc.d/pf
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/etc/rc.d/pf
==============================================================================
--- stable/10/etc/rc.d/pf Wed Mar 21 09:57:05 2018 (r331288)
+++ stable/10/etc/rc.d/pf Wed Mar 21 09:57:29 2018 (r331289)
@@ -53,9 +53,6 @@ pf_reload()
{
echo "Reloading pf rules."
$pf_program -n -f "$pf_rules" $pf_flags || return 1
- # Flush everything but existing state entries that way when
- # rules are read in, it doesn't break established connections.
- $pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1
$pf_program -f "$pf_rules" $pf_flags
}
More information about the svn-src-stable-10
mailing list