rtems/rtems-libbsd
1
0
Fork 0
mirror of https://git.rtems.org/rtems-libbsd/ synced 2025-06-03 15:59:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

libbsd.txt: Move PF description

Browse Source
This commit is contained in:
Sebastian Huber 2022-05-23 15:21:17 +02:00
parent c80453238b
commit 56fe2fd56e
2 changed files with 52 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
README.rst
View File

@ -396,6 +396,58 @@ HOSTNAME(1)
resolver instance. See also ``rtems_mdns_sethostname()`` and
``rtems_mdns_gethostname()``.
Packet Filter (PF, Firewall)
============================
It is possible to use PF as a firewall. See the
`FreeBSD Handbook <https://docs.freebsd.org/en/books/handbook/firewalls/#firewalls-pf>`_
for details on the range of functions and for how to configure the firewall.
Configuration
-------------
The following is necessary to use PF on RTEMS:
* You have to provide a ``/etc/pf.os`` file. The firewall can use it for passive
OS fingerprinting. If you don't want to use this feature, the file may contain
nothing except a line of comment (for example "# empty").
* If some filters use protocol names (like ``tcp`` or ``udp``) you have to provide a
``/etc/protocols`` file.
* If some filters use service names (like ``http`` or ``https``) you have to provide a
``/etc/services`` file.
* Create a rule file (normally ``/etc/pf.conf``). See the FreeBSD manual for the
syntax.
* Load the rule file using the
`pfctl <http://www.freebsd.org/cgi/man.cgi?query=pfctl&sektion=8>`_
command and enable PF. Please note that the pfctl command needs a lot of
stack. You should use at least RTEMS_MINIMUM_STACK_SIZE + 8192 Bytes of
stack. An example initialisation can look like follows:
.. code-block:: c
int exit_code;
char *argv[] = {
"pfctl",
"-f",
"/etc/pf.conf",
"-e",
NULL
};
exit_code = rtems_bsd_command_pfctl(ARGC(argv), argv);
assert(exit_code == EXIT_SUCCSESS);
Known Restrictions
------------------
Currently, PF on RTEMS always uses the configuration for memory restricted
systems (on FreeBSD that means systems with less than 100 MB RAM). This is
fixed in ``pfctl_init_options()``.
Updating RTEMS Waf Support
==========================

46
libbsd.txt
View File

@ -321,52 +321,6 @@ structure that were not being used were conditionally compiled out. The
capability of supporting children did not appear to be needed and was
not implemented in the rtems version of these routines.
== PF (Firewall) ==
It is possible to use PF as a firewall. See
[https://www.freebsd.org/doc/handbook/firewalls-pf.html] for details on the
range of functions and for how to configure the firewall.
The following is necessary to use PF on RTEMS:
- You have to provide a +/etc/pf.os+ file. The firewall can use it for passive
OS fingerprinting. If you don't want to use this feature, the file may contain
nothing except a line of comment (for example "# empty").
- If some filters use protocol names (like tcp or udp) you have to provide a
+/etc/protocols+ file.
- If some filters use service names (like ssh or http) you have to provide a
+/etc/services+ file.
- Create a rule file (normally +/etc/pf.conf+). See the FreeBSD manual for the
syntax.
- Load the rule file using the pfctl command and enable pf. Please note that the
pfctl command needs a lot of stack. You should use at least
RTEMS_MINIMUM_STACK_SIZE + 8192 Bytes of stack. An example initialisation can
look like follows:
----
int exit_code;
char *params[] = {
"pfctl",
"-f",
"/etc/pf.conf",
"-e",
NULL
};
exit_code = rtems_bsd_command_pfctl(ARGC(params), params);
assert(exit_code == EXIT_SUCCSESS);
----
=== Known restrictions ===
- Currently PF on RTEMS always uses the configuration for memory restricted
systems (on FreeBSD that means systems with less than 100 MB RAM). This is
fixed in +pfctl_init_options()+.
== Wireless Network (WLAN) ==
The libbsd provides a basic support for WLAN. Note that currently this support