From 871544b3feadbf2940077327b517b98b443d3304 Mon Sep 17 00:00:00 2001
From: mpf <>
Date: Wed, 9 Jan 2008 21:38:19 +0000
Subject: [PATCH] Do not bring up pfsync(4) before the working ruleset has been
 loaded. Otherwise, states that are received during the initial bulk update
 mismatch the correct pf-checksum and do not attach to the rules. Problem
 identified by david@. Fix done in collaboration. OK henning@

---
 src/etc/netstart | 8 +++-----
 src/etc/rc       | 8 ++++++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/etc/netstart b/src/etc/netstart
index 07dd92da..4b32332e 100644
--- a/src/etc/netstart
+++ b/src/etc/netstart
@@ -1,6 +1,6 @@
 #!/bin/sh -
 #
-#	$OpenBSD: netstart,v 1.116 2007/08/02 03:19:10 david Exp $
+#	$OpenBSD: netstart,v 1.117 2008/01/09 21:38:19 mpf Exp $
 
 # Strip comments (and leading/trailing whitespace if IFS is set)
 # from a file and spew to stdout
@@ -304,10 +304,8 @@ fi
 
 # The trunk interfaces need to come up first in this list.
 # The vlan interfaces need to come up after trunk.
-# The pfsync interfaces need to come up before carp.
-# Configure all the carp interfaces which we know about.
-# They must come up after pfsync but before default route.
-ifmstart "trunk vlan pfsync carp"
+# Configure all the carp interfaces which we know about before default route.
+ifmstart "trunk vlan carp"
 
 # /etc/mygate, if it exists, contains the name of my gateway host
 # that name must be in /etc/hosts.
diff --git a/src/etc/rc b/src/etc/rc
index 6e26e727..e7241e02 100644
--- a/src/etc/rc
+++ b/src/etc/rc
@@ -1,4 +1,4 @@
-#	$OpenBSD: rc,v 1.308 2007/12/07 17:13:35 deraadt Exp $
+#	$OpenBSD: rc,v 1.309 2008/01/09 21:38:19 mpf Exp $
 
 # System startup script run by init on autoboot
 # or after single-user.
@@ -221,7 +221,7 @@ if [ X"${pf}" != X"NO" ]; then
 		RULES="$RULES\npass out inet6 proto icmp6 all icmp6-type routersol"
 		RULES="$RULES\npass in inet6 proto icmp6 all icmp6-type routeradv"
 	fi
-	RULES="$RULES\npass proto { pfsync, carp }"
+	RULES="$RULES\npass proto carp"
 	case `sysctl vfs.mounts.nfs 2>/dev/null` in
 	*[1-9]*)
 		# don't kill NFS
@@ -249,6 +249,10 @@ if [ X"${pf}" != X"NO" ]; then
 	if [ -f ${pf_rules} ]; then
 		pfctl -f ${pf_rules}
 	fi
+	# bring up pfsync after the working ruleset has been loaded
+	if [ -f /etc/hostname.pfsync0 ]; then
+		. /etc/netstart pfsync0
+	fi
 fi
 
 mount -s /usr >/dev/null 2>&1