Index: branches/releng-9.0/nanobsd/files/etc/crontab
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/crontab	(revision 10408)
+++ branches/releng-9.0/nanobsd/files/etc/crontab	(revision 10417)
@@ -26,8 +26,9 @@
 1,31	0-5	*	*	*	root	adjkerntz -a
 #
+# WL NanoBSD Custom Rules
+#
 # Write updates for ntp.drift to flash
-0	12	*	*	*	root	/usr/local/bin/write_ntpdrift
+0	12	*	*	*	root	/usr/local/sbin/store-ntpdrift
 #
 # Nagios checks
-30	*	*	*	*	root	/usr/local/dense/dense.sh
 */15	*	*	*	*	root	/usr/local/sbin/check-inet-alive
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/http302
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/http302	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/http302	(revision 10417)
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# PROVIDE: http301
+# BEFORE: DAEMON
+# KEYWORD: shutdown
+#
+# Add the following line to /etc/rc.conf to enable iperf in server mode:
+#
+# http302_enable="YES"
+#
+. /etc/rc.subr
+
+name=http302
+rcvar=`set_rcvar`
+
+command=/usr/local/bin/tcpserver
+command_args="-R -H -l 0 172.31.255.1 8081 /usr/local/bin/http302 &"
+
+load_rc_config ${name}
+
+http301_enable=${http301_enable-"NO"}
+
+####
+# tcpserver does not generate a pid file
+
+run_rc_command "$1"
+
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/iperf
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/iperf	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/iperf	(revision 10417)
@@ -0,0 +1,29 @@
+#!/bin/sh
+#
+# PROVIDE: iperf
+# BEFORE: DAEMON
+# KEYWORD: shutdown
+#
+# Add the following line to /etc/rc.conf to enable iperf in server mode:
+#
+# iperf_enable="YES"
+#
+. /etc/rc.subr
+
+name=iperf
+rcvar=`set_rcvar`
+
+command=/usr/local/bin/iperf
+command_args="-s -D"
+
+load_rc_config ${name}
+
+iperf_enable=${iperf_enable-"NO"}
+
+####
+# iperf does not generate a pid file
+# iperf_pidfile=${iperf_pidfile-"/var/run/.pid"}
+# pidfile="${iperf_pidfile}"
+
+run_rc_command "$1"
+
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/lvrouted
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/lvrouted	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/lvrouted	(revision 10417)
@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# PROVIDE: lvrouted
+# REQUIRE: netif routing
+# KEYWORD: nojail
+
+lvrouted_enable=${lvrouted_enable:-"NO"}
+lvrouted_flags=${lvrouted_flags:-}
+
+. /etc/rc.subr
+
+name="lvrouted"
+rcvar=`set_rcvar`
+load_rc_config $name
+
+command="/usr/local/sbin/${name}"
+pid_file="/var/run/${name}.pid" 
+
+# Import proxies
+wleiden_conf="/usr/local/etc/wleiden.conf"
+if [ -r $wleiden_conf ]; then
+  . ${wleiden_conf}
+fi
+
+# If there are proxies specified, them add them with the z flag
+if [ -n "$PROXIES" ]; then
+  PROXIES=`echo ${PROXIES} | sed 's/\ /\,/g'`
+  lvrouted_flags="$lvrouted_flags -z $PROXIES"
+fi
+
+start_precmd="lvrouted_flush_routes"
+
+# XXX: Needs to be a flag to disable
+# XXX: lvrouted should mark their added routed protocol specific (see: man 8 route)
+# lvrouted requires no route to exists before start as it is not able to alter
+# old routes, so make it flush all dynamic generated routes
+lvrouted_flush_routes() {
+	
+	# XXX: Does the looping bug still exists?
+	# Keep looping till we whiped _all_ dynamic generated routes
+	while true; do
+		netstat -nr -f inet | awk '{if ($3 ~ /.*D.*/) { exit 1} }'
+		if [ $? -eq 0 ]; then
+			break
+		fi
+		echo "WARNING: Flushing all existing DYNAMIC routes" 1>&2
+		netstat -nr -f inet | awk '{if ($3 ~ /.*D.*/) {print $1} }' | xargs -n 1 route delete
+	done
+} 
+	
+run_rc_command "$1"
+
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-motd
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-motd	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-motd	(revision 10417)
@@ -0,0 +1,61 @@
+#!/bin/sh
+#
+# $FreeBSD: src/etc/rc.d/motd,v 1.9.10.1.4.1 2009/04/15 03:14:26 kensmith Exp $
+#
+
+# PROVIDE: nanobsd-motd
+# REQUIRE: mountcritremote
+# BEFORE:  LOGIN
+
+. /etc/rc.subr
+
+name="nanobsd_motd"
+rcvar="update_nanobsd_motd"
+start_cmd="motd_start"
+stop_cmd=":"
+
+PERMS="644"
+
+motd_start()
+{
+	#	Update kernel info in /etc/motd
+	#	Must be done *before* interactive logins are possible
+	#	to prevent possible race conditions.
+	#
+	echo -n 'Updating motd'
+	if [ ! -f /etc/motd ]; then
+		install -c -o root -g wheel -m ${PERMS} /dev/null /etc/motd
+	fi
+
+	if [ ! -w /etc/motd ]; then
+		echo ' ... /etc/motd is not writable, update failed.'
+		return
+	fi
+
+	T=`mktemp -t motd`
+	uname -v | sed -e 's,^\([^#]*\) #\(.* [1-2][0-9][0-9][0-9]\).*/\([^\]*\) $,\1 (\3) #\2,' > ${T}
+	awk '{if (NR == 1) {if ($1 == "FreeBSD") {next} else {print "\n"$0}} else {print}}' < /etc/motd >> ${T}
+
+	cmp -s $T /etc/motd || {
+                # XXX: Hack quick and dirty combine of /etc/rc.d/motd and /tools/savesshkeys
+		trap "umount /cfg" 1 2 15 EXIT
+		mount /cfg
+		cp $T /cfg/motd
+		chmod ${PERMS} /etc/motd
+		umount /cfg
+		trap 1 2 15 EXIT
+
+		trap "mount -uro noatime /" 1 2 15 EXIT
+		mount -uwo noatime /
+		cp $T /etc/motd
+		chmod ${PERMS} /etc/motd
+                mount -uro noatime /
+		trap 1 2 15 EXIT
+	}
+	rm -f $T
+
+	echo .
+}
+
+load_rc_config $name
+run_rc_command "$1"
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-save-sshkeys
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-save-sshkeys	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/nanobsd-save-sshkeys	(revision 10417)
@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# $FreeBSD: ports/net/pen/files/pen.sh.in,v 1.1 2006/09/24 14:34:36 clement Exp $
+#
+
+# PROVIDE: pen
+# REQUIRE: NETWORKING SERVERS sshd
+# KEYWORD: shutdown
+
+#
+# Add the following line to /etc/rc.conf to enable nanobsd-save-sshkeys:
+#
+# nanobsd_save_sshkeys_enable="YES"
+#
+
+. /etc/rc.subr
+
+name=nanobsd_save_sshkeys
+rcvar=`set_rcvar`
+
+nanobsd_save_sshkeys_enable=${nanobsd_save_sshkeys_enable:-"NO"}
+
+start_cmd="save_sshkeys"
+stop_cmd="save_sshkeys"
+
+save_sshkeys() {
+	MOUNTED_RW=0
+	trap "umount /cfg" 1 2 15 EXIT
+	mount -ro noatime /cfg
+        for FILE in /etc/ssh/ssh_host_*; do
+		cmp -s $FILE /cfg/ssh/`basename ${FILE}`
+		if [ $? -ne 0 ]; then
+			if [ ${MOUNTED_RW} -eq 0 ]; then
+			 	mount -uwo noatime /cfg
+				mkdir -p /cfg/ssh
+				MOUNTED_RW=1
+			fi
+			cp $FILE /cfg/ssh/`basename ${FILE}`
+		fi
+	done
+
+	umount /cfg
+	trap 1 2 15 EXIT
+}
+
+
+load_rc_config $name
+run_rc_command "$1"
+
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/pen_wrapper
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/pen_wrapper	(revision 10417)
+++ branches/releng-9.0/nanobsd/files/etc/local/rc.d/pen_wrapper	(revision 10417)
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# $FreeBSD: ports/net/pen/files/pen.sh.in,v 1.1 2006/09/24 14:34:36 clement Exp $
+#
+
+# PROVIDE: pen_wrapper
+# REQUIRE: NETWORKING SERVERS
+# BEFORE: DAEMON
+# KEYWORD: shutdown
+
+#
+# Add the following line to /etc/rc.conf to enable pen:
+#
+# pen_wrapper_enable="YES"
+#
+
+. /etc/rc.subr
+
+pen_wrapper_cmd() {
+	${command_interpreter} ${command} &
+}
+
+name=pen_wrapper
+rcvar=`set_rcvar`
+start_cmd=${name}_cmd
+
+command_interpreter="/bin/sh"
+command=/usr/local/bin/pen_wrapper
+
+pen_wrapper_enable=${pen_wrapper_enable:-"NO"}
+pen_wrapper_flags=${pen_wrapper_flags:-""}
+
+load_rc_config $name
+run_rc_command "$1"
Index: branches/releng-9.0/nanobsd/files/etc/local/rc.d/pf2
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/local/rc.d/pf2	(revision 10408)
+++ 	(revision )
@@ -1,24 +1,0 @@
-#!/bin/sh
-#
-# PROVIDE: pf2
-# BEFORE: lvrouted
-# KEYWORD: shutdown
-#
-#
-# http302_enable="YES"
-#
-. /etc/rc.subr
-
-name=pf2
-rcvar=`set_rcvar`
-
-command=/etc/rc.d/pf
-command_args="onestart"
-
-load_rc_config ${name}
-
-pf2_enable=${pf2_enable-"NO"}
-
-
-run_rc_command "$1"
-
Index: branches/releng-9.0/nanobsd/files/etc/newsyslog.conf
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/newsyslog.conf	(revision 10408)
+++ branches/releng-9.0/nanobsd/files/etc/newsyslog.conf	(revision 10417)
@@ -37,10 +37,10 @@
 /var/log/wtmp				644  3	   *	@01T05 B
 /var/log/xferlog			600  7	   100	*     JC
+#
+# WL NanoBSD Custom Log Files. As-rule-of-thumb, use syslog(4) instead custom
+# created logfile because of locking issues.
+#
+/var/log/wlportal.log			664  3     100  *     J /var/run/wlportal.pid
+/var/log/snmpd.log                      644  3     100  *     J /var/run/snmpd.pid
+/var/log/thttpd.log                     644  3     100  *     J
 /var/log/pen_wrapper.log                644  3     100  *     J
-/var/log/wlportal.log			664  3     100  *     J /var/run/wlportal.pid
-/var/log/wlweb-access.log		644  3     100  *     J
-/var/log/wlweb-error.log		644  3     100  *     J
-/var/log/snmpd.log                      644  3     100  *     J /var/run/snmpd.pid
-/var/log/thttpd.log			644  3     100  *     J /var/run/thttpd.pid
-
-
Index: branches/releng-9.0/nanobsd/files/etc/pf.conf
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/pf.conf	(revision 10408)
+++ branches/releng-9.0/nanobsd/files/etc/pf.conf	(revision 10417)
@@ -1,11 +1,8 @@
-wifi_if="wlan0"
 all_node="172.31.255.1/32"
-
 wl_net="172.16.0.0/12"
-vpn_net="172.17.64.0/28"
 allow_ext_tcp="{22}"
 allow_ext_udp="{161}"
-allow_int_tcp="{22,53,80,3128}"
-allow_int_udp="{53,131,161,12345}"
+allow_int_tcp="{22,3128}"
+allow_int_udp="{53,161,12345}"
 allow_int_udp_any="{67}"
 
@@ -18,22 +15,18 @@
 nat on $int_if from $private to $wl_net -> ($int_if)
 
+# Redirection, needs source natting and allow rules
+#rdr on $ext_if inet proto tcp from any to $ext_if port 1022 -> 192.168.84.1 port 22    
+
 # Block all
-block in on $ext_if
-pass in on $int_if
+block in on $ext_if from any to $ext_if
+block in on $int_if from any to $int_if
 
-# Allow wl access from access point (not yet reversed)
-pass on $wifi_if from $wl_net to $wl_net
-
-# Block this device from wifi
-block in on $wifi_if inet from any to $wifi_if
-block inet from any to $all_node
-
+# Allow private to private
 # Enable me to access anything
-pass out on {$ext_if, $int_if, $wifi_if} keep state
+pass out on {$ext_if, $int_if} keep state
 
 # Allow internet access from the network
-pass in on $wifi_if inet proto tcp from $wl_net to any port $publicnat keep state
-block in on $wifi_if inet proto tcp from $wl_net to $wifi_if port $publicnat
-block in on $wifi_if inet proto tcp from $wl_net to $all_node port $publicnat
+pass in on $int_if inet proto tcp from $wl_net to any port $publicnat keep state
+block in on $int_if inet proto tcp from $wl_net to $int_if port $publicnat
 
 # Allow directives 
@@ -41,13 +34,7 @@
 pass in on $ext_if inet proto udp from any to $ext_if port $allow_ext_udp keep state
 
-pass in on $int_if inet proto tcp from $wl_net to $vpn_net port $allow_int_tcp keep state
-pass in on $int_if inet proto udp from $wl_net to $vpn_net port $allow_int_udp keep state
-pass in on $int_if inet proto icmp from $wl_net to $vpn_net keep state
-pass in on $int_if inet proto udp from any to any port $allow_int_udp_any keep state
-
-pass in on $wifi_if inet proto tcp from $wl_net to $wl_net port $allow_int_tcp keep state
-pass in on $wifi_if inet proto udp from $wl_net to $wl_net port $allow_int_udp keep state
-pass in on $wifi_if inet proto icmp from $wl_net to $wl_net keep state
-pass in on $wifi_if inet proto udp from any to any port $allow_int_udp_any keep state
+pass in on $int_if inet proto tcp from $wl_net to $int_if port $allow_int_tcp keep state
+pass in on $int_if inet proto udp from $wl_net to $int_if port $allow_int_udp keep state
+pass in on $int_if inet proto icmp from $wl_net to $int_if keep state
 
 # Allow wl access from local network
@@ -55,5 +42,6 @@
 
 # Make sure to block local network access from wl
-block on $wifi_if from $wl_net to $private
 block on $int_if from $wl_net to $private
 
+# Otherwise lvrouted breaks:
+pass in on $int_if
Index: branches/releng-9.0/nanobsd/files/etc/pf.conf.ileiden
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/pf.conf.ileiden	(revision 10408)
+++ 	(revision )
@@ -1,63 +1,0 @@
-ext_if="sis0"
-int_if="tap0" 
-wifi_if="wlan0"
-all_node="172.31.255.1/32"
-
-wl_net="172.16.0.0/12"
-vpn_net="172.17.64.0/28"
-
-publicnat="{80, 443, 22}"
-allow_ext_tcp="{22}"
-allow_ext_udp="{161}"
-allow_int_tcp="{22,53,80,3128}"
-allow_int_udp="{53,131,161,12345}"
-allow_int_udp_any="{67}"
-
-private="{ 10.0.0.0/8 , 192.168.0.0/16 }"
-
-# Nat the internet
-nat on $ext_if from $wl_net to any port $publicnat -> ($ext_if) 
-
-# Nat local wl access
-nat on $int_if from $private to $wl_net -> ($int_if)
-
-# Block all
-block in on $ext_if
-pass in on $int_if
-
-# Allow wl access from access point (not yet reversed)
-pass on $wifi_if from $wl_net to $wl_net
-
-# Block this device from wifi
-block in on $wifi_if inet from any to $wifi_if
-block inet from any to $all_node
-
-# Enable me to access anything
-pass out on {$ext_if, $int_if, $wifi_if} keep state
-
-# Allow internet access from the network
-pass in on $wifi_if inet proto tcp from $wl_net to any port $publicnat keep state
-block in on $wifi_if inet proto tcp from $wl_net to $wifi_if port $publicnat
-block in on $wifi_if inet proto tcp from $wl_net to $all_node port $publicnat
-
-# Allow directives 
-pass in on $ext_if inet proto tcp from any to $ext_if port $allow_ext_tcp keep state
-pass in on $ext_if inet proto udp from any to $ext_if port $allow_ext_udp keep state
-
-pass in on $int_if inet proto tcp from $wl_net to $vpn_net port $allow_int_tcp keep state
-pass in on $int_if inet proto udp from $wl_net to $vpn_net port $allow_int_udp keep state
-pass in on $int_if inet proto icmp from $wl_net to $vpn_net keep state
-pass in on $int_if inet proto udp from any to any port $allow_int_udp_any keep state
-
-pass in on $wifi_if inet proto tcp from $wl_net to $wl_net port $allow_int_tcp keep state
-pass in on $wifi_if inet proto udp from $wl_net to $wl_net port $allow_int_udp keep state
-pass in on $wifi_if inet proto icmp from $wl_net to $wl_net keep state
-pass in on $wifi_if inet proto udp from any to any port $allow_int_udp_any keep state
-
-# Allow wl access from local network
-pass on $ext_if from $private to $wl_net keep state
-
-# Make sure to block local network access from wl
-block on $wifi_if from $wl_net to $private
-block on $int_if from $wl_net to $private
-
Index: branches/releng-9.0/nanobsd/files/etc/rc.conf
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/rc.conf	(revision 10408)
+++ branches/releng-9.0/nanobsd/files/etc/rc.conf	(revision 10417)
@@ -1,6 +1,6 @@
-## Building options
-dumpdev="NO"			# No kernel dumps as we don't have a place to
-				# store them 
-ipv6_network_interfaces="NONE"	# No IPv6 support for now, near feature... ;-)
+# No kernel dumps as we don't have a place to store them 
+dumpdev="NO"			
+# We are an router/gateway (wireless to be precise)
+gateway_enable="YES"
 
 # NTP server needs working config with WL network or internet on boot
@@ -24,9 +24,4 @@
 sshd_flags="-u0"
 
-# Don't update the motd as it not writeable, the update_nanobsd_motd is a
-# simple wrapper found at /usr/local/etc/rc.d supporting this featureg
-update_motd="NO"
-update_nanobsd_motd="YES"
-
 # Monitoring deamons
 nrpe2_enable="YES"
@@ -40,19 +35,22 @@
 nanobsd_save_sshkeys_enable="YES"
 
-## Port extentions
-# Serve our clients some pretty cool IP address to at least get connected
-# Also some low-memory footprint dns resolver
+# low-memory footprint DHCP and non-autoritive recursive DNS resolver
 dnsmasq_enable="YES"
+
+# Explicitly disable the memory-hungry alternatives
+dhcpd_enable="NO"
+named_enable="NO"
 named_auto_forward="YES"
-named_enable="NO"
 
-## WL ports extentions
+# WL Captive Portal and WL Web Config Overview
 thttpd_enable="YES"
 http302_enable="YES"
 
-# Make sure generated ssh keys are saved 
-nanobsd_save_sshkeys_enable="YES"
+# Hybrid setup, requires outgoing VPN Server
+openvpn_enable="NO"
+openvpn_if="tap"
 
-#Hybrid
-openvpn_enable="YES"
-openvpn_if="tap"
+# Enable the firewall by default
+pf_enable="YES"
+pf_rules="/etc/pf.default.conf"
+pf_flags="-D ext_if=vr0 -D int_if=vr1 -D publicnat={80,443}"
Index: branches/releng-9.0/nanobsd/files/etc/syslog.conf
===================================================================
--- branches/releng-9.0/nanobsd/files/etc/syslog.conf	(revision 10408)
+++ branches/releng-9.0/nanobsd/files/etc/syslog.conf	(revision 10417)
@@ -31,2 +31,4 @@
 !ppp
 *.*						/var/log/ppp.log
+!thttpd
+*.*						/var/log/thttpd.log
