1#!/bin/sh 2#
| 1#!/bin/sh 2#
|
3# $NetBSD: ipfilter,v 1.8 2000/10/01 05:58:06 lukem Exp $
| 3# $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $ 4# $FreeBSD: head/etc/rc.d/ipfilter 98184 2002-06-13 22:14:37Z gordon $
|
4# 5 6# PROVIDE: ipfilter 7# REQUIRE: root beforenetlkm mountcritlocal tty
| 5# 6 7# PROVIDE: ipfilter 8# REQUIRE: root beforenetlkm mountcritlocal tty
|
| 9# KEYWORD: FreeBSD NetBSD
|
8 9. /etc/rc.subr 10 11name="ipfilter"
| 10 11. /etc/rc.subr 12 13name="ipfilter"
|
12rcvar=$name
| 14rcvar=`set_rcvar` 15load_rc_config $name 16 17case `${CMD_OSTYPE}` in 18FreeBSD) 19 stop_precmd="test -f ${ipfilter_rules}" 20 ;; 21NetBSD) 22 stop_precmd="test -f /etc/ipf.conf -o -f /etc/ipf6.conf" 23 ;; 24esac 25
|
13start_precmd="ipfilter_prestart" 14start_cmd="ipfilter_start"
| 26start_precmd="ipfilter_prestart" 27start_cmd="ipfilter_start"
|
15stop_precmd="test -f /etc/ipf.conf -o -f /etc/ipf6.conf"
| |
16stop_cmd="ipfilter_stop" 17reload_precmd="$stop_precmd" 18reload_cmd="ipfilter_reload"
| 28stop_cmd="ipfilter_stop" 29reload_precmd="$stop_precmd" 30reload_cmd="ipfilter_reload"
|
| 31resync_precmd="$stop_precmd" 32resync_cmd="ipfilter_resync"
|
19status_precmd="$stop_precmd" 20status_cmd="ipfilter_status"
| 33status_precmd="$stop_precmd" 34status_cmd="ipfilter_status"
|
21extra_commands="reload status"
| 35extra_commands="reload resync status"
|
22 23ipfilter_prestart() 24{
| 36 37ipfilter_prestart() 38{
|
| 39case `${CMD_OSTYPE}` in 40FreeBSD) 41 # load ipfilter kernel module if needed 42 if ! sysctl net.inet.ipf.fr_pass > /dev/null 2>&1; then 43 if kldload ipl ; then 44 echo 'IP-filter module loaded.' 45 else 46 warn 'IP-filter module failed to load.' 47 return 1 48 fi 49 fi 50 51 # check for ipfilter rules 52 if [ ! -r "${ipfilter_rules}" ]; then 53 warn 'IP-filter: NO IPF RULES' 54 return 1 55 fi 56 ;; 57NetBSD)
|
25 if [ ! -f /etc/ipf.conf ] && [ ! -f /etc/ipf6.conf ]; then 26 warn "/etc/ipf*.conf not readable; ipfilter start aborted." 27 # 28 # If booting directly to multiuser, send SIGTERM to 29 # the parent (/etc/rc) to abort the boot 30 # 31 if [ "$autoboot" = yes ]; then 32 echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!" 33 kill -TERM $$ 34 exit 1 35 fi 36 return 1 37 fi
| 58 if [ ! -f /etc/ipf.conf ] && [ ! -f /etc/ipf6.conf ]; then 59 warn "/etc/ipf*.conf not readable; ipfilter start aborted." 60 # 61 # If booting directly to multiuser, send SIGTERM to 62 # the parent (/etc/rc) to abort the boot 63 # 64 if [ "$autoboot" = yes ]; then 65 echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!" 66 kill -TERM $$ 67 exit 1 68 fi 69 return 1 70 fi
|
| 71 ;; 72esac
|
38 return 0 39} 40 41ipfilter_start() 42{ 43 echo "Enabling ipfilter."
| 73 return 0 74} 75 76ipfilter_start() 77{ 78 echo "Enabling ipfilter."
|
44 /sbin/ipf -E -Fa 45 if [ -f /etc/ipf.conf ]; then 46 /sbin/ipf -f /etc/ipf.conf 47 fi 48 if [ -f /etc/ipf6.conf ]; then 49 /sbin/ipf -6 -f /etc/ipf6.conf 50 fi
| 79 case `${CMD_OSTYPE}` in 80 FreeBSD) 81 ${ipfilter_program:-/sbin/ipf} -Fa -f \ 82 "${ipfilter_rules}" ${ipfilter_flags} 83 ;; 84 NetBSD) 85 /sbin/ipf -E -Fa 86 if [ -f /etc/ipf.conf ]; then 87 /sbin/ipf -f /etc/ipf.conf 88 fi 89 if [ -f /etc/ipf6.conf ]; then 90 /sbin/ipf -6 -f /etc/ipf6.conf 91 fi 92 ;; 93 esac
|
51} 52 53ipfilter_stop() 54{
| 94} 95 96ipfilter_stop() 97{
|
| 98 case `${CMD_OSTYPE}` in 99 FreeBSD) 100 echo "Saving firewall state tables" 101 ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags} 102 ;; 103 NetBSD) 104 ;; 105 esac 106 # XXX - The following command is not effective for 'lkm's
|
55 echo "Disabling ipfilter." 56 /sbin/ipf -D 57} 58 59ipfilter_reload() 60{ 61 echo "Reloading ipfilter rules." 62
| 107 echo "Disabling ipfilter." 108 /sbin/ipf -D 109} 110 111ipfilter_reload() 112{ 113 echo "Reloading ipfilter rules." 114
|
63 /sbin/ipf -I -Fa 64 if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then 65 err 1 "reload of ipf.conf failed; not swapping to new ruleset." 66 fi 67 if [ -f /etc/ipf6.conf ] && ! /sbin/ipf -I -6 -f /etc/ipf6.conf; then 68 err 1 "reload of ipf6.conf failed; not swapping to new ruleset." 69 fi 70 /sbin/ipf -s
| 115 case `${CMD_OSTYPE}` in 116 FreeBSD) 117 ${ipfilter_program:-/sbin/ipf} -I -Fa -f \ 118 "${ipfilter_rules}" ${ipfilter_flags} 119 ;; 120 NetBSD) 121 /sbin/ipf -I -Fa 122 if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then 123 err 1 "reload of ipf.conf failed; not swapping to" \ 124 " new ruleset." 125 fi 126 if [ -f /etc/ipf6.conf ] && \ 127 ! /sbin/ipf -I -6 -f /etc/ipf6.conf; then 128 err 1 "reload of ipf6.conf failed; not swapping to" \ 129 " new ruleset." 130 fi 131 /sbin/ipf -s 132 ;; 133 esac 134
|
71} 72
| 135} 136
|
| 137ipfilter_resync() 138{ 139 case `${CMD_OSTYPE}` in 140 FreeBSD) 141 # Don't resync if ipfilter is not loaded 142 [ sysctl net.inet.ipf.fr_pass > /dev/null 2>&1 ] && return 143 ;; 144 esac 145 ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags} 146} 147
|
73ipfilter_status() 74{
| 148ipfilter_status() 149{
|
75 /sbin/ipf -V
| 150 ${ipfilter_program:-/sbin/ipf} -V
|
76} 77
| 151} 152
|
78load_rc_config $name
| |
79run_rc_command "$1"
| 153run_rc_command "$1"
|