ipfilter revision 121067 
1#!/bin/sh
2#
3# $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $
4# $FreeBSD: head/etc/rc.d/ipfilter 121067 2003-10-13 08:20:55Z dougb $
5#
6
7# PROVIDE: ipfilter
8# REQUIRE: root beforenetlkm mountcritlocal ipmon
9# BEFORE:  netif
10# KEYWORD: FreeBSD NetBSD
11
12. /etc/rc.subr
13
14name="ipfilter"
15rcvar=`set_rcvar`
16load_rc_config $name
17
18case ${OSTYPE} in
19FreeBSD)
20	stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
21	;;
22NetBSD)
23	stop_precmd="test -f /etc/ipf.conf -o -f /etc/ipf6.conf"
24	;;
25esac
26
27start_precmd="ipfilter_prestart"
28start_cmd="ipfilter_start"
29stop_cmd="ipfilter_stop"
30reload_precmd="$stop_precmd"
31reload_cmd="ipfilter_reload"
32resync_precmd="$stop_precmd"
33resync_cmd="ipfilter_resync"
34status_precmd="$stop_precmd"
35status_cmd="ipfilter_status"
36extra_commands="reload resync status"
37
38ipfilter_prestart()
39{
40case ${OSTYPE} in
41FreeBSD)
42	# load ipfilter kernel module if needed
43	if ! kldstat -v | grep "IP Filter" > /dev/null 2>&1; then
44		if kldload ipl; then
45			info 'IP-filter module loaded.'
46		else
47			err 1 'IP-filter module failed to load.'
48		fi
49	fi
50
51	# check for ipfilter rules
52	if [ ! -r "${ipfilter_rules}" ] && [ ! -r "${ipv6_ipfilter_rules}" ]
53	then
54		warn 'IP-filter: NO IPF RULES'
55		return 1
56	fi
57	;;
58NetBSD)
59	if [ ! -f /etc/ipf.conf ] && [ ! -f /etc/ipf6.conf ]; then
60		warn "/etc/ipf*.conf not readable; ipfilter start aborted."
61			#
62			# If booting directly to multiuser, send SIGTERM to
63			# the parent (/etc/rc) to abort the boot
64			#
65		if [ "$autoboot" = yes ]; then
66			echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!"
67			kill -TERM $$
68			exit 1
69		fi
70		return 1
71	fi
72	;;
73esac
74	return 0
75}
76
77ipfilter_start()
78{
79	echo "Enabling ipfilter."
80	case ${OSTYPE} in
81	FreeBSD)
82		if [ `sysctl -n net.inet.ipf.fr_running` -eq 0 ]; then
83			${ipfilter_program:-/sbin/ipf} -E
84		fi
85		${ipfilter_program:-/sbin/ipf} -Fa
86		if [ -r "${ipfilter_rules}" ]; then
87			${ipfilter_program:-/sbin/ipf} \
88			    -f "${ipfilter_rules}" ${ipfilter_flags}
89		fi
90		${ipfilter_program:-/sbin/ipf} -6 -Fa
91		if [ -r "${ipv6_ipfilter_rules}" ]; then
92			${ipfilter_program:-/sbin/ipf} -6 \
93			    -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
94		fi
95		;;
96	NetBSD)
97		/sbin/ipf -E -Fa
98		if [ -f /etc/ipf.conf ]; then
99			/sbin/ipf -f /etc/ipf.conf
100		fi
101		if [ -f /etc/ipf6.conf ]; then
102			/sbin/ipf -6 -f /etc/ipf6.conf
103		fi
104		;;
105	esac
106}
107
108ipfilter_stop()
109{
110	# XXX - The ipf -D command is not effective for 'lkm's
111	if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then
112		case ${OSTYPE} in
113		FreeBSD)
114			echo "Saving firewall state tables"
115			${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
116			echo "Disabling ipfilter."
117			${ipfilter_program:-/sbin/ipf} -D
118			;;
119		NetBSD)
120			echo "Disabling ipfilter."
121			/sbin/ipf -D
122			;;
123		esac
124	fi
125}
126
127ipfilter_reload()
128{
129	echo "Reloading ipfilter rules."
130
131	case ${OSTYPE} in
132	FreeBSD)
133		${ipfilter_program:-/sbin/ipf} -I -Fa
134		if [ -r "${ipfilter_rules}" ]; then
135			${ipfilter_program:-/sbin/ipf} -I \
136			    -f "${ipfilter_rules}" ${ipfilter_flags}
137		fi
138		${ipfilter_program:-/sbin/ipf} -I -6 -Fa
139		if [ -r "${ipv6_ipfilter_rules}" ]; then
140			${ipfilter_program:-/sbin/ipf} -I -6 \
141			    -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
142		fi
143		${ipfilter_program:-/sbin/ipf} -s
144		;;
145	NetBSD)
146		/sbin/ipf -I -Fa
147		if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then
148			err 1 "reload of ipf.conf failed; not swapping to" \
149			    " new ruleset."
150		fi
151		if [ -f /etc/ipf6.conf ] && \
152		    ! /sbin/ipf -I -6 -f /etc/ipf6.conf; then
153			err 1 "reload of ipf6.conf failed; not swapping to" \
154			    " new ruleset."
155		fi
156		/sbin/ipf -s
157		;;
158	esac
159
160}
161
162ipfilter_resync()
163{
164	case ${OSTYPE} in
165	FreeBSD)
166		# Don't resync if ipfilter is not loaded
167		if ! kldstat -v | grep "IP Filter" > /dev/null 2>&1; then
168			 return
169		fi
170		;;
171	esac
172	${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
173}
174
175ipfilter_status()
176{
177	${ipfilter_program:-/sbin/ipf} -V
178}
179
180run_rc_command "$1"
181