pf revision 150516
142629Sobrien#!/bin/sh 242629Sobrien# 342629Sobrien# $FreeBSD: head/etc/rc.d/pf 150516 2005-09-24 15:57:17Z pjd $ 438494Sobrien# 542629Sobrien 6174294Sobrien# PROVIDE: pf 742629Sobrien# REQUIRE: root mountcritlocal netif pflog 8174294Sobrien# BEFORE: DAEMON LOGIN 9174294Sobrien# KEYWORD: nojail 10174294Sobrien 1142629Sobrien. /etc/rc.subr 1242629Sobrien 1342629Sobrienname="pf" 1442629Sobrienrcvar=`set_rcvar` 1542629Sobrienload_rc_config $name 1642629Sobrienstop_precmd="test -f ${pf_rules}" 1742629Sobrienstart_precmd="pf_prestart" 1842629Sobrienstart_cmd="pf_start" 1942629Sobrienstop_cmd="pf_stop" 2042629Sobriencheck_precmd="$stop_precmd" 2142629Sobriencheck_cmd="pf_check" 2242629Sobrienreload_precmd="$stop_precmd" 2342629Sobrienreload_cmd="pf_reload" 2442629Sobrienresync_precmd="$stop_precmd" 2542629Sobrienresync_cmd="pf_resync" 2642629Sobrienstatus_precmd="$stop_precmd" 27174294Sobrienstatus_cmd="pf_status" 28174294Sobrienextra_commands="check reload resync status" 29174294Sobrien 3042629Sobrienpf_prestart() 3142629Sobrien{ 3242629Sobrien # load pf kernel module if needed 33174294Sobrien if ! kldstat -q -m pf ; then 34119679Smbr if kldload pf ; then 35174294Sobrien info 'pf module loaded.' 36174294Sobrien else 3742629Sobrien err 1 'pf module failed to load.' 3882794Sobrien fi 3982794Sobrien fi 4082794Sobrien 4182794Sobrien # check for pf rules 4282794Sobrien if [ ! -r "${pf_rules}" ]; then 4342629Sobrien warn 'pf: NO PF RULESET FOUND' 4482794Sobrien return 1 4582794Sobrien fi 4642629Sobrien} 4742629Sobrien 4842629Sobrienpf_start() 4942629Sobrien{ 50119679Smbr echo "Enabling pf." 51119679Smbr ${pf_program:-/sbin/pfctl} -Fa > /dev/null 2>&1 5242629Sobrien ${pf_program:-/sbin/pfctl} -f "${pf_rules}" ${pf_flags} 5342629Sobrien if ! ${pf_program:-/sbin/pfctl} -si | grep -q "Enabled" ; then 5482794Sobrien ${pf_program:-/sbin/pfctl} -e 55174294Sobrien fi 56174294Sobrien} 57174294Sobrien 58174294Sobrienpf_stop() 59174294Sobrien{ 6038494Sobrien if ${pf_program:-/sbin/pfctl} -si | grep -q "Enabled" ; then 61174294Sobrien echo "Disabling pf." 6242629Sobrien ${pf_program:-/sbin/pfctl} -d 6338494Sobrien fi 6438494Sobrien} 6538494Sobrien 6638494Sobrienpf_check() 6742629Sobrien{ 6838494Sobrien echo "Checking pf rules." 6938494Sobrien 70174294Sobrien ${pf_program:-/sbin/pfctl} -n -f "${pf_rules}" 71174294Sobrien} 72174294Sobrien 73174294Sobrienpf_reload() 74174294Sobrien{ 75174294Sobrien echo "Reloading pf rules." 76174294Sobrien 77174294Sobrien ${pf_program:-/sbin/pfctl} -n -f "${pf_rules}" || return 1 7838494Sobrien # Flush everything but existing state entries that way when 7938494Sobrien # rules are read in, it doesn't break established connections. 8038494Sobrien ${pf_program:-/sbin/pfctl} -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1 8138494Sobrien ${pf_program:-/sbin/pfctl} -f "${pf_rules}" ${pf_flags} 8238494Sobrien} 8338494Sobrien 8438494Sobrienpf_resync() 8542629Sobrien{ 8642629Sobrien # Don't resync if pf is not loaded 87174294Sobrien kldstat -q -m pf && ${pf_program:-/sbin/pfctl} -f "${pf_rules}" ${pf_flags} 88174294Sobrien} 89174294Sobrien 9038494Sobrienpf_status() 91174294Sobrien{ 92174294Sobrien ${pf_program:-/sbin/pfctl} -si 93174294Sobrien} 9438494Sobrien 95174294Sobrienrun_rc_command "$1" 96174294Sobrien