blacklistd-helper revision 301172
1168404Spjd#!/bin/sh 2168404Spjd#echo "run $@" 1>&2 3168404Spjd#set -x 4168404Spjd# $1 command 5168404Spjd# $2 rulename 6168404Spjd# $3 protocol 7168404Spjd# $4 address 8168404Spjd# $5 mask 9168404Spjd# $6 port 10168404Spjd# $7 id 11168404Spjd 12168404Spjdpf= 13168404Spjdfor f in npf pf; do 14168404Spjd if [ -f "/etc/$f.conf" ]; then 15168404Spjd pf="$f" 16168404Spjd break 17168404Spjd fi 18168404Spjddone 19168404Spjd 20168404Spjdif [ -z "$pf" ]; then 21168404Spjd echo "$0: Unsupported packet filter" 1>&2 22219089Spjd exit 1 23168404Spjdfi 24168404Spjd 25219089Spjdif [ -n "$3" ]; then 26168404Spjd proto="proto $3" 27168404Spjdfi 28168404Spjd 29168404Spjdif [ -n "$6" ]; then 30168404Spjd port="port $6" 31168404Spjdfi 32168404Spjd 33168404Spjdaddr="$4" 34219089Spjdmask="$5" 35168404Spjdcase "$4" in 36185029Spjd::ffff:*.*.*.*) 37185029Spjd if [ "$5" = 128 ]; then 38185029Spjd mask=32 39168404Spjd addr=${4#::ffff:} 40219089Spjd fi;; 41168404Spjdesac 42219089Spjd 43219089Spjdcase "$1" in 44219089Spjdadd) 45219089Spjd case "$pf" in 46219089Spjd npf) 47219089Spjd /sbin/npfctl rule "$2" add block in final $proto from \ 48219089Spjd "$addr/$mask" to any $port 49168404Spjd ;; 50219089Spjd pf) 51219089Spjd # insert $ip/$mask into per-protocol anchored table 52219089Spjd /sbin/pfctl -a "$2" -t "port$6" -T add "$addr/$mask" 53219089Spjd echo "block in quick $proto from <port$6> to any $port" | \ 54219089Spjd /sbin/pfctl -a "$2" -f - 55219089Spjd ;; 56219089Spjd esac 57219089Spjd ;; 58219089Spjdrem) 59219089Spjd case "$pf" in 60219089Spjd npf) 61219089Spjd /sbin/npfctl rule "$2" rem-id "$7" 62219089Spjd ;; 63219089Spjd pf) 64219089Spjd /sbin/pfctl -a "$2" -t "port$6" -T delete "$addr/$mask" 65219089Spjd ;; 66219089Spjd esac 67219089Spjd ;; 68185029Spjdflush) 69219089Spjd case "$pf" in 70185029Spjd npf) 71219089Spjd /sbin/npfctl rule "$2" flush 72219089Spjd ;; 73185029Spjd pf) 74219089Spjd /sbin/pfctl -a "$2" -t "port$6" -T flush 75219089Spjd ;; 76219089Spjd esac 77219089Spjd ;; 78219089Spjd*) 79219089Spjd echo "$0: Unknown command '$1'" 1>&2 80219089Spjd exit 1 81185029Spjd ;; 82219089Spjdesac 83219089Spjd