ipfilter revision 120515
178344Sobrien#!/bin/sh 278344Sobrien# 398184Sgordon# $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $ 498184Sgordon# $FreeBSD: head/etc/rc.d/ipfilter 120515 2003-09-27 13:50:47Z mux $ 578344Sobrien# 678344Sobrien 778344Sobrien# PROVIDE: ipfilter 8118219Smtm# REQUIRE: root beforenetlkm mountcritlocal ipmon 9113959Smtm# BEFORE: netif 1098184Sgordon# KEYWORD: FreeBSD NetBSD 1178344Sobrien 1278344Sobrien. /etc/rc.subr 1378344Sobrien 1478344Sobrienname="ipfilter" 1598184Sgordonrcvar=`set_rcvar` 1698184Sgordonload_rc_config $name 1798184Sgordon 18103019Sgordoncase ${OSTYPE} in 1998184SgordonFreeBSD) 20106333Sume stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}" 2198184Sgordon ;; 2298184SgordonNetBSD) 2398184Sgordon stop_precmd="test -f /etc/ipf.conf -o -f /etc/ipf6.conf" 2498184Sgordon ;; 2598184Sgordonesac 2698184Sgordon 2778344Sobrienstart_precmd="ipfilter_prestart" 2878344Sobrienstart_cmd="ipfilter_start" 2978344Sobrienstop_cmd="ipfilter_stop" 3078344Sobrienreload_precmd="$stop_precmd" 3178344Sobrienreload_cmd="ipfilter_reload" 3298184Sgordonresync_precmd="$stop_precmd" 3398184Sgordonresync_cmd="ipfilter_resync" 3478344Sobrienstatus_precmd="$stop_precmd" 3578344Sobrienstatus_cmd="ipfilter_status" 3698184Sgordonextra_commands="reload resync status" 3778344Sobrien 3878344Sobrienipfilter_prestart() 3978344Sobrien{ 40103019Sgordoncase ${OSTYPE} in 4198184SgordonFreeBSD) 4298184Sgordon # load ipfilter kernel module if needed 43120515Smux if ! kldstat -v | grep "IP Filter" > /dev/null 2>&1; then 44104980Sschweikh if kldload ipl; then 45114271Smtm info 'IP-filter module loaded.' 4698184Sgordon else 47113959Smtm err 1 'IP-filter module failed to load.' 4898184Sgordon fi 4998184Sgordon fi 5098184Sgordon 5198184Sgordon # check for ipfilter rules 52106333Sume if [ ! -r "${ipfilter_rules}" ] && [ ! -r "${ipv6_ipfilter_rules}" ] 53106333Sume then 5498184Sgordon warn 'IP-filter: NO IPF RULES' 5598184Sgordon return 1 5698184Sgordon fi 5798184Sgordon ;; 5898184SgordonNetBSD) 5978344Sobrien if [ ! -f /etc/ipf.conf ] && [ ! -f /etc/ipf6.conf ]; then 6078344Sobrien warn "/etc/ipf*.conf not readable; ipfilter start aborted." 6178344Sobrien # 6278344Sobrien # If booting directly to multiuser, send SIGTERM to 6378344Sobrien # the parent (/etc/rc) to abort the boot 6478344Sobrien # 6578344Sobrien if [ "$autoboot" = yes ]; then 6678344Sobrien echo "ERROR: ABORTING BOOT (sending SIGTERM to parent)!" 6778344Sobrien kill -TERM $$ 6878344Sobrien exit 1 6978344Sobrien fi 7078344Sobrien return 1 7178344Sobrien fi 7298184Sgordon ;; 7398184Sgordonesac 7478344Sobrien return 0 7578344Sobrien} 7678344Sobrien 7778344Sobrienipfilter_start() 7878344Sobrien{ 7978344Sobrien echo "Enabling ipfilter." 80103019Sgordon case ${OSTYPE} in 8198184Sgordon FreeBSD) 82120515Smux if [ `sysctl -n net.inet.ipf.fr_running` -eq 0 ]; then 83120515Smux ${ipfilter_program:-/sbin/ipf} -E 84120515Smux fi 85120515Smux ${ipfilter_program:-/sbin/ipf} -Fa 86106333Sume if [ -r "${ipfilter_rules}" ]; then 87106333Sume ${ipfilter_program:-/sbin/ipf} \ 88106333Sume -f "${ipfilter_rules}" ${ipfilter_flags} 89106333Sume fi 90120515Smux ${ipfilter_program:-/sbin/ipf} -6 -Fa 91106333Sume if [ -r "${ipv6_ipfilter_rules}" ]; then 92106333Sume ${ipfilter_program:-/sbin/ipf} -6 \ 93106333Sume -f "${ipv6_ipfilter_rules}" ${ipfilter_flags} 94106333Sume fi 9598184Sgordon ;; 9698184Sgordon NetBSD) 9798184Sgordon /sbin/ipf -E -Fa 9898184Sgordon if [ -f /etc/ipf.conf ]; then 9998184Sgordon /sbin/ipf -f /etc/ipf.conf 10098184Sgordon fi 10198184Sgordon if [ -f /etc/ipf6.conf ]; then 10298184Sgordon /sbin/ipf -6 -f /etc/ipf6.conf 10398184Sgordon fi 10498184Sgordon ;; 10598184Sgordon esac 10678344Sobrien} 10778344Sobrien 10878344Sobrienipfilter_stop() 10978344Sobrien{ 110120515Smux # XXX - The ipf -D command is not effective for 'lkm's 111120515Smux if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then 112120515Smux case ${OSTYPE} in 113120515Smux FreeBSD) 114120515Smux echo "Saving firewall state tables" 115120515Smux ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags} 116120515Smux echo "Disabling ipfilter." 117120515Smux ${ipfilter_program:-/sbin/ipf} -D 118120515Smux ;; 119120515Smux NetBSD) 120120515Smux echo "Disabling ipfilter." 121120515Smux /sbin/ipf -D 122120515Smux ;; 123120515Smux esac 124120515Smux fi 12578344Sobrien} 12678344Sobrien 12778344Sobrienipfilter_reload() 12878344Sobrien{ 12978344Sobrien echo "Reloading ipfilter rules." 13078344Sobrien 131103019Sgordon case ${OSTYPE} in 13298184Sgordon FreeBSD) 133106333Sume ${ipfilter_program:-/sbin/ipf} -I -Fa 134106333Sume if [ -r "${ipfilter_rules}" ]; then 135106333Sume ${ipfilter_program:-/sbin/ipf} -I \ 136106333Sume -f "${ipfilter_rules}" ${ipfilter_flags} 137106333Sume fi 138111913Sume ${ipfilter_program:-/sbin/ipf} -I -6 -Fa 139106333Sume if [ -r "${ipv6_ipfilter_rules}" ]; then 140106333Sume ${ipfilter_program:-/sbin/ipf} -I -6 \ 141106333Sume -f "${ipv6_ipfilter_rules}" ${ipfilter_flags} 142106333Sume fi 143112500Sume ${ipfilter_program:-/sbin/ipf} -s 14498184Sgordon ;; 14598184Sgordon NetBSD) 14698184Sgordon /sbin/ipf -I -Fa 14798184Sgordon if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then 14898184Sgordon err 1 "reload of ipf.conf failed; not swapping to" \ 14998184Sgordon " new ruleset." 15098184Sgordon fi 15198184Sgordon if [ -f /etc/ipf6.conf ] && \ 15298184Sgordon ! /sbin/ipf -I -6 -f /etc/ipf6.conf; then 15398184Sgordon err 1 "reload of ipf6.conf failed; not swapping to" \ 15498184Sgordon " new ruleset." 15598184Sgordon fi 15698184Sgordon /sbin/ipf -s 15798184Sgordon ;; 15898184Sgordon esac 15998184Sgordon 16078344Sobrien} 16178344Sobrien 16298184Sgordonipfilter_resync() 16398184Sgordon{ 164103019Sgordon case ${OSTYPE} in 16598184Sgordon FreeBSD) 16698184Sgordon # Don't resync if ipfilter is not loaded 167120515Smux [ kldstat -v | grep "IP Filter" > /dev/null 2>&1 ] && return 16898184Sgordon ;; 16998184Sgordon esac 17098184Sgordon ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags} 17198184Sgordon} 17298184Sgordon 17378344Sobrienipfilter_status() 17478344Sobrien{ 17598184Sgordon ${ipfilter_program:-/sbin/ipf} -V 17678344Sobrien} 17778344Sobrien 17878344Sobrienrun_rc_command "$1" 179