ipfilter revision 164175
12061Sjkh#!/bin/sh 233611Sjb# 32061Sjkh# $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $ 433611Sjb# $FreeBSD: head/etc/rc.d/ipfilter 164175 2006-11-11 10:48:34Z ceri $ 532427Sjb# 632427Sjb 733611Sjb# PROVIDE: ipfilter 833611Sjb# REQUIRE: root mountcritlocal 932427Sjb# BEFORE: netif 1032427Sjb# KEYWORD: nojail 112061Sjkh 1215603Smarkm. /etc/rc.subr 1330169Sjkh 1420710Sasaminame="ipfilter" 1520710Sasamircvar=`set_rcvar` 163197Scsgrload_rc_config $name 172061Sjkhstop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}" 1812483Speter 1933133Sadamstart_precmd="ipfilter_prestart" 202160Scsgrstart_cmd="ipfilter_start" 212834Swollmanstop_cmd="ipfilter_stop" 222061Sjkhreload_precmd="$stop_precmd" 232061Sjkhreload_cmd="ipfilter_reload" 242160Scsgrresync_precmd="$stop_precmd" 2517308Speterresync_cmd="ipfilter_resync" 2619320Sadamstatus_precmd="$stop_precmd" 2727788Sasamistatus_cmd="ipfilter_status" 2830169Sjkhextra_commands="reload resync status" 2925980Sasami 301594Srgrimesipfilter_loaded() 3117308Speter{ 3217308Speter if ! kldstat -v | grep "ipfilter$" > /dev/null 2>&1; then 3327910Sasami return 1 3427910Sasami else 3527910Sasami return 0 3617308Speter fi 3717308Speter} 3817308Speter 3919175Sbdeipfilter_prestart() 4019175Sbde{ 4119175Sbde # load ipfilter kernel module if needed 4219175Sbde if ! ipfilter_loaded; then 4317308Speter if kldload ipl; then 4427910Sasami info 'IP-filter module loaded.' 4525647Sbde else 4627910Sasami err 1 'IP-filter module failed to load.' 4717308Speter fi 482061Sjkh fi 492061Sjkh 501594Srgrimes # check for ipfilter rules 5130169Sjkh if [ ! -r "${ipfilter_rules}" ] && [ ! -r "${ipv6_ipfilter_rules}" ] 5230169Sjkh then 5330169Sjkh warn 'IP-filter: NO IPF RULES' 5430169Sjkh return 1 5530169Sjkh fi 5630169Sjkh return 0 5730169Sjkh} 5830169Sjkh 597407Srgrimesipfilter_start() 607108Sphk{ 617108Sphk echo "Enabling ipfilter." 627108Sphk if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then 637407Srgrimes ${ipfilter_program:-/sbin/ipf} -E 647407Srgrimes fi 657407Srgrimes ${ipfilter_program:-/sbin/ipf} -Fa 667108Sphk if [ -r "${ipfilter_rules}" ]; then 672061Sjkh ${ipfilter_program:-/sbin/ipf} \ 682061Sjkh -f "${ipfilter_rules}" ${ipfilter_flags} 692061Sjkh fi 7017308Speter ${ipfilter_program:-/sbin/ipf} -6 -Fa 712061Sjkh if [ -r "${ipv6_ipfilter_rules}" ]; then 722061Sjkh ${ipfilter_program:-/sbin/ipf} -6 \ 732061Sjkh -f "${ipv6_ipfilter_rules}" ${ipfilter_flags} 742061Sjkh fi 752061Sjkh} 7630169Sjkh 7730169Sjkhipfilter_stop() 782626Scsgr{ 792061Sjkh # XXX - The ipf -D command is not effective for 'lkm's 802061Sjkh if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then 812061Sjkh echo "Saving firewall state tables" 822061Sjkh ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags} 832061Sjkh echo "Disabling ipfilter." 842061Sjkh ${ipfilter_program:-/sbin/ipf} -D 8519320Sadam fi 862061Sjkh} 872061Sjkh 882061Sjkhipfilter_reload() 892061Sjkh{ 902061Sjkh echo "Reloading ipfilter rules." 912061Sjkh 922061Sjkh ${ipfilter_program:-/sbin/ipf} -I -Fa 932061Sjkh if [ -r "${ipfilter_rules}" ]; then 942061Sjkh ${ipfilter_program:-/sbin/ipf} -I \ 952061Sjkh -f "${ipfilter_rules}" ${ipfilter_flags} 962061Sjkh if [ $? -ne 0 ]; then 972834Swollman err 1 'Load of rules into alternate set failed; aborting reload' 982834Swollman fi 992834Swollman fi 1002834Swollman ${ipfilter_program:-/sbin/ipf} -I -6 -Fa 1012834Swollman if [ -r "${ipv6_ipfilter_rules}" ]; then 1022834Swollman ${ipfilter_program:-/sbin/ipf} -I -6 \ 1031594Srgrimes -f "${ipv6_ipfilter_rules}" ${ipfilter_flags} 1044486Sphk if [ $? -ne 0 ]; then 1054486Sphk err 1 'Load of IPv6 rules into alternate set failed; aborting reload' 1064486Sphk fi 1074486Sphk fi 1084486Sphk ${ipfilter_program:-/sbin/ipf} -s 1092061Sjkh 1102061Sjkh} 11125979Sjkh 11225979Sjkhipfilter_resync() 11325979Sjkh{ 11425979Sjkh # Don't resync if ipfilter is not loaded 1152061Sjkh if ! ipfilter_loaded; then 11625979Sjkh return 1172061Sjkh fi 1182061Sjkh ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags} 11917308Speter} 1202061Sjkh 1212061Sjkhipfilter_status() 1222061Sjkh{ 1232061Sjkh ${ipfilter_program:-/sbin/ipf} -V 1242061Sjkh} 12512483Speter 12612483Speterrun_rc_command "$1" 12712483Speter