libexec/rc/rc.d/ipfilter

   1 #!/bin/sh
   2 #
   3 # $FreeBSD$
   4 #
   5
   6 # PROVIDE: ipfilter
   7 # REQUIRE: FILESYSTEMS
   8 # BEFORE: ipmon ipnat netif netwait securelevel
   9 # KEYWORD: nojailvnet
  10
  11 . /etc/rc.subr
  12
  13 name="ipfilter"
  14 desc="IP packet filter"
  15 rcvar="ipfilter_enable"
  16 load_rc_config $name
  17 stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
  18
  19 start_precmd="$stop_precmd"
  20 start_cmd="ipfilter_start"
  21 stop_cmd="ipfilter_stop"
  22 reload_precmd="$stop_precmd"
  23 reload_cmd="ipfilter_reload"
  24 resync_precmd="$stop_precmd"
  25 resync_cmd="ipfilter_resync"
  26 status_precmd="$stop_precmd"
  27 status_cmd="ipfilter_status"
  28 extra_commands="reload resync"
  29 required_modules="ipl:ipfilter"
  30
  31 ipfilter_start()
  32 {
  33         echo "Enabling ipfilter."
  34         if ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
  35                 ${ipfilter_program:-/sbin/ipf} -E
  36         fi
  37         ${ipfilter_program:-/sbin/ipf} -Fa
  38         if [ -r "${ipfilter_rules}" ]; then
  39                 ${ipfilter_program:-/sbin/ipf} \
  40                     -f "${ipfilter_rules}" ${ipfilter_flags}
  41         fi
  42         if [ -r "${ipv6_ipfilter_rules}" ]; then
  43                 ${ipfilter_program:-/sbin/ipf} -6 \
  44                     -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
  45         fi
  46 }
  47
  48 ipfilter_stop()
  49 {
  50         if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
  51                 echo "Saving firewall state tables"
  52                 ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
  53                 echo "Disabling ipfilter."
  54                 ${ipfilter_program:-/sbin/ipf} -D
  55         fi
  56 }
  57
  58 ipfilter_reload()
  59 {
  60         echo "Reloading ipfilter rules."
  61
  62         ${ipfilter_program:-/sbin/ipf} -I -Fa
  63         if [ -r "${ipfilter_rules}" ]; then
  64                 ${ipfilter_program:-/sbin/ipf} -I \
  65                     -f "${ipfilter_rules}" ${ipfilter_flags}
  66                 if [ $? -ne 0 ]; then
  67                         err 1 'Load of rules into alternate set failed; aborting reload'
  68                 fi
  69         fi
  70         if [ -r "${ipv6_ipfilter_rules}" ]; then
  71                 ${ipfilter_program:-/sbin/ipf} -I -6 \
  72                     -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
  73                 if [ $? -ne 0 ]; then
  74                         err 1 'Load of IPv6 rules into alternate set failed; aborting reload'
  75                 fi
  76         fi
  77         ${ipfilter_program:-/sbin/ipf} -s
  78
  79 }
  80
  81 ipfilter_resync()
  82 {
  83         ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
  84 }
  85
  86 ipfilter_status()
  87 {
  88         ${ipfilter_program:-/sbin/ipf} -V
  89 }
  90
  91 run_rc_command "$1"