etc/rc.d/ipfilter

   1 #!/bin/sh
   2 #
   3 # $FreeBSD$
   4 #
   5
   6 # PROVIDE: ipfilter
   7 # REQUIRE: FILESYSTEMS
   8 # BEFORE:  netif
   9 # KEYWORD: nojail
  10
  11 . /etc/rc.subr
  12
  13 name="ipfilter"
  14 rcvar=`set_rcvar`
  15 load_rc_config $name
  16 stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
  17
  18 start_precmd="$stop_precmd"
  19 start_cmd="ipfilter_start"
  20 stop_cmd="ipfilter_stop"
  21 reload_precmd="$stop_precmd"
  22 reload_cmd="ipfilter_reload"
  23 resync_precmd="$stop_precmd"
  24 resync_cmd="ipfilter_resync"
  25 status_precmd="$stop_precmd"
  26 status_cmd="ipfilter_status"
  27 extra_commands="reload resync status"
  28 required_modules="ipl:ipfilter"
  29
  30 ipfilter_start()
  31 {
  32         echo "Enabling ipfilter."
  33         if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then
  34                 ${ipfilter_program:-/sbin/ipf} -E
  35         fi
  36         ${ipfilter_program:-/sbin/ipf} -Fa
  37         if [ -r "${ipfilter_rules}" ]; then
  38                 ${ipfilter_program:-/sbin/ipf} \
  39                     -f "${ipfilter_rules}" ${ipfilter_flags}
  40         fi
  41         ${ipfilter_program:-/sbin/ipf} -6 -Fa
  42         if [ -r "${ipv6_ipfilter_rules}" ]; then
  43                 ${ipfilter_program:-/sbin/ipf} -6 \
  44                     -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
  45         fi
  46 }
  47
  48 ipfilter_stop()
  49 {
  50         # XXX - The ipf -D command is not effective for 'lkm's
  51         if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then
  52                 echo "Saving firewall state tables"
  53                 ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
  54                 echo "Disabling ipfilter."
  55                 ${ipfilter_program:-/sbin/ipf} -D
  56         fi
  57 }
  58
  59 ipfilter_reload()
  60 {
  61         echo "Reloading ipfilter rules."
  62
  63         ${ipfilter_program:-/sbin/ipf} -I -Fa
  64         if [ -r "${ipfilter_rules}" ]; then
  65                 ${ipfilter_program:-/sbin/ipf} -I \
  66                     -f "${ipfilter_rules}" ${ipfilter_flags}
  67                 if [ $? -ne 0 ]; then
  68                         err 1 'Load of rules into alternate set failed; aborting reload'
  69                 fi
  70         fi
  71         ${ipfilter_program:-/sbin/ipf} -I -6 -Fa
  72         if [ -r "${ipv6_ipfilter_rules}" ]; then
  73                 ${ipfilter_program:-/sbin/ipf} -I -6 \
  74                     -f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
  75                 if [ $? -ne 0 ]; then
  76                         err 1 'Load of IPv6 rules into alternate set failed; aborting reload'
  77                 fi
  78         fi
  79         ${ipfilter_program:-/sbin/ipf} -s
  80
  81 }
  82
  83 ipfilter_resync()
  84 {
  85         ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
  86 }
  87
  88 ipfilter_status()
  89 {
  90         ${ipfilter_program:-/sbin/ipf} -V
  91 }
  92
  93 run_rc_command "$1"