d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c21ae3a403
freebsd-dev/etc/rc.d/ipfilter

93 lines
2.1 KiB
Plaintext
Raw Normal View History

Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
#!/bin/sh
#
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
# $FreeBSD$
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
#
# PROVIDE: ipfilter
FILESYSTEMS requires root, so requiring both of them is redundant.
2007-04-09 08:53:40 +00:00
# REQUIRE: FILESYSTEMS
Remove the requirement for the FreeBSD keyword as it no longer makes any sense. Discussed with: dougb, brooks MFC after: 3 days
2004-10-07 13:55:26 +00:00
# KEYWORD: nojail
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
. /etc/rc.subr
name="ipfilter"
Prepare for the removal of set_rcvar() by changing the rcvar= assignments to the literal values it would have returned. The concept of set_rcvar() was nice in theory, but the forks it creates are a drag on the startup process, which is especially noticeable on slower systems, such as embedded ones. During the discussion on freebsd-rc@ a preference was expressed for using ${name}_enable instead of the literal values. However the code portability concept doesn't really apply since there are so many other places where the literal name has to be searched for and replaced. Also, using the literal value is also a tiny bit faster than dereferencing the variables, and every little bit helps.
2012-01-14 02:18:41 +00:00
rcvar="ipfilter_enable"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
load_rc_config $name
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
Use $required_modules wherever suitable. Use load_kld() in special cases. So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
start_precmd="$stop_precmd"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
start_cmd="ipfilter_start"
stop_cmd="ipfilter_stop"
reload_precmd="$stop_precmd"
reload_cmd="ipfilter_reload"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
resync_precmd="$stop_precmd"
resync_cmd="ipfilter_resync"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
status_precmd="$stop_precmd"
status_cmd="ipfilter_status"
Remove redundant keywords. Submitted by: wxs
2011-05-17 07:40:13 +00:00
extra_commands="reload resync"
Use $required_modules wherever suitable. Use load_kld() in special cases. So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
required_modules="ipl:ipfilter"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
ipfilter_start()
{
echo "Enabling ipfilter."
`net.inet.ipf.fr_running' can be a negative value, which was introduced by recent ipfilter import. Approved by: re (scottl), anholt (mentor)
2005-07-07 05:59:44 +00:00
if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
${ipfilter_program:-/sbin/ipf} -E
fi
${ipfilter_program:-/sbin/ipf} -Fa
if [ -r "${ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} \
-f "${ipfilter_rules}" ${ipfilter_flags}
fi
${ipfilter_program:-/sbin/ipf} -6 -Fa
if [ -r "${ipv6_ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -6 \
-f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
fi
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_stop()
{
A number of fixes/enhancements for the ipfilter rc script: - Use a more robust check to determine if we need to load ipl.ko. - Don't try to run ipf -E if ipfilter is already enabled. Look at the net.inet.ipf.fr_running sysctl to figure this out. This fixes a warning message about ipfilter being already initialized. - Only one ipf -E command is needed. We don't need an extra one for the -6 case which would only print a warning message about ipfilter being already initialized. - Fix one occurence where we were running /sbin/ipf directly without using the ${ipfilter_program} variable if set. - In ipfilter_stop(), don't try to save the firewall state tables if ipfilter is disabled. Similarly, don't try to disable it if it's already disabled. This fixes some more error messages.
2003-09-27 13:50:47 +00:00
# XXX - The ipf -D command is not effective for 'lkm's
if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
echo "Saving firewall state tables"
${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
echo "Disabling ipfilter."
${ipfilter_program:-/sbin/ipf} -D
A number of fixes/enhancements for the ipfilter rc script: - Use a more robust check to determine if we need to load ipl.ko. - Don't try to run ipf -E if ipfilter is already enabled. Look at the net.inet.ipf.fr_running sysctl to figure this out. This fixes a warning message about ipfilter being already initialized. - Only one ipf -E command is needed. We don't need an extra one for the -6 case which would only print a warning message about ipfilter being already initialized. - Fix one occurence where we were running /sbin/ipf directly without using the ${ipfilter_program} variable if set. - In ipfilter_stop(), don't try to save the firewall state tables if ipfilter is disabled. Similarly, don't try to disable it if it's already disabled. This fixes some more error messages.
2003-09-27 13:50:47 +00:00
fi
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_reload()
{
echo "Reloading ipfilter rules."
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
${ipfilter_program:-/sbin/ipf} -I -Fa
if [ -r "${ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -I \
-f "${ipfilter_rules}" ${ipfilter_flags}
Ensure that the load of rules into the alternate ruleset worked before loading them into the live one too. PR: conf/97311 Submitted by: David Bushong Reviewed by: silence on rc@ Approved by: ru (mentor) MFC after: 10 days
2006-11-11 10:48:34 +00:00
if [ $? -ne 0 ]; then
err 1 'Load of rules into alternate set failed; aborting reload'
fi
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
fi
${ipfilter_program:-/sbin/ipf} -I -6 -Fa
if [ -r "${ipv6_ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -I -6 \
-f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
Ensure that the load of rules into the alternate ruleset worked before loading them into the live one too. PR: conf/97311 Submitted by: David Bushong Reviewed by: silence on rc@ Approved by: ru (mentor) MFC after: 10 days
2006-11-11 10:48:34 +00:00
if [ $? -ne 0 ]; then
err 1 'Load of IPv6 rules into alternate set failed; aborting reload'
fi
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
fi
${ipfilter_program:-/sbin/ipf} -s
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
}
ipfilter_resync()
{
${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_status()
{
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
${ipfilter_program:-/sbin/ipf} -V
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
run_rc_command "$1"
Reference in New Issue Copy Permalink