Add IPFW support to blacklistd-helper
Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D6753
This commit is contained in:
parent
208250ed4d
commit
5cc0844d4b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=301736
@ -16,6 +16,11 @@ for f in npf pf; do
|
|||||||
break
|
break
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
if [ -f "/etc/ipfw-blacklist.rc" ]; then
|
||||||
|
pf="ipfw"
|
||||||
|
. /etc/ipfw-blacklist.rc
|
||||||
|
ipfw_offset=${ipfw_offset:-2000}
|
||||||
|
fi
|
||||||
|
|
||||||
if [ -z "$pf" ]; then
|
if [ -z "$pf" ]; then
|
||||||
echo "$0: Unsupported packet filter" 1>&2
|
echo "$0: Unsupported packet filter" 1>&2
|
||||||
@ -43,6 +48,13 @@ esac
|
|||||||
case "$1" in
|
case "$1" in
|
||||||
add)
|
add)
|
||||||
case "$pf" in
|
case "$pf" in
|
||||||
|
ipfw)
|
||||||
|
rule=$(( $ipfw_offset + $6 )) # use $ipfw_offset+$port for rule number
|
||||||
|
tname="port$6"
|
||||||
|
/sbin/ipfw table $tname create type addr 2>/dev/null
|
||||||
|
/sbin/ipfw -q table $tname add "$addr/$mask"
|
||||||
|
/sbin/ipfw -q add $rule drop $3 from "table("$tname")" to any dst-port $6
|
||||||
|
;;
|
||||||
npf)
|
npf)
|
||||||
/sbin/npfctl rule "$2" add block in final $proto from \
|
/sbin/npfctl rule "$2" add block in final $proto from \
|
||||||
"$addr/$mask" to any $port
|
"$addr/$mask" to any $port
|
||||||
@ -57,6 +69,9 @@ add)
|
|||||||
;;
|
;;
|
||||||
rem)
|
rem)
|
||||||
case "$pf" in
|
case "$pf" in
|
||||||
|
ipfw)
|
||||||
|
/sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null
|
||||||
|
;;
|
||||||
npf)
|
npf)
|
||||||
/sbin/npfctl rule "$2" rem-id "$7"
|
/sbin/npfctl rule "$2" rem-id "$7"
|
||||||
;;
|
;;
|
||||||
@ -67,6 +82,9 @@ rem)
|
|||||||
;;
|
;;
|
||||||
flush)
|
flush)
|
||||||
case "$pf" in
|
case "$pf" in
|
||||||
|
ipfw)
|
||||||
|
/sbin/ipfw table "port$6" flush 2>/dev/null
|
||||||
|
;;
|
||||||
npf)
|
npf)
|
||||||
/sbin/npfctl rule "$2" flush
|
/sbin/npfctl rule "$2" flush
|
||||||
;;
|
;;
|
||||||
|
Loading…
Reference in New Issue
Block a user