Commit Graph

32 Commits

Author SHA1 Message Date
Cy Schubert
854cb10a58 ipfilter 5.1.2 no longer supports sysctl. Use ipf -V to determine if
available (the kernel module is loaded or compiled into the kernel).

Approved by:	glebius (mentor)
Approved by:	re (blanket)
2013-09-10 13:48:33 +00:00
Doug Barton
801c438304 Prepare for the removal of set_rcvar() by changing the rcvar=
assignments to the literal values it would have returned.

The concept of set_rcvar() was nice in theory, but the forks
it creates are a drag on the startup process, which is especially
noticeable on slower systems, such as embedded ones.

During the discussion on freebsd-rc@ a preference was expressed for
using ${name}_enable instead of the literal values. However the
code portability concept doesn't really apply since there are so
many other places where the literal name has to be searched for
and replaced. Also, using the literal value is also a tiny bit
faster than dereferencing the variables, and every little bit helps.
2012-01-14 02:18:41 +00:00
Hiroki Sato
88492dfb20 Remove redundant keywords.
Submitted by:	wxs
2011-05-17 07:40:13 +00:00
Doug Barton
a3f6188b53 Make the pf and ipfw firewalls start before netif, just like ipfilter
already does. This eliminates a logical inconsistency, and a small
window where the system is open after the network comes up.
2009-06-01 05:35:03 +00:00
Doug Barton
e3c46a3332 Remove $NetBSD$ CVS tags. We no longer attempt to synch our rc.d files
with theirs, so this information doesn't need to be in the live file.
Having it in our CVS history is enough.
2007-12-08 07:20:23 +00:00
Dag-Erling Smørgrav
255d327cc5 FILESYSTEMS requires root, so requiring both of them is redundant. 2007-04-09 08:53:40 +00:00
Dag-Erling Smørgrav
7bd5b79de4 Add a dummy script, FILESYSTEMS, which depends on root and mountcritlocal
and takes over mountcritlocal's role as the early / late divider.  This
makes it far easier to add rc scripts which need to run early, such as a
startup script for zfs, which is right around the corner.

This change should be a no-op; I have verified that the only change in
rcorder's output is the insertion of FILESYSTEMS immediately after
mountcritlocal.

MFC after:	3 weeks
2007-04-02 22:53:07 +00:00
Yaroslav Tykhiy
0c30639059 Use $required_modules wherever suitable. Use load_kld() in special
cases.  So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
Ceri Davies
8495277664 Ensure that the load of rules into the alternate ruleset worked before
loading them into the live one too.

PR:		conf/97311
Submitted by:	David Bushong
Reviewed by:	silence on rc@
Approved by:	ru (mentor)
MFC after:	10 days
2006-11-11 10:48:34 +00:00
Jung-uk Kim
c687e6de5b `net.inet.ipf.fr_running' can be a negative value, which was introduced by
recent ipfilter import.

Approved by:	re (scottl), anholt (mentor)
2005-07-07 05:59:44 +00:00
Dima Dorfman
b5f6d74386 Unbreak the ipfilter_loaded function. There doesn't seem to be a way
for kldstat to ever print "IP Filter" (the module is called "ipfilter"
and modules don't have anything like a description), so this function
would always return false. That would cause prestart to attempt to
load the module even if it's already loaded, which would fail and
prevent the rules from being loaded.

Approved by:	re (dwhite)
2005-06-21 09:39:09 +00:00
Mike Makonnen
337338ee00 Remove the requirement for the FreeBSD keyword as it no longer
makes any sense.

Discussed with: dougb, brooks
MFC after: 3 days
2004-10-07 13:55:26 +00:00
Darren Reed
da48dbe191 apply patch so pr can be closed
PR:		misc/56715
Submitted by:	grant@NetBSD.org
Reviewed by:	darrenr
2004-04-20 13:30:49 +00:00
Pawel Jakub Dawidek
bd57d5b0f5 Mark scripts as not usable inside a jail by adding keyword 'nojail'.
Some suggestions from:	rwatson, Ruben de Groot <mail25@bzerk.org>
2004-03-08 12:25:05 +00:00
Mike Makonnen
6e571c7035 Remove scripts we don't use from requirement lines. These were
hold-overs from the initial NetBSD import.
2004-03-05 07:43:38 +00:00
Maxime Henrion
226b72f862 Move the test used to determine whether IPFilter is loaded or not
into its own function to avoid a small duplication of code.
2004-01-24 20:40:11 +00:00
Mike Makonnen
9dd342fee6 Luke Mewburn has indicated that they (NetBSD) are not interested
in keeping the scripts under rc.d in sync with us. So, remove
NetBSD specific stuff (which made our scripts more complicated
than necessary).

The NetBSD ident string will be left intact, both for history and
also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
Mike Makonnen
1afce00360 Luke Mewburn has indicated that they (NetBSD) are not interested
in keeping the scripts under rc.d in sync with us. So, begin removal
of NetBSD specific stuff (which made our scripts more complicated
than necessary), starting with the NetBSD KEYWORD.
2004-01-17 10:16:38 +00:00
Doug Barton
76f9428757 Remove trailing whitespace 2003-10-13 08:20:55 +00:00
Maxime Henrion
c7b33a84a4 Fix bogon in ipfilter_resync() introduced in my last commit.
Spotted by:	Gennady Proskurin <gpr@nvnpp.vrn.ru>
2003-10-03 11:57:43 +00:00
Maxime Henrion
50e8b3f340 A number of fixes/enhancements for the ipfilter rc script:
- Use a more robust check to determine if we need to load ipl.ko.
- Don't try to run ipf -E if ipfilter is already enabled.  Look at
  the net.inet.ipf.fr_running sysctl to figure this out.  This fixes
  a warning message about ipfilter being already initialized.
- Only one ipf -E command is needed.  We don't need an extra one for
  the -6 case which would only print a warning message about ipfilter
  being already initialized.
- Fix one occurence where we were running /sbin/ipf directly without
  using the ${ipfilter_program} variable if set.
- In ipfilter_stop(), don't try to save the firewall state tables if
  ipfilter is disabled.  Similarly, don't try to disable it if it's
  already disabled.  This fixes some more error messages.
2003-09-27 13:50:47 +00:00
Mike Makonnen
7a34a70b8d tty whacking should occur early, but not so early that the
required commands are not on a mounted file system.

Noticed by: bde
2003-07-30 18:53:59 +00:00
Mike Makonnen
c56836728a o Make the 'Ip-filter module loaded' messages informational
o Make 'No ipnat rules' a warning
o Remove unecessary ' ..'

Approved by:	markm (implicit)
2003-04-30 02:54:17 +00:00
Mike Makonnen
f686a8e864 Running the script with restart or manually stopping and starting
it doesn't work because the start_cmd doesn't enable ipfilter if
it is currently disabled.

Approved by:	markm (mentor) (implicit)
Submitted by:	Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
PR:		conf/46103
2003-04-30 02:19:38 +00:00
Mike Makonnen
8cf06adbcb Make ipfilter, ipnat, ipmon, and ipfs behave more like the old rc.
o group them together so they run one right after another
	o use the NetBSD supplied ipfs script instead of tacking
	  it on to the end of ipnat
	o Load the ipl module in ipnat and ipfilter, if it's not already
	  loaded
	o In ipmon and ipnat show a warning if neither ipfilter nor
	  ipnat is enabled or the ipl module is not loaded, and exit

Approved by:	markm (mentor) (implicit)
Tested by:	leafy <leafy@leafy.idv.tw>
2003-04-24 08:20:47 +00:00
Hajimu UMEMOTO
667b217aa3 add missing `ipf -s'.
Submitted by:	Mark Huizer <xaa+freebsd@timewasters.nl>
2003-03-22 14:53:23 +00:00
Hajimu UMEMOTO
b209d7e493 Latest IPFilter requires flushing rules for IPv6 separately
from IPv4.
2003-03-05 17:16:22 +00:00
Hajimu UMEMOTO
7b988fe73c Add IPv6 setup for ipfilter. `ipv6_ipfilter_rules' was added
to specify rules definition file for ipfilter.  The default is
/etc/ipf6.rules.  If there is a file which is specified by
'ipv6_ipfilter_rules', IPv6 rule is installed.

Reviewed by:	Ronald van der Pol <Ronald.vanderPol@rvdp.org>
MFC after:	1 week
2002-11-02 08:21:26 +00:00
Jens Schweikhardt
143085107b Fix style bugs:
* Space -> tabs conversion.
* Removed blanks before semicolon in "if ... ; then".
* Proper indentation of misindented lines.
* Put a full stop after some comments.
* Removed whitespace at end of line.

Approved by:	silence from gordon
2002-10-12 10:31:31 +00:00
Gordon Tetlow
77e55efba0 Convert from ${CMD_OSTYPE} to ${OSTYPE}. This saves a shell invocation on
OS-dependent case switches.
2002-09-06 16:18:05 +00:00
Gordon Tetlow
27bc1b287e Merge in all the changes that Mike Makonnen has been maintaining for a
while. This is only the script pieces, the glue for the build comes next.

Submitted by:	Mike Makonnen <makonnen@pacbell.net>
Reviewed by:	silence on -current and -hackers
Prodded by:	rwatson
2002-06-13 22:14:37 +00:00
David E. O'Brien
9d62501fd8 Import the NetBSD 1.5 RC system.
Note that `rc' and `rc.shutdown' could not be imported because we already
have files with those names.
2001-06-16 07:16:14 +00:00