d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4474431c34
freebsd-skq/etc/rc.d/ipfilter

95 lines
2.1 KiB
Plaintext
Raw Normal View History

Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
#!/bin/sh
#
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
# $NetBSD: ipfilter,v 1.10 2001/02/28 17:03:50 lukem Exp $
# $FreeBSD$
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
#
# PROVIDE: ipfilter
Add a dummy script, FILESYSTEMS, which depends on root and mountcritlocal and takes over mountcritlocal's role as the early / late divider. This makes it far easier to add rc scripts which need to run early, such as a startup script for zfs, which is right around the corner. This change should be a no-op; I have verified that the only change in rcorder's output is the insertion of FILESYSTEMS immediately after mountcritlocal. MFC after: 3 weeks
2007-04-02 22:53:07 +00:00
# REQUIRE: root FILESYSTEMS
Make ipfilter, ipnat, ipmon, and ipfs behave more like the old rc. o group them together so they run one right after another o use the NetBSD supplied ipfs script instead of tacking it on to the end of ipnat o Load the ipl module in ipnat and ipfilter, if it's not already loaded o In ipmon and ipnat show a warning if neither ipfilter nor ipnat is enabled or the ipl module is not loaded, and exit Approved by: markm (mentor) (implicit) Tested by: leafy <leafy@leafy.idv.tw>
2003-04-24 08:20:47 +00:00
# BEFORE: netif
Remove the requirement for the FreeBSD keyword as it no longer makes any sense. Discussed with: dougb, brooks MFC after: 3 days
2004-10-07 13:55:26 +00:00
# KEYWORD: nojail
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
. /etc/rc.subr
name="ipfilter"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
rcvar=`set_rcvar`
load_rc_config $name
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
stop_precmd="test -f ${ipfilter_rules} -o -f ${ipv6_ipfilter_rules}"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
Use $required_modules wherever suitable. Use load_kld() in special cases. So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
start_precmd="$stop_precmd"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
start_cmd="ipfilter_start"
stop_cmd="ipfilter_stop"
reload_precmd="$stop_precmd"
reload_cmd="ipfilter_reload"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
resync_precmd="$stop_precmd"
resync_cmd="ipfilter_resync"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
status_precmd="$stop_precmd"
status_cmd="ipfilter_status"
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
extra_commands="reload resync status"
Use $required_modules wherever suitable. Use load_kld() in special cases. So we get rid of quite a few lines of duplicated code.
2006-12-31 10:37:18 +00:00
required_modules="ipl:ipfilter"
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
ipfilter_start()
{
echo "Enabling ipfilter."
`net.inet.ipf.fr_running' can be a negative value, which was introduced by recent ipfilter import. Approved by: re (scottl), anholt (mentor)
2005-07-07 05:59:44 +00:00
if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
${ipfilter_program:-/sbin/ipf} -E
fi
${ipfilter_program:-/sbin/ipf} -Fa
if [ -r "${ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} \
-f "${ipfilter_rules}" ${ipfilter_flags}
fi
${ipfilter_program:-/sbin/ipf} -6 -Fa
if [ -r "${ipv6_ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -6 \
-f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
fi
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_stop()
{
A number of fixes/enhancements for the ipfilter rc script: - Use a more robust check to determine if we need to load ipl.ko. - Don't try to run ipf -E if ipfilter is already enabled. Look at the net.inet.ipf.fr_running sysctl to figure this out. This fixes a warning message about ipfilter being already initialized. - Only one ipf -E command is needed. We don't need an extra one for the -6 case which would only print a warning message about ipfilter being already initialized. - Fix one occurence where we were running /sbin/ipf directly without using the ${ipfilter_program} variable if set. - In ipfilter_stop(), don't try to save the firewall state tables if ipfilter is disabled. Similarly, don't try to disable it if it's already disabled. This fixes some more error messages.
2003-09-27 13:50:47 +00:00
# XXX - The ipf -D command is not effective for 'lkm's
if [ `sysctl -n net.inet.ipf.fr_running` -eq 1 ]; then
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
echo "Saving firewall state tables"
${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags}
echo "Disabling ipfilter."
${ipfilter_program:-/sbin/ipf} -D
A number of fixes/enhancements for the ipfilter rc script: - Use a more robust check to determine if we need to load ipl.ko. - Don't try to run ipf -E if ipfilter is already enabled. Look at the net.inet.ipf.fr_running sysctl to figure this out. This fixes a warning message about ipfilter being already initialized. - Only one ipf -E command is needed. We don't need an extra one for the -6 case which would only print a warning message about ipfilter being already initialized. - Fix one occurence where we were running /sbin/ipf directly without using the ${ipfilter_program} variable if set. - In ipfilter_stop(), don't try to save the firewall state tables if ipfilter is disabled. Similarly, don't try to disable it if it's already disabled. This fixes some more error messages.
2003-09-27 13:50:47 +00:00
fi
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_reload()
{
echo "Reloading ipfilter rules."
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
${ipfilter_program:-/sbin/ipf} -I -Fa
if [ -r "${ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -I \
-f "${ipfilter_rules}" ${ipfilter_flags}
Ensure that the load of rules into the alternate ruleset worked before loading them into the live one too. PR: conf/97311 Submitted by: David Bushong Reviewed by: silence on rc@ Approved by: ru (mentor) MFC after: 10 days
2006-11-11 10:48:34 +00:00
if [ $? -ne 0 ]; then
err 1 'Load of rules into alternate set failed; aborting reload'
fi
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
fi
${ipfilter_program:-/sbin/ipf} -I -6 -Fa
if [ -r "${ipv6_ipfilter_rules}" ]; then
${ipfilter_program:-/sbin/ipf} -I -6 \
-f "${ipv6_ipfilter_rules}" ${ipfilter_flags}
Ensure that the load of rules into the alternate ruleset worked before loading them into the live one too. PR: conf/97311 Submitted by: David Bushong Reviewed by: silence on rc@ Approved by: ru (mentor) MFC after: 10 days
2006-11-11 10:48:34 +00:00
if [ $? -ne 0 ]; then
err 1 'Load of IPv6 rules into alternate set failed; aborting reload'
fi
Luke Mewburn has indicated that they (NetBSD) are not interested in keeping the scripts under rc.d in sync with us. So, remove NetBSD specific stuff (which made our scripts more complicated than necessary). The NetBSD ident string will be left intact, both for history and also incase we wish to pull in future versions.
2004-01-17 10:40:45 +00:00
fi
${ipfilter_program:-/sbin/ipf} -s
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
}
ipfilter_resync()
{
${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags}
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
ipfilter_status()
{
Merge in all the changes that Mike Makonnen has been maintaining for a while. This is only the script pieces, the glue for the build comes next. Submitted by: Mike Makonnen <makonnen@pacbell.net> Reviewed by: silence on -current and -hackers Prodded by: rwatson
2002-06-13 22:14:37 +00:00
${ipfilter_program:-/sbin/ipf} -V
Import the NetBSD 1.5 RC system. Note that `rc' and `rc.shutdown' could not be imported because we already have files with those names.
2001-06-16 07:16:14 +00:00
}
run_rc_command "$1"
Reference in New Issue Copy Permalink