d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update blacklist-helper to not emit messages from pf during operation.

Browse Source 
Use 'pfctl -k' when blocking a site to kill active tcp connections
from the blocked address.

Fix 'purge' operation for pf, which must dynamically determine which
filters have been created, so the filters can be flushed by name.

MFC after:	2 weeks
This commit is contained in:
Kurt Lidl 2018-02-04 19:43:51 +00:00
parent 9c33cc93cd
commit 549f31e459
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
contrib/blacklist/libexec/blacklistd-helper
View File

@ -80,8 +80,8 @@ add)
echo "block in quick $proto from <port$6> to any $port" | \
/sbin/pfctl -a "$2/$6" -f -
# insert $ip/$mask into per-protocol/port anchored table
/sbin/pfctl -a "$2/$6" -t "port$6" -T add "$addr/$mask" && \
echo OK
/sbin/pfctl -qa "$2/$6" -t "port$6" -T add "$addr/$mask" && \
/sbin/pfctl -q -k $addr && echo OK
;;
esac
;;
@ -101,7 +101,7 @@ rem)
/sbin/npfctl rule "$2" rem-id "$7"
;;
pf)
/sbin/pfctl -a "$2/$6" -t "port$6" -T delete "$addr/$mask" && \
/sbin/pfctl -qa "$2/$6" -t "port$6" -T delete "$addr/$mask" && \
echo OK
;;
esac
@ -118,7 +118,13 @@ flush)
/sbin/npfctl rule "$2" flush
;;
pf)
/sbin/pfctl -a "$2/$6" -t "port$6" -T flush && echo OK
# dynamically determine which anchors exist
anchors=$(/sbin/pfctl -a $2 -s Anchors)
for anchor in $anchors; do
/sbin/pfctl -a $anchor -t "port${anchor##*/}" -T flush
/sbin/pfctl -a $anchor -F rules
done
echo OK
;;
esac
;;