1#!/bin/sh 2# 3# 4 5# PROVIDE: ipfilter 6# REQUIRE: FILESYSTEMS 7# BEFORE: ipmon ipnat netif netwait securelevel 8# KEYWORD: nojailvnet 9 10. /etc/rc.subr 11 12name="ipfilter" 13desc="IP packet filter" 14rcvar="ipfilter_enable" 15load_rc_config $name 16stop_precmd="test -f ${ipfilter_rules}" 17 18# doesn't make sense to run in a svcj: config setting 19ipfilter_svcj="NO" 20 21start_precmd="$stop_precmd" 22start_cmd="ipfilter_start" 23stop_cmd="ipfilter_stop" 24reload_precmd="$stop_precmd" 25reload_cmd="ipfilter_reload" 26resync_precmd="$stop_precmd" 27resync_cmd="ipfilter_resync" 28status_precmd="$stop_precmd" 29status_cmd="ipfilter_status" 30extra_commands="reload resync" 31required_modules="ipl:ipfilter" 32 33ipfilter_start() 34{ 35 echo "Enabling ipfilter." 36 if [ -n "${ifilter_optionlist}" ]; then 37 if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then 38 ${ipfilter_program:-/sbin/ipf} -D 39 fi 40 ${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}" 41 ${ipfilter_program:-/sbin/ipf} -E 42 elif ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then 43 ${ipfilter_program:-/sbin/ipf} -E 44 fi 45 ${ipfilter_program:-/sbin/ipf} -Fa 46 if [ -r "${ipfilter_rules}" ]; then 47 ${ipfilter_program:-/sbin/ipf} \ 48 -f "${ipfilter_rules}" ${ipfilter_flags} 49 fi 50} 51 52ipfilter_stop() 53{ 54 if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then 55 echo "Saving firewall state tables" 56 ${ipfs_program:-/sbin/ipfs} -W ${ipfs_flags} 57 echo "Disabling ipfilter." 58 ${ipfilter_program:-/sbin/ipf} -D 59 fi 60} 61 62ipfilter_reload() 63{ 64 echo "Reloading ipfilter rules." 65 66 ${ipfilter_program:-/sbin/ipf} -I -Fa 67 if [ -r "${ipfilter_rules}" ]; then 68 ${ipfilter_program:-/sbin/ipf} -I \ 69 -f "${ipfilter_rules}" ${ipfilter_flags} 70 if [ $? -ne 0 ]; then 71 err 1 'Load of rules into alternate set failed; aborting reload' 72 fi 73 fi 74 ${ipfilter_program:-/sbin/ipf} -s 75 76} 77 78ipfilter_resync() 79{ 80 ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags} 81} 82 83ipfilter_status() 84{ 85 ${ipfilter_program:-/sbin/ipf} -V 86} 87 88run_rc_command "$1" 89