[BACK]Return to ipfilter CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / src / etc / rc.d

File: [cvs.NetBSD.org] / src / etc / rc.d / ipfilter (download)

Revision 1.18, Mon Mar 23 18:52:02 2009 UTC (15 years ago) by hannken
Branch: MAIN
CVS Tags: yamt-pagecache-tag8, yamt-pagecache-base9, yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, yamt-pagecache-base5, yamt-pagecache-base4, yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, yamt-pagecache, tls-maxphys-base, tls-maxphys, tls-earlyentropy-base, tls-earlyentropy, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2, prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, phil-wifi-base, phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, phil-wifi-20190609, phil-wifi, pgoyette-localcount-base, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, pgoyette-localcount, pgoyette-compat-merge-20190127, pgoyette-compat-base, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, pgoyette-compat, perseant-stdc-iso10646-base, perseant-stdc-iso10646, netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9, netbsd-8-base, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-8, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, netbsd-6, matt-premerge-20091211, matt-nb8-mediatek-base, matt-nb8-mediatek, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, matt-mips64-premerge-20101231, localcount-20160914, khorben-n900, jym-xensuspend-nbase, jym-xensuspend-base, is-mlppp-base, is-mlppp, cherry-xenmp-base, cherry-xenmp, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2, agc-symver-base, agc-symver
Changes since 1.17: +2 -2 lines

Add flags to rc.d/ipfilter.  Use it from rc.conf like

	ipfilter=YES ipfilter_flags="-T fr_statemax=18963,fr_statesize=27091"

Ok: Christos Zoulas <christos@netbsd.org>

#!/bin/sh
#
# $NetBSD: ipfilter,v 1.18 2009/03/23 18:52:02 hannken Exp $
#

# PROVIDE: ipfilter
# REQUIRE: root bootconf mountcritlocal tty

$_rc_subr_loaded . /etc/rc.subr

name="ipfilter"
rcvar=$name
start_precmd="ipfilter_prestart"
start_cmd="ipfilter_start"
stop_precmd="test -f /etc/ipf.conf -o -f /etc/ipf6.conf"
stop_cmd="ipfilter_stop"
reload_precmd="$stop_precmd"
reload_cmd="ipfilter_reload"
resync_precmd="$stop_precmd"
resync_cmd="ipfilter_resync"
status_precmd="$stop_precmd"
status_cmd="ipfilter_status"
extra_commands="reload resync status"

ipfilter_prestart()
{
	if [ ! -f /etc/ipf.conf ] && [ ! -f /etc/ipf6.conf ]; then
		warn "/etc/ipf*.conf not readable; ipfilter start aborted."

		stop_boot
		return 1
	fi
	return 0
}

ipfilter_start()
{
	echo "Enabling ipfilter."
	/sbin/ipf ${rc_flags} -E

		# Do the flush first; since older ipf has different semantics.
		#
	if [ -f /etc/ipf.conf ]; then
		/sbin/ipf -Fa
	fi
	if [ -f /etc/ipf6.conf ]; then
		/sbin/ipf -6 -Fa
	fi

		# Now load the config files
		#
	if [ -f /etc/ipf.conf ]; then
		/sbin/ipf -f /etc/ipf.conf
	fi
	if [ -f /etc/ipf6.conf ]; then
		/sbin/ipf -6 -f /etc/ipf6.conf
	fi
}

ipfilter_stop()
{
	echo "Disabling ipfilter."
	/sbin/ipf -D
}

ipfilter_reload()
{
	echo "Reloading ipfilter rules."

		# Do the flush first; since older ipf has different semantics.
		#
	if [ -f /etc/ipf.conf ]; then
		/sbin/ipf -I -Fa
	fi
	if [ -f /etc/ipf6.conf ]; then
		/sbin/ipf -6 -I -Fa
	fi

		# Now load the config files into the Inactive set
		#
	if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then
		err 1 "reload of ipf.conf failed; not swapping to new ruleset."
	fi
	if [ -f /etc/ipf6.conf ] && ! /sbin/ipf -I -6 -f /etc/ipf6.conf; then
		err 1 "reload of ipf6.conf failed; not swapping to new ruleset."
	fi
		
		# Swap in the new rules
		#
	/sbin/ipf -s
}

ipfilter_resync()
{
	/sbin/ipf -y
}

ipfilter_status()
{
	/sbin/ipf -V
}

load_rc_config $name
run_rc_command "$1"