hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-22 19:51:04 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

ipfilter: Set ipf -T optionlist at boot

Browse Source 
There is no easy way to set ipfilter optionlist variables during boot.
Add plumbing to the rc script to support this.

PR:			130555
Reviewed by:		jlduran
MFC			1 week
Differential Revision:	https://reviews.freebsd.org/D47346
This commit is contained in:
Cy Schubert 2024-10-30 12:28:31 -07:00
parent 055b41056e
commit 8d6feaaaa2
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libexec/rc/rc.conf
View File

@ -214,6 +214,7 @@ ipfilter_program="/sbin/ipf" # where the ipfilter program lives
ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see
# /usr/src/contrib/ipfilter/rules for examples # /usr/src/contrib/ipfilter/rules for examples
ipfilter_flags="" # additional flags for ipfilter ipfilter_flags="" # additional flags for ipfilter
ipfilter_optionlist="" # optionlist for ipf(8) -T
ippool_enable="NO" # Set to YES to enable ip filter pools ippool_enable="NO" # Set to YES to enable ip filter pools
ippool_program="/sbin/ippool" # where the ippool program lives ippool_program="/sbin/ippool" # where the ippool program lives
ippool_rules="/etc/ippool.tables" # rules definition file for ippool ippool_rules="/etc/ippool.tables" # rules definition file for ippool

8
libexec/rc/rc.d/ipfilter
View File

@ -33,7 +33,13 @@ required_modules="ipl:ipfilter"
ipfilter_start() ipfilter_start()
{ {
echo "Enabling ipfilter." echo "Enabling ipfilter."
if ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then if [ -n "${ifilter_optionlist}" ]; then
if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
${ipfilter_program:-/sbin/ipf} -D
fi
${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}"
${ipfilter_program:-/sbin/ipf} -E
elif ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
${ipfilter_program:-/sbin/ipf} -E ${ipfilter_program:-/sbin/ipf} -E
fi fi
${ipfilter_program:-/sbin/ipf} -Fa ${ipfilter_program:-/sbin/ipf} -Fa