diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2024-10-30 19:28:31 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2024-11-01 18:08:14 +0000 |
| commit | 8d6feaaaa26f444abb209360e52b993e39cb81bb (patch) | |
| tree | 9616020d34493081dbcd7250b1258bf1409e5761 | |
| parent | 055b41056ef7a54d0a75ba5c9049fc0bd34a8b26 (diff) | |
| download | src-8d6feaaaa26f.tar.gz src-8d6feaaaa26f.zip | |
ipfilter: Set ipf -T optionlist at boot
There is no easy way to set ipfilter optionlist variables during boot.
Add plumbing to the rc script to support this.
PR: 130555
Reviewed by: jlduran
MFC 1 week
Differential Revision: https://reviews.freebsd.org/D47346
| -rw-r--r-- | libexec/rc/rc.conf | 1 | ||||
| -rwxr-xr-x | libexec/rc/rc.d/ipfilter | 8 |
2 files changed, 8 insertions, 1 deletions
diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 8f585bc02856..a21c587dcc07 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -214,6 +214,7 @@ ipfilter_program="/sbin/ipf" # where the ipfilter program lives ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see # /usr/src/contrib/ipfilter/rules for examples ipfilter_flags="" # additional flags for ipfilter +ipfilter_optionlist="" # optionlist for ipf(8) -T ippool_enable="NO" # Set to YES to enable ip filter pools ippool_program="/sbin/ippool" # where the ippool program lives ippool_rules="/etc/ippool.tables" # rules definition file for ippool diff --git a/libexec/rc/rc.d/ipfilter b/libexec/rc/rc.d/ipfilter index d0cb09ab527c..9b64fcff0c7a 100755 --- a/libexec/rc/rc.d/ipfilter +++ b/libexec/rc/rc.d/ipfilter @@ -33,7 +33,13 @@ required_modules="ipl:ipfilter" ipfilter_start() { echo "Enabling ipfilter." - if ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then + if [ -n "${ifilter_optionlist}" ]; then + if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then + ${ipfilter_program:-/sbin/ipf} -D + fi + ${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}" + ${ipfilter_program:-/sbin/ipf} -E + elif ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then ${ipfilter_program:-/sbin/ipf} -E fi ${ipfilter_program:-/sbin/ipf} -Fa |