diff options
author | Kurt Lidl <lidl@FreeBSD.org> | 2018-02-04 19:43:51 +0000 |
---|---|---|
committer | Kurt Lidl <lidl@FreeBSD.org> | 2018-02-04 19:43:51 +0000 |
commit | 549f31e4590e97c7b9ee771a24fd2c84198f0dd8 (patch) | |
tree | 91586c2885cfd4cf04281707a2f2667658a31374 /contrib/blacklist | |
parent | 9c33cc93cd2a7144211244ef0ffdececf2ad8a9e (diff) | |
download | src-549f31e4590e97c7b9ee771a24fd2c84198f0dd8.tar.gz src-549f31e4590e97c7b9ee771a24fd2c84198f0dd8.zip |
Update blacklist-helper to not emit messages from pf during operation.
Use 'pfctl -k' when blocking a site to kill active tcp connections
from the blocked address.
Fix 'purge' operation for pf, which must dynamically determine which
filters have been created, so the filters can be flushed by name.
MFC after: 2 weeks
Notes
Notes:
svn path=/head/; revision=328861
Diffstat (limited to 'contrib/blacklist')
-rw-r--r-- | contrib/blacklist/libexec/blacklistd-helper | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/contrib/blacklist/libexec/blacklistd-helper b/contrib/blacklist/libexec/blacklistd-helper index 2d0a89e8fb0e..1af320d426b0 100644 --- a/contrib/blacklist/libexec/blacklistd-helper +++ b/contrib/blacklist/libexec/blacklistd-helper @@ -80,8 +80,8 @@ add) echo "block in quick $proto from <port$6> to any $port" | \ /sbin/pfctl -a "$2/$6" -f - # insert $ip/$mask into per-protocol/port anchored table - /sbin/pfctl -a "$2/$6" -t "port$6" -T add "$addr/$mask" && \ - echo OK + /sbin/pfctl -qa "$2/$6" -t "port$6" -T add "$addr/$mask" && \ + /sbin/pfctl -q -k $addr && echo OK ;; esac ;; @@ -101,7 +101,7 @@ rem) /sbin/npfctl rule "$2" rem-id "$7" ;; pf) - /sbin/pfctl -a "$2/$6" -t "port$6" -T delete "$addr/$mask" && \ + /sbin/pfctl -qa "$2/$6" -t "port$6" -T delete "$addr/$mask" && \ echo OK ;; esac @@ -118,7 +118,13 @@ flush) /sbin/npfctl rule "$2" flush ;; pf) - /sbin/pfctl -a "$2/$6" -t "port$6" -T flush && echo OK + # dynamically determine which anchors exist + anchors=$(/sbin/pfctl -a $2 -s Anchors) + for anchor in $anchors; do + /sbin/pfctl -a $anchor -t "port${anchor##*/}" -T flush + /sbin/pfctl -a $anchor -F rules + done + echo OK ;; esac ;; |