upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-04-15 14:29:58 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ipfilter: Set ipf -T optionlist at boot

Browse source 
There is no easy way to set ipfilter optionlist variables during boot.
Add plumbing to the rc script to support this.

PR:			130555
Reviewed by:		jlduran
Differential Revision:	https://reviews.freebsd.org/D47346

(cherry picked from commit 8d6feaaaa26f444abb209360e52b993e39cb81bb)
This commit is contained in:
Cy Schubert 2024-10-30 12:28:31 -07:00
parent 3b8bce6a6b
commit 3b032c0698
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
libexec/rc/rc.conf
View file

@ -220,6 +220,7 @@ ipfilter_program="/sbin/ipf" # where the ipfilter program lives
ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see
# /usr/src/share/examples/ipfilter for examples
ipfilter_flags="" # additional flags for ipfilter
ipfilter_optionlist="" # optionlist for ipf(8) -T
ippool_enable="NO" # Set to YES to enable ip filter pools
ippool_program="/sbin/ippool" # where the ippool program lives
ippool_rules="/etc/ippool.tables" # rules definition file for ippool

8
libexec/rc/rc.d/ipfilter
View file

@ -30,7 +30,13 @@ required_modules="ipl:ipfilter"
ipfilter_start()
{
echo "Enabling ipfilter."
if ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
if [ -n "${ifilter_optionlist}" ]; then
if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
${ipfilter_program:-/sbin/ipf} -D
fi
${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}"
${ipfilter_program:-/sbin/ipf} -E
elif ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
${ipfilter_program:-/sbin/ipf} -E
fi
${ipfilter_program:-/sbin/ipf} -Fa