Author: emax
Date: Thu Feb 25 18:02:52 2010
New Revision: 204325
URL: http://svn.freebsd.org/changeset/base/204325
Log:
MFC: r203676
Introduce new rc.conf variable firewall_coscripts. It can be used to
specify list of executables and/or rc scripts that should be executed
after firewall starts/stops.
Submitted by: Yuri Kurenkov <y dot kurenkov at init dot ru>
Reviewed by: rhodes, rc@
Modified:
stable/7/etc/defaults/rc.conf
stable/7/etc/rc.d/ipfw
stable/7/share/man/man5/rc.conf.5 (contents, props changed)
Directory Properties:
stable/7/etc/ (props changed)
stable/7/share/man/man5/ (props changed)
Modified: stable/7/etc/defaults/rc.conf
==============================================================================
--- stable/7/etc/defaults/rc.conf Thu Feb 25 16:40:08 2010
(r204324)
+++ stable/7/etc/defaults/rc.conf Thu Feb 25 18:02:52 2010
(r204325)
@@ -113,6 +113,8 @@ firewall_quiet="NO" # Set to YES to sup
firewall_logging="NO" # Set to YES to enable events logging
firewall_flags="" # Flags passed to ipfw when type is a file
firewall_client_net="192.0.2.0/24" # Network address for "client" firewall.
+firewall_coscripts="" # List of executables/scripts to run after
+ # firewall starts/stops
firewall_simple_iif="ed1" # Inside network interface for "simple"
# firewall.
firewall_simple_inet="192.0.2.16/28" # Inside network address for "simple"
Modified: stable/7/etc/rc.d/ipfw
==============================================================================
--- stable/7/etc/rc.d/ipfw Thu Feb 25 16:40:08 2010 (r204324)
+++ stable/7/etc/rc.d/ipfw Thu Feb 25 18:02:52 2010 (r204325)
@@ -15,6 +15,7 @@ name="ipfw"
rcvar="firewall_enable"
start_cmd="ipfw_start"
start_precmd="ipfw_prestart"
+start_postcmd="ipfw_poststart"
stop_cmd="ipfw_stop"
required_modules="ipfw"
@@ -41,9 +42,6 @@ ipfw_start()
[ -z "${firewall_script}" ] && firewall_script=/etc/rc.firewall
if [ -r "${firewall_script}" ]; then
- if [ -f /etc/rc.d/natd ] ; then
- /etc/rc.d/natd start
- fi
/bin/sh "${firewall_script}" "${_firewall_type}"
echo 'Firewall rules loaded.'
elif [ "`ipfw list 65535`" = "65535 deny ip from any to any" ]; then
@@ -58,6 +56,19 @@ ipfw_start()
echo 'Firewall logging enabled.'
sysctl net.inet.ip.fw.verbose=1 >/dev/null
fi
+}
+
+ipfw_poststart()
+{
+ local _coscript
+
+ # Start firewall coscripts
+ #
+ for _coscript in ${firewall_coscripts} ; do
+ if [ -f "${_coscript}" ]; then
+ ${_coscript} quietstart
+ fi
+ done
# Enable the firewall
#
@@ -66,13 +77,22 @@ ipfw_start()
ipfw_stop()
{
+ local _coscript
+
# Disable the firewall
#
${SYSCTL_W} net.inet.ip.fw.enable=0
- if [ -f /etc/rc.d/natd ] ; then
- /etc/rc.d/natd stop
- fi
+
+ # Stop firewall coscripts
+ #
+ for _coscript in `reverse_list ${firewall_coscripts}` ; do
+ if [ -f "${_coscript}" ]; then
+ ${_coscript} quietstop
+ fi
+ done
}
load_rc_config $name
+firewall_coscripts="/etc/rc.d/natd ${firewall_coscripts}"
+
run_rc_command $*
Modified: stable/7/share/man/man5/rc.conf.5
==============================================================================
--- stable/7/share/man/man5/rc.conf.5 Thu Feb 25 16:40:08 2010
(r204324)
+++ stable/7/share/man/man5/rc.conf.5 Thu Feb 25 18:02:52 2010
(r204325)
@@ -501,6 +501,10 @@ specifies a filename.
.Pq Vt str
The IPv6 equivalent of
.Va firewall_flags .
+.It Va firewall_coscripts
+.Pq Vt str
+List of executables and/or rc scripts to run after firewall starts/stops.
+Default is empty.
.\" ----- firewall_nat_enable setting --------------------------------
.It Va firewall_nat_enable
.Pq Vt bool
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
