Module Name: src Committed By: christos Date: Fri Mar 17 20:42:43 UTC 2017
Modified Files: src/external/bsd/blacklist/libexec: blacklistd-helper Log Message: fixes from FreeBSD via Kurt Lidl To generate a diff of this commit: cvs rdiff -u -r1.11 -r1.12 \ src/external/bsd/blacklist/libexec/blacklistd-helper Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/external/bsd/blacklist/libexec/blacklistd-helper diff -u src/external/bsd/blacklist/libexec/blacklistd-helper:1.11 src/external/bsd/blacklist/libexec/blacklistd-helper:1.12 --- src/external/bsd/blacklist/libexec/blacklistd-helper:1.11 Thu Jun 9 16:02:52 2016 +++ src/external/bsd/blacklist/libexec/blacklistd-helper Fri Mar 17 16:42:42 2017 @@ -10,10 +10,10 @@ # $7 id pf= -if [ -z "$pf" -a -f "/etc/ipfw-blacklist.rc" ]; then - pf="ipfw" - . /etc/ipfw-blacklist.rc - ipfw_offset=${ipfw_offset:-2000} +if [ -f "/etc/ipfw-blacklist.rc" ]; then + pf="ipfw" + . /etc/ipfw-blacklist.rc + ipfw_offset=${ipfw_offset:-2000} fi if [ -z "$pf" ]; then @@ -52,9 +52,10 @@ case "$1" in add) case "$pf" in ipf) - /sbin/ipfstat -io | /sbin/ipf -I -f - - echo block in quick proto $proto from $addr/$mask to \ - any port=$port head $port$6 | /sbin/ipf -I -f - -s + /sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1 + echo block in quick $proto from $addr/$mask to \ + any port=$6 head port$6 | \ + /sbin/ipf -I -f - -s >/dev/null 2>&1 && echo OK ;; ipfw) # use $ipfw_offset+$port for rule number @@ -62,52 +63,62 @@ add) tname="port$6" /sbin/ipfw table $tname create type addr 2>/dev/null /sbin/ipfw -q table $tname add "$addr/$mask" - /sbin/ipfw -q add $rule drop $3 from "table("$tname")" to \ - any dst-port $6 + # if rule number $rule does not already exist, create it + /sbin/ipfw show $rule >/dev/null 2>&1 || \ + /sbin/ipfw add $rule drop $3 from \ + table"("$tname")" to any dst-port $6 >/dev/null && \ + echo OK ;; npf) /sbin/npfctl rule "$2" add block in final $proto from \ "$addr/$mask" to any $port ;; pf) - # insert $ip/$mask into per-protocol anchored table - /sbin/pfctl -a "$2" -t "port$6" -T add "$addr/$mask" - echo "block in quick $proto from <port$6> to any $port" | \ - /sbin/pfctl -a "$2" -f - + # if the filtering rule does not exist, create it + /sbin/pfctl -a "$2/$6" -sr 2>/dev/null | \ + grep -q "<port$6>" || \ + echo "block in quick $proto from <port$6> to any $port" | \ + /sbin/pfctl -a "$2/$6" -f - + # insert $ip/$mask into per-protocol/port anchored table + /sbin/pfctl -a "$2/$6" -t "port$6" -T add "$addr/$mask" && \ + echo OK ;; esac ;; rem) case "$pf" in ipf) - /sbin/ipfstat -io | /sbin/ipf -I -f - - echo block in quick proto $proto from $addr/$mask to any \ - port =$port head port$6 | /sbin/ipf -r -f - -s + /sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1 + echo block in quick $proto from $addr/$mask to \ + any port=$6 head port$6 | \ + /sbin/ipf -I -r -f - -s >/dev/null 2>&1 && echo OK ;; ipfw) - /sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null + /sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null && \ + echo OK ;; npf) /sbin/npfctl rule "$2" rem-id "$7" ;; pf) - /sbin/pfctl -a "$2" -t "port$6" -T delete "$addr/$mask" + /sbin/pfctl -a "$2/$6" -t "port$6" -T delete "$addr/$mask" && \ + echo OK ;; esac ;; flush) - case "$pf" in + case "$pf" in ipf) - /sbin/ipf -Z -I -Fa -s + /sbin/ipf -Z -I -Fi -s > /dev/null && echo OK ;; ipfw) - /sbin/ipfw table "port$6" flush 2>/dev/null + /sbin/ipfw table "port$6" flush 2>/dev/null && echo OK ;; npf) /sbin/npfctl rule "$2" flush ;; pf) - /sbin/pfctl -a "$2" -t "port$6" -T flush + /sbin/pfctl -a "$2/$6" -t "port$6" -T flush && echo OK ;; esac ;;