svn commit: r306695 - head/contrib/blacklist/libexec
Kurt Lidl
lidl at FreeBSD.org
Tue Oct 4 23:10:44 UTC 2016
Author: lidl
Date: Tue Oct 4 23:10:43 2016
New Revision: 306695
URL: https://svnweb.freebsd.org/changeset/base/306695
Log:
Make blacklist-helper commands emit a message when successful
The blacklistd daemon expects to see a message on stdout, instead
of just relying on the exit value from any invoked programs.
Change the pf filtering to create multiple filters, attached under
a the "blacklist/*" anchor point. This prevents the filtering for
each port's filtering rule from overwriting the previously installed
filtering rule. Check for an existing filtering rule for each port,
so the installation of a given filtering rule only happens once.
Reinstalling the same rule resets the counters for the pf rule, and
we don't want that.
Reported by: David Horn (dhorn2000 at gmail.com)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D8081
Modified:
head/contrib/blacklist/libexec/blacklistd-helper
Modified: head/contrib/blacklist/libexec/blacklistd-helper
==============================================================================
--- head/contrib/blacklist/libexec/blacklistd-helper Tue Oct 4 22:36:36 2016 (r306694)
+++ head/contrib/blacklist/libexec/blacklistd-helper Tue Oct 4 23:10:43 2016 (r306695)
@@ -19,8 +19,8 @@ fi
if [ -z "$pf" ]; then
for f in npf pf ipf; do
if [ -f "/etc/$f.conf" ]; then
- pf="$f"
- break
+ pf="$f"
+ break
fi
done
fi
@@ -54,8 +54,8 @@ add)
ipf)
/sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1
echo block in quick $proto from $addr/$mask to \
- any port=$6 head port$6 | \
- /sbin/ipf -I -f - -s >/dev/null 2>&1
+ any port=$6 head port$6 | \
+ /sbin/ipf -I -f - -s >/dev/null 2>&1 && echo OK
;;
ipfw)
# use $ipfw_offset+$port for rule number
@@ -64,17 +64,21 @@ add)
/sbin/ipfw table $tname create type addr 2>/dev/null
/sbin/ipfw -q table $tname add "$addr/$mask"
/sbin/ipfw -q add $rule drop $3 from "table("$tname")" to \
- any dst-port $6
+ any dst-port $6 && echo OK
;;
npf)
/sbin/npfctl rule "$2" add block in final $proto from \
"$addr/$mask" to any $port
;;
pf)
- # insert $ip/$mask into per-protocol anchored table
- /sbin/pfctl -a "$2" -t "port$6" -T add "$addr/$mask"
- echo "block in quick $proto from <port$6> to any $port" | \
- /sbin/pfctl -a "$2" -f -
+ # if the filtering rule does not exist, create it
+ /sbin/pfctl -a "$2/$6" -sr 2>/dev/null | \
+ grep -q "<port$6>" || \
+ echo "block in quick $proto from <port$6> to any $port" | \
+ /sbin/pfctl -a "$2/$6" -f -
+ # insert $ip/$mask into per-protocol/port anchored table
+ /sbin/pfctl -a "$2/$6" -t "port$6" -T add "$addr/$mask" && \
+ echo OK
;;
esac
;;
@@ -83,33 +87,35 @@ rem)
ipf)
/sbin/ipfstat -io | /sbin/ipf -I -f - >/dev/null 2>&1
echo block in quick $proto from $addr/$mask to \
- any port=$6 head port$6 | \
- /sbin/ipf -I -r -f - -s >/dev/null 2>&1
+ any port=$6 head port$6 | \
+ /sbin/ipf -I -r -f - -s >/dev/null 2>&1 && echo OK
;;
ipfw)
- /sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null
+ /sbin/ipfw table "port$6" delete "$addr/$mask" 2>/dev/null && \
+ echo OK
;;
npf)
/sbin/npfctl rule "$2" rem-id "$7"
;;
pf)
- /sbin/pfctl -a "$2" -t "port$6" -T delete "$addr/$mask"
+ /sbin/pfctl -a "$2/$6" -t "port$6" -T delete "$addr/$mask" && \
+ echo OK
;;
esac
;;
flush)
case "$pf" in
ipf)
- /sbin/ipf -Z -I -Fi -s > /dev/null
+ /sbin/ipf -Z -I -Fi -s > /dev/null && echo OK
;;
ipfw)
- /sbin/ipfw table "port$6" flush 2>/dev/null
+ /sbin/ipfw table "port$6" flush 2>/dev/null && echo OK
;;
npf)
/sbin/npfctl rule "$2" flush
;;
pf)
- /sbin/pfctl -a "$2" -t "port$6" -T flush
+ /sbin/pfctl -a "$2/$6" -t "port$6" -T flush && echo OK
;;
esac
;;
More information about the svn-src-all
mailing list