mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-20 02:07:23 +01:00
see #2042 re-ran tests
This commit is contained in:
Vadim Kurland
parent
1460fef57f
commit
69896936ba
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:08 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:23 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-base-rulesets.fw /etc/fw/firewall-base-rulesets.fw
|
||||
# files: firewall-base-rulesets.conf /etc/fw/firewall-base-rulesets.conf
|
||||
@ -163,7 +163,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en2 192.168.100.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:08 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:23 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:08 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:23 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-ipv6-1.fw pf-ipv6.fw
|
||||
# files: firewall-ipv6-1.conf /etc/fw/pf-ipv6.conf
|
||||
@ -175,7 +175,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo ::1/128 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:08 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:23 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:24 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-ipv6-2.fw pf.fw
|
||||
# files: firewall-ipv6-2.conf pf.conf
|
||||
@ -179,7 +179,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo ::1/128 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:24 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:24 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-ipv6-3.fw /etc/firewall-ipv6-3.fw
|
||||
# files: firewall-ipv6-3.conf /etc/firewall-ipv6-3.conf
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:39 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:52 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall.fw /etc/pf.fw
|
||||
# files: firewall.conf /etc/pf.conf
|
||||
@ -167,7 +167,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:39 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:52 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:40 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:53 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall1.fw /etc/fw/firewall1.fw
|
||||
# files: firewall1.conf /etc/fw/firewall1.conf
|
||||
@ -79,7 +79,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:40 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:53 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:42 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:54 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-1.fw /etc/fw/firewall10-1.fw
|
||||
# files: firewall10-1.conf /etc/fw/firewall10-1.conf
|
||||
@ -74,7 +74,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:42 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:54 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:43 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:55 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-2.fw /etc/fw/firewall10-2.fw
|
||||
# files: firewall10-2.conf /etc/fw/firewall10-2.conf
|
||||
@ -74,7 +74,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:43 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:55 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:44 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:56 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-3.fw /etc/fw/firewall10-3.fw
|
||||
# files: firewall10-3.conf /etc/fw/firewall10-3.conf
|
||||
@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:44 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:56 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:45 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:59 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-4.fw /etc/fw/firewall10-4.fw
|
||||
# files: firewall10-4.conf /etc/fw/firewall10-4.conf
|
||||
@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:45 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:59 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:46 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:00 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-5.fw /etc/fw/firewall10-5.fw
|
||||
# files: firewall10-5.conf /etc/fw/firewall10-5.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:46 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:00 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:47 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:01 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-6.fw /etc/fw/firewall10-6.fw
|
||||
# files: firewall10-6.conf /etc/fw/firewall10-6.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:47 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:01 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:41 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:53 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall100.fw /etc/fw/pf.fw
|
||||
# files: firewall100.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -160,7 +160,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:41 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:53 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:41 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:54 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall101.fw /etc/fw/pf.fw
|
||||
# files: firewall101.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -163,7 +163,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:41 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:54 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:42 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:55 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall102.fw /etc/fw/pf.fw
|
||||
# files: firewall102.conf /etc/fw/path\ with\ space/pf.conf
|
||||
|
||||
25
test/pf/firewall103-1.conf.orig
Normal file
25
test/pf/firewall103-1.conf.orig
Normal file
@ -0,0 +1,25 @@
|
||||
|
||||
set timeout udp.single 5
|
||||
|
||||
#
|
||||
# Scrub rules
|
||||
#
|
||||
match all scrub (reassemble tcp no-df )
|
||||
match out all scrub (random-id min-ttl 1 max-mss 1460)
|
||||
|
||||
|
||||
# Tables: (1)
|
||||
table <tbl.r9998.d> { 10.1.1.81 , 10.3.14.81 , 192.168.1.1 }
|
||||
|
||||
#
|
||||
# Rule backup ssh access rule
|
||||
# backup ssh access rule
|
||||
pass in quick inet proto tcp from 10.3.14.30 to <tbl.r9998.d> port 22 label "RULE 9998 -- ACCEPT "
|
||||
#
|
||||
# Rule 0 (global)
|
||||
block log quick inet from any to any no state label "RULE 0 -- DROP "
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
399
test/pf/firewall103-1.fw.orig
Executable file
399
test/pf/firewall103-1.fw.orig
Executable file
@ -0,0 +1,399 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 14:10:57 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall103-1.fw /etc/fw/pf.fw
|
||||
# files: firewall103-1.conf /etc/fw/path\ with\ space/pf.conf
|
||||
#
|
||||
# Compiled for pf 4.7
|
||||
#
|
||||
# bridge interface, static address, shell script format, OpenBSD 4.7
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
test -x "$LOGGER" && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
missing_vlan() {
|
||||
vlan=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $vlan
|
||||
subint=$1
|
||||
parent=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
vlan_id=$(echo $subint | sed 's/vlan//')
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id vlandev $parent
|
||||
$FWBDEBUG $IFCONFIG $subint up
|
||||
}
|
||||
test "$cmd" = "rem" && {
|
||||
echo "# Removing VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id -vlandev
|
||||
$FWBDEBUG $IFCONFIG $subint destroy
|
||||
}
|
||||
}
|
||||
|
||||
parse_fwb_vlans() {
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
shift
|
||||
|
||||
FWB_VLANS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$vlan_parent_interface"
|
||||
done | sort
|
||||
)
|
||||
echo $FWB_VLANS
|
||||
}
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
done | sort
|
||||
}
|
||||
|
||||
update_vlans_of_interface() {
|
||||
args="$1"
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
|
||||
FWB_VLANS=$(parse_fwb_vlans "$args")
|
||||
CURRENT_VLANS=$(parse_current_vlans $vlan_parent_interface)
|
||||
|
||||
$IFCONFIG $vlan_parent_interface up
|
||||
diff_intf missing_vlan "$FWB_VLANS" "$CURRENT_VLANS" add
|
||||
diff_intf missing_vlan "$CURRENT_VLANS" "$FWB_VLANS" rem
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^vlan[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
|
||||
BRCONFIG="$IFCONFIG"
|
||||
|
||||
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^carp[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting carp interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating carp interface $intf"
|
||||
$SYSCTL -w net.inet.carp.allow=1
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^pfsync[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_bridge_interfaces bridge0
|
||||
update_bridge_interface bridge0 "em2 em3"
|
||||
sync_carp_interfaces
|
||||
sync_pfsync_interfaces
|
||||
update_addresses_of_interface "bridge0 192.168.1.1/0xffffff00" ""
|
||||
update_addresses_of_interface "em0 10.3.14.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em2" ""
|
||||
update_addresses_of_interface "em3" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:57 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL -f /etc/fw/path\ with\ space/pf.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
25
test/pf/firewall103-2.conf.orig
Normal file
25
test/pf/firewall103-2.conf.orig
Normal file
@ -0,0 +1,25 @@
|
||||
|
||||
set timeout udp.single 5
|
||||
|
||||
#
|
||||
# Scrub rules
|
||||
#
|
||||
scrub all reassemble tcp no-df
|
||||
scrub out all random-id min-ttl 1 max-mss 1460
|
||||
|
||||
|
||||
# Tables: (1)
|
||||
table <tbl.r9998.d> { 10.1.1.81 , 10.3.14.81 , 192.168.1.1 }
|
||||
|
||||
#
|
||||
# Rule backup ssh access rule
|
||||
# backup ssh access rule
|
||||
pass in quick inet proto tcp from 10.3.14.30 to <tbl.r9998.d> port 22 label "RULE 9998 -- ACCEPT "
|
||||
#
|
||||
# Rule 0 (global)
|
||||
block log quick inet from any to any no state label "RULE 0 -- DROP "
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
399
test/pf/firewall103-2.fw.orig
Executable file
399
test/pf/firewall103-2.fw.orig
Executable file
@ -0,0 +1,399 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 14:10:57 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall103-2.fw /etc/fw/pf.fw
|
||||
# files: firewall103-2.conf /etc/fw/path\ with\ space/pf.conf
|
||||
#
|
||||
# Compiled for pf 4.0
|
||||
#
|
||||
# bridge interface, static address, shell script format, OpenBSD <4.7
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
test -x "$LOGGER" && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
missing_vlan() {
|
||||
vlan=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $vlan
|
||||
subint=$1
|
||||
parent=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
vlan_id=$(echo $subint | sed 's/vlan//')
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id vlandev $parent
|
||||
$FWBDEBUG $IFCONFIG $subint up
|
||||
}
|
||||
test "$cmd" = "rem" && {
|
||||
echo "# Removing VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id -vlandev
|
||||
$FWBDEBUG $IFCONFIG $subint destroy
|
||||
}
|
||||
}
|
||||
|
||||
parse_fwb_vlans() {
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
shift
|
||||
|
||||
FWB_VLANS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$vlan_parent_interface"
|
||||
done | sort
|
||||
)
|
||||
echo $FWB_VLANS
|
||||
}
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
done | sort
|
||||
}
|
||||
|
||||
update_vlans_of_interface() {
|
||||
args="$1"
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
|
||||
FWB_VLANS=$(parse_fwb_vlans "$args")
|
||||
CURRENT_VLANS=$(parse_current_vlans $vlan_parent_interface)
|
||||
|
||||
$IFCONFIG $vlan_parent_interface up
|
||||
diff_intf missing_vlan "$FWB_VLANS" "$CURRENT_VLANS" add
|
||||
diff_intf missing_vlan "$CURRENT_VLANS" "$FWB_VLANS" rem
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^vlan[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
BRCONFIG="brconfig"
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^carp[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting carp interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating carp interface $intf"
|
||||
$SYSCTL -w net.inet.carp.allow=1
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^pfsync[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_bridge_interfaces bridge0
|
||||
update_bridge_interface bridge0 "em2 em3"
|
||||
sync_carp_interfaces
|
||||
sync_pfsync_interfaces
|
||||
update_addresses_of_interface "bridge0 192.168.1.1/0xffffff00" ""
|
||||
update_addresses_of_interface "em0 10.3.14.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em2" ""
|
||||
update_addresses_of_interface "em3" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:57 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL -f /etc/fw/path\ with\ space/pf.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:43 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:56 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall103.fw /etc/fw/pf.fw
|
||||
# files: firewall103.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -169,7 +169,7 @@ parse_fwb_vlans() {
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
$IFCONFIG | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
@ -190,7 +190,7 @@ update_vlans_of_interface() {
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -210,8 +210,102 @@ sync_vlan_interfaces() {
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
BRCONFIG="$IFCONFIG"
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -233,7 +327,7 @@ sync_carp_interfaces() {
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -281,7 +375,7 @@ configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_bridge_interfaces bridge0
|
||||
update_bridge_interface "bridge0 em2 em3"
|
||||
update_bridge_interface bridge0 "em2 em3"
|
||||
sync_carp_interfaces
|
||||
sync_pfsync_interfaces
|
||||
update_addresses_of_interface "bridge0 192.168.1.1/0xffffff00" ""
|
||||
@ -291,7 +385,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "em3" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:43 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:56 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
25
test/pf/firewall104-1.conf.orig
Normal file
25
test/pf/firewall104-1.conf.orig
Normal file
@ -0,0 +1,25 @@
|
||||
|
||||
set timeout udp.single 5
|
||||
|
||||
#
|
||||
# Scrub rules
|
||||
#
|
||||
match all scrub (reassemble tcp no-df )
|
||||
match out all scrub (random-id min-ttl 1 max-mss 1460)
|
||||
|
||||
|
||||
# Tables: (1)
|
||||
table <tbl.r9998.d> { bridge0 , 10.1.1.81 , 10.3.14.81 }
|
||||
|
||||
#
|
||||
# Rule backup ssh access rule
|
||||
# backup ssh access rule
|
||||
pass in quick inet proto tcp from 10.3.14.30 to <tbl.r9998.d> port 22 label "RULE 9998 -- ACCEPT "
|
||||
#
|
||||
# Rule 0 (global)
|
||||
block log quick inet from any to any no state label "RULE 0 -- DROP "
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
398
test/pf/firewall104-1.fw.orig
Executable file
398
test/pf/firewall104-1.fw.orig
Executable file
@ -0,0 +1,398 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 14:10:59 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall104-1.fw /etc/fw/pf.fw
|
||||
# files: firewall104-1.conf /etc/fw/path\ with\ space/pf.conf
|
||||
#
|
||||
# Compiled for pf 4.7
|
||||
#
|
||||
# bridge interface, dynamic address, shell script format, OpenBSD 4.7
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
test -x "$LOGGER" && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
missing_vlan() {
|
||||
vlan=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $vlan
|
||||
subint=$1
|
||||
parent=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
vlan_id=$(echo $subint | sed 's/vlan//')
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id vlandev $parent
|
||||
$FWBDEBUG $IFCONFIG $subint up
|
||||
}
|
||||
test "$cmd" = "rem" && {
|
||||
echo "# Removing VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id -vlandev
|
||||
$FWBDEBUG $IFCONFIG $subint destroy
|
||||
}
|
||||
}
|
||||
|
||||
parse_fwb_vlans() {
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
shift
|
||||
|
||||
FWB_VLANS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$vlan_parent_interface"
|
||||
done | sort
|
||||
)
|
||||
echo $FWB_VLANS
|
||||
}
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
done | sort
|
||||
}
|
||||
|
||||
update_vlans_of_interface() {
|
||||
args="$1"
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
|
||||
FWB_VLANS=$(parse_fwb_vlans "$args")
|
||||
CURRENT_VLANS=$(parse_current_vlans $vlan_parent_interface)
|
||||
|
||||
$IFCONFIG $vlan_parent_interface up
|
||||
diff_intf missing_vlan "$FWB_VLANS" "$CURRENT_VLANS" add
|
||||
diff_intf missing_vlan "$CURRENT_VLANS" "$FWB_VLANS" rem
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^vlan[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
|
||||
BRCONFIG="$IFCONFIG"
|
||||
|
||||
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^carp[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting carp interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating carp interface $intf"
|
||||
$SYSCTL -w net.inet.carp.allow=1
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^pfsync[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_bridge_interfaces bridge0
|
||||
update_bridge_interface bridge0 "em2 em3"
|
||||
sync_carp_interfaces
|
||||
sync_pfsync_interfaces
|
||||
update_addresses_of_interface "em0 10.3.14.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em2" ""
|
||||
update_addresses_of_interface "em3" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:59 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL -f /etc/fw/path\ with\ space/pf.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:44 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:10:58 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall104.fw /etc/fw/pf.fw
|
||||
# files: firewall104.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -169,7 +169,7 @@ parse_fwb_vlans() {
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
$IFCONFIG | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
@ -190,7 +190,7 @@ update_vlans_of_interface() {
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -210,8 +210,102 @@ sync_vlan_interfaces() {
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
BRCONFIG="$IFCONFIG"
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -233,7 +327,7 @@ sync_carp_interfaces() {
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -281,17 +375,16 @@ configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_bridge_interfaces bridge0
|
||||
update_bridge_interface "bridge0 em2 em3"
|
||||
update_bridge_interface bridge0 "em2 em3"
|
||||
sync_carp_interfaces
|
||||
sync_pfsync_interfaces
|
||||
update_addresses_of_interface "bridge0" ""
|
||||
update_addresses_of_interface "em0 10.3.14.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
update_addresses_of_interface "em2" ""
|
||||
update_addresses_of_interface "em3" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:44 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:10:58 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:46 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:00 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall105.fw /etc/fw/pf.fw
|
||||
# files: firewall105.conf /etc/fw/path\ with\ space/pf.conf
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:47 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:01 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall106.fw /etc/fw/pf.fw
|
||||
# files: firewall106.conf /etc/fw/path\ with\ space/pf.conf
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:48 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:02 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall107.fw /etc/fw/pf.fw
|
||||
# files: firewall107.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -169,7 +169,7 @@ parse_fwb_vlans() {
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
$IFCONFIG | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
@ -190,7 +190,7 @@ update_vlans_of_interface() {
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -210,8 +210,102 @@ sync_vlan_interfaces() {
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
BRCONFIG="$IFCONFIG"
|
||||
|
||||
|
||||
missing_port() {
|
||||
intf=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $intf
|
||||
port=$1
|
||||
bridge_interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
echo "# Updating bridge configuration: $bridge_interface $cmd $port"
|
||||
$FWBDEBUG $BRCONFIG $bridge_interface $cmd $port
|
||||
test "$cmd" = "addm" && $FWBDEBUG $IFCONFIG $port up
|
||||
}
|
||||
|
||||
update_bridge_interface() {
|
||||
bridge_interface=$1
|
||||
shift
|
||||
|
||||
FWB_PORTS=""
|
||||
CURRENT_PORTS=""
|
||||
|
||||
FWB_PORTS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
# this is really redundant because we create missing bridge
|
||||
# interfaces in sync_bridge_interfaces. However will leave this
|
||||
# here so that function update_bridge can be used without prior
|
||||
# call to sync_bridge_interfaces The difference is that
|
||||
# sync_bridge_interfaces also deletes bridge interfaces that exist
|
||||
# on the machine but are missing in fwbuilder confgiuration. The
|
||||
# update_bridge function can only add bridge interfaces.
|
||||
$BRCONFIG $bridge_interface >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $bridge_interface"
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface create
|
||||
$FWBDEBUG $IFCONFIG $bridge_interface up
|
||||
}
|
||||
|
||||
PORTS=$(
|
||||
$BRCONFIG $bridge_interface | awk '($1~/member:/) { print $2; }'
|
||||
)
|
||||
|
||||
test -n "$PORTS" && {
|
||||
CURRENT_PORTS=$(
|
||||
for subint in $PORTS; do
|
||||
echo "${subint}@$bridge_interface"
|
||||
done | sort
|
||||
)
|
||||
}
|
||||
|
||||
# first delete bridge ports, then add. This way, if an interface
|
||||
# moves from one bridge to another, we remove it first and then
|
||||
# add. It would not work if we tried to add it first, brctl issues
|
||||
# an error:
|
||||
# device eth2 is already a member of a bridge; can't enslave it to bridge br1.
|
||||
#
|
||||
diff_intf missing_port "$CURRENT_PORTS" "$FWB_PORTS" deletem
|
||||
diff_intf missing_port "$FWB_PORTS" "$CURRENT_PORTS" addm
|
||||
}
|
||||
|
||||
|
||||
sync_bridge_interfaces() {
|
||||
$BRCONFIG -a | awk -F: -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
($1 ~ /^bridge[0-9]/ && !($1 in ignored_dict)) {print $1;}' | \
|
||||
while read brintf; do
|
||||
echo "# Deleting bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brintf down
|
||||
$FWBDEBUG $IFCONFIG $brintf destroy
|
||||
done
|
||||
|
||||
for brint in $*; do
|
||||
$BRCONFIG $brint >/dev/null 2>&1 || {
|
||||
echo "# Creating bridge interface $brintf"
|
||||
$FWBDEBUG $IFCONFIG $brint create
|
||||
$FWBDEBUG $IFCONFIG $brint up
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -233,7 +327,7 @@ sync_carp_interfaces() {
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -291,7 +385,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan102 192.168.102.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:48 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:02 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:48 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:03 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall108.fw /etc/fw/pf.fw
|
||||
# files: firewall108.conf /etc/fw/path\ with\ space/pf.conf
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:49 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:03 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall11.fw /etc/firewall11.fw
|
||||
# files: firewall11.conf /etc/firewall11.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:49 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:03 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:49 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:04 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall12.fw /etc/fw/firewall12.fw
|
||||
# files: firewall12.conf /etc/fw/firewall12.conf
|
||||
@ -159,7 +159,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:49 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:04 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:50 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:04 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall13.fw /etc/fw/firewall13.fw
|
||||
# files: firewall13.conf /etc/fw/firewall13.conf
|
||||
@ -88,7 +88,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:50 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:04 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:51 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:05 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall14-1.fw /etc/firewall14-1.fw
|
||||
# files: firewall14-1.conf /etc/firewall14-1.conf
|
||||
@ -241,7 +241,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:51 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:05 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:51 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:05 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall14.fw /etc/firewall14.fw
|
||||
# files: firewall14.conf /etc/firewall14.conf
|
||||
@ -241,7 +241,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:51 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:05 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:53 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:08 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall2-1.fw /etc/fw/firewall2-1.fw
|
||||
# files: firewall2-1.conf /etc/fw/firewall2-1.conf
|
||||
@ -89,7 +89,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:53 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:08 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:52 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:06 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall2.fw /etc/fw/firewall2.fw
|
||||
# files: firewall2.conf /etc/fw/firewall2.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:52 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:06 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:52 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:07 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall20.fw /etc/fw/firewall20.fw
|
||||
# files: firewall20.conf /etc/fw/firewall20.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:52 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:07 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:53 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:07 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall21.fw /etc/fw/firewall21.fw
|
||||
# files: firewall21.conf /etc/fw/firewall21.conf
|
||||
@ -81,7 +81,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:53 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:07 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:54 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:09 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall22.fw /etc/fw/firewall22.fw
|
||||
# files: firewall22.conf /etc/fw/firewall22.conf
|
||||
@ -80,7 +80,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:54 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:09 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:54 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:09 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall3.fw /etc/firewall3.fw
|
||||
# files: firewall3.conf /etc/firewall3.conf
|
||||
@ -159,7 +159,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:54 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:09 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:56 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:10 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall33.fw /etc/fw/firewall33.fw
|
||||
# files: firewall33.conf /etc/fw/firewall33.conf
|
||||
@ -158,12 +158,11 @@ run_epilog_and_exit() {
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
update_addresses_of_interface "eth0.100" ""
|
||||
update_addresses_of_interface "eth1 192.168.1.100/0xffffff00" ""
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:56 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:10 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:56 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:10 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall34.fw /etc/fw/firewall34.fw
|
||||
# files: firewall34.conf /etc/fw/firewall34.conf
|
||||
@ -154,12 +154,11 @@ run_epilog_and_exit() {
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
update_addresses_of_interface "eth0.100" ""
|
||||
update_addresses_of_interface "eth1 192.168.1.100/0xffffff00" ""
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:56 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:10 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:57 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:11 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall38.fw /etc/fw/firewall38.fw
|
||||
# files: firewall38.conf /etc/fw/firewall38.conf
|
||||
@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:57 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:11 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:57 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:12 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall39.fw pf.fw
|
||||
# files: firewall39.conf pf.conf
|
||||
@ -79,7 +79,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:57 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:12 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:58 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:12 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall4.fw pf.fw
|
||||
# files: firewall4.conf /etc/fw/pf.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:58 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:12 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:59 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:14 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall40-1.fw /etc/firewall40-1.fw
|
||||
# files: firewall40-1.conf /etc/firewall40-1.conf
|
||||
@ -176,7 +176,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:59 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:14 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:58 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:13 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall40.fw /etc/firewall40.fw
|
||||
# files: firewall40.conf /etc/firewall40.conf
|
||||
@ -160,7 +160,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:58 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:13 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:17:59 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:14 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall41.fw /etc/firewall41.fw
|
||||
# files: firewall41.conf /etc/firewall41.conf
|
||||
@ -163,7 +163,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "eth1 2.2.2.2/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:17:59 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:14 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:00 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:15 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall5.fw /etc/fw/firewall5.fw
|
||||
# files: firewall5.conf /etc/fw/firewall5.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:00 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:15 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:01 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:16 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall51.fw /etc/fw/firewall51.fw
|
||||
# files: firewall51.conf /etc/fw/firewall51.conf
|
||||
@ -80,7 +80,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:01 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:16 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:01 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:16 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall6.fw /etc/fw/firewall6.fw
|
||||
# files: firewall6.conf /etc/fw/firewall6.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:01 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:16 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:02 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:17 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall62.fw /etc/firewall62.fw
|
||||
# files: firewall62.conf /etc/firewall62.conf
|
||||
@ -185,7 +185,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en1 222.222.222.222/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:02 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:17 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:03 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:17 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall63.fw /etc/fw/firewall63.fw
|
||||
# files: firewall63.conf /etc/fw/firewall63.conf
|
||||
@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:03 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:17 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:03 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:18 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall7.fw /etc/fw/firewall7.fw
|
||||
# files: firewall7.conf /etc/fw/firewall7.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:03 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:18 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:04 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:18 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall70.fw /etc/fw/firewall70.fw
|
||||
# files: firewall70.conf /etc/fw/firewall70.conf
|
||||
@ -82,7 +82,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:04 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:18 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:04 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:19 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall8.fw /etc/firewall8.fw
|
||||
# files: firewall8.conf /etc/firewall8.conf
|
||||
@ -72,7 +72,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:04 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:19 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:06 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:20 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall80-4.5.fw /etc/firewall80-4.5.fw
|
||||
# files: firewall80-4.5.conf /etc/firewall80-4.5.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:06 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:20 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:05 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:20 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall80.fw /etc/firewall80.fw
|
||||
# files: firewall80.conf /etc/firewall80.conf
|
||||
@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:05 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:20 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:06 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:21 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall9.fw /etc/fw/firewall9.fw
|
||||
# files: firewall9.conf /etc/fw/firewall9.conf
|
||||
@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:06 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:21 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:07 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:21 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall91.fw /etc/fw/pf.fw
|
||||
# files: firewall91.conf /etc/fw/pf.conf
|
||||
@ -240,7 +240,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:21 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:07 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:22 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall92.fw /etc/fw/pf.fw
|
||||
# files: firewall92.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@ -160,7 +160,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:22 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:24 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_1_openbsd-1.fw /etc/pf_cluster_1_openbsd-1.fw
|
||||
# files: pf_cluster_1_openbsd-1.conf /etc/pf_cluster_1_openbsd-1.conf
|
||||
@ -289,7 +289,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:24 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:24 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_1_openbsd-2.fw /etc/pf_cluster_1_openbsd-2.fw
|
||||
# files: pf_cluster_1_openbsd-2.conf /etc/pf_cluster_1_openbsd-2.conf
|
||||
@ -186,7 +186,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:24 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:25 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_2_freebsd-1.fw /etc/pf_cluster_2_freebsd-1.fw
|
||||
# files: pf_cluster_2_freebsd-1.conf /etc/pf_cluster_2_freebsd-1.conf
|
||||
@ -168,7 +168,7 @@ parse_fwb_vlans() {
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
$IFCONFIG | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
@ -189,7 +189,7 @@ update_vlans_of_interface() {
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -210,7 +210,7 @@ sync_vlan_interfaces() {
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -232,7 +232,7 @@ sync_carp_interfaces() {
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -291,7 +291,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en1 192.168.1.2/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:25 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:25 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_2_freebsd-2.fw /etc/pf_cluster_2_freebsd-2.fw
|
||||
# files: pf_cluster_2_freebsd-2.conf /etc/pf_cluster_2_freebsd-2.conf
|
||||
@ -132,7 +132,7 @@ update_addresses_of_interface() {
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
$IFCONFIG | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
@ -188,7 +188,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en1 192.168.1.3/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:25 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:25 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_3_openbsd-3.fw /etc/pf_cluster_3_openbsd-3.fw
|
||||
# files: pf_cluster_3_openbsd-3.conf /etc/pf_cluster_3_openbsd-3.conf
|
||||
@ -292,7 +292,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan100 172.20.0.2/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:25 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:25 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_3_openbsd-4.fw /etc/pf_cluster_3_openbsd-4.fw
|
||||
# files: pf_cluster_3_openbsd-4.conf /etc/pf_cluster_3_openbsd-4.conf
|
||||
@ -190,7 +190,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan100 172.20.0.3/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Feb 8 11:18:10 2011 by vadim"
|
||||
log "Activating firewall script generated Tue Feb 8 14:11:25 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3464
|
||||
# Firewall Builder fwb_pf v4.2.0.3465
|
||||
#
|
||||
# Generated Tue Feb 8 11:18:10 2011 PST by vadim
|
||||
# Generated Tue Feb 8 14:11:25 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_4_rc.conf.local /etc/pf_cluster_4_rc.conf.local
|
||||
# files: pf_cluster_4_pf.conf /etc/pf_cluster_4_pf.conf
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user