Date: Sun, 4 Feb 2018 19:43:52 +0000 (UTC) From: Kurt Lidl <lidl@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r328861 - head/contrib/blacklist/libexec Message-ID: <201802041943.w14JhqR4012464@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: lidl Date: Sun Feb 4 19:43:51 2018 New Revision: 328861 URL: https://svnweb.freebsd.org/changeset/base/328861 Log: Update blacklist-helper to not emit messages from pf during operation. Use 'pfctl -k' when blocking a site to kill active tcp connections from the blocked address. Fix 'purge' operation for pf, which must dynamically determine which filters have been created, so the filters can be flushed by name. MFC after: 2 weeks Modified: head/contrib/blacklist/libexec/blacklistd-helper Modified: head/contrib/blacklist/libexec/blacklistd-helper ============================================================================== --- head/contrib/blacklist/libexec/blacklistd-helper Sun Feb 4 19:14:09 2018 (r328860) +++ head/contrib/blacklist/libexec/blacklistd-helper Sun Feb 4 19:43:51 2018 (r328861) @@ -80,8 +80,8 @@ add) echo "block in quick $proto from <port$6> to any $port" | \ /sbin/pfctl -a "$2/$6" -f - # insert $ip/$mask into per-protocol/port anchored table - /sbin/pfctl -a "$2/$6" -t "port$6" -T add "$addr/$mask" && \ - echo OK + /sbin/pfctl -qa "$2/$6" -t "port$6" -T add "$addr/$mask" && \ + /sbin/pfctl -q -k $addr && echo OK ;; esac ;; @@ -101,7 +101,7 @@ rem) /sbin/npfctl rule "$2" rem-id "$7" ;; pf) - /sbin/pfctl -a "$2/$6" -t "port$6" -T delete "$addr/$mask" && \ + /sbin/pfctl -qa "$2/$6" -t "port$6" -T delete "$addr/$mask" && \ echo OK ;; esac @@ -118,7 +118,13 @@ flush) /sbin/npfctl rule "$2" flush ;; pf) - /sbin/pfctl -a "$2/$6" -t "port$6" -T flush && echo OK + # dynamically determine which anchors exist + anchors=$(/sbin/pfctl -a $2 -s Anchors) + for anchor in $anchors; do + /sbin/pfctl -a $anchor -t "port${anchor##*/}" -T flush + /sbin/pfctl -a $anchor -F rules + done + echo OK ;; esac ;;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201802041943.w14JhqR4012464>