Project

General

Profile

Download (3.07 KB) Statistics
| Branch: | Tag: | Revision:
1 46e27ea7 Renato Botelho
#!/usr/local/bin/php -f
2
<?php
3
/*
4 bd4471a4 Phil Davis
	rc.kill_states
5 46e27ea7 Renato Botelho
	Copyright (C) 2013 Renato Botelho (garga@pfsense.org)
6 5721595b Chris Buechler
	part of pfSense (https://www.pfsense.org)
7 46e27ea7 Renato Botelho
8
	Redistribution and use in source and binary forms, with or without
9
	modification, are permitted provided that the following conditions are met:
10
11
	1. Redistributions of source code must retain the above copyright notice,
12
	this list of conditions and the following disclaimer.
13
14
	2. Redistributions in binary form must reproduce the above copyright
15
	notice, this list of conditions and the following disclaimer in the
16
	documentation and/or other materials provided with the distribution.
17
18
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
19
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27
	POSSIBILITY OF SUCH DAMAGE.
28
*/
29
30
/* parse the configuration and include all functions used below */
31
require_once("globals.inc");
32
require_once("config.inc");
33
require_once("interfaces.inc");
34
require_once("util.inc");
35
36
// Do not process while booting
37 285ef132 Ermal LUÇI
if (platform_booting())
38
	return;
39 46e27ea7 Renato Botelho
40
/* Interface address to cleanup states */
41
$interface = str_replace("\n", "", $argv[1]);
42
43
/* IP address to cleanup states */
44
$local_ip = str_replace("\n", "", $argv[2]);
45
46
if (empty($interface) || !does_interface_exist($interface)) {
47
	log_error("rc.kill_states: Invalid interface '{$interface}'");
48 8ad1ee63 Ermal LUÇI
	return;
49 46e27ea7 Renato Botelho
}
50
51
if (!empty($local_ip)) {
52
	list($local_ip, $subnet_bits) = explode("/", $local_ip);
53
54
	if (empty($subnet_bits))
55
		$subnet_bits = "32";
56
57
	if (!is_ipaddr($local_ip)) {
58
		log_error("rc.kill_states: Invalid IP address '{$local_ip}'");
59 8ad1ee63 Ermal LUÇI
		return;
60 46e27ea7 Renato Botelho
	}
61
}
62
63
if (!isset($config['system']['kill_states'])) {
64
	if (!empty($local_ip)) {
65
		log_error("rc.kill_states: Removing states for IP {$local_ip}/{$subnet_bits}");
66 d13b7363 Renato Botelho
		$nat_states = exec_command("/sbin/pfctl -i {$interface} -ss | " .
67
			"/usr/bin/egrep '\-> +{$local_ip}:[0-9]+ +\->'");
68
69
		$cleared_states = array();
70
		foreach(explode("\n", $nat_states) as $nat_state) {
71
			if (preg_match_all('/([\d\.]+):[\d]+[\s->]+/i', $nat_state, $matches, PREG_SET_ORDER) != 3)
72
				continue;
73
74
			$src = $matches[0][1];
75
			$dst = $matches[2][1];
76
77
			if (empty($src) || empty($dst) || in_array("{$src},{$dst}", $cleared_states))
78
				continue;
79
80
			$cleared_states[] = "{$src},{$dst}";
81 0174c480 Ermal LUÇI
			pfSense_kill_states($src, $dst);
82 d13b7363 Renato Botelho
		}
83
84 0174c480 Ermal LUÇI
		pfSense_kill_states("0.0.0.0/0", "{$local_ip}/{$subnet_bits}");
85
		pfSense_kill_states("{$local_ip}/{$subnet_bits}");
86
		pfSense_kill_srcstates("{$local_ip}/{$subnet_bits}");
87 46e27ea7 Renato Botelho
	}
88
	log_error("rc.kill_states: Removing states for interface {$interface}");
89
	mwexec("/sbin/pfctl -i {$interface} -Fs", true);
90
}