#!/bin/sh
# Revision 0.15 Sun Nov 26 18:08:04 EET 2006
#
# Copyright (c) 2006 Dominique Goncalves
# Copyright (c) 2006 Andrei Kolu
# Modified 2006 Kris Moore (PC-BSD Software)
#
# See COPYING for licence terms.
#
# Create a basic pf.conf.
# Block everything by default,
# Allow everything on lo0,
# Do not create rules on some interface ie: plip0,
# Allow all tcp and udp connections to outside with keep state flags,
# Allow icmp on all interfaces.
#
# PROVIDE: pf_rules
# REQUIRE: netif
# BEFORE: pf

. /etc/rc.subr

name="pf_rules"
rcvar=`set_rcvar`
start_cmd="create_rules"
required_files="$pf_rules"
create_rules ()
{
        echo "Creating $pf_rules."
        echo "set skip on lo0" > $pf_rules
        echo "set block-policy return" >> $pf_rules
        #echo "set loginterface rl0" >> $pf_rules
        echo "scrub in all" >> $pf_rules
        echo "block in log" >> $pf_rules
        echo "antispoof quick for lo0 inet" >> $pf_rules
        # block anything coming from source we have no back routes for
        echo "block in from no-route to any" >> $pf_rules
        # Allow anything on localhost
        echo "pass out quick on lo0 all" >> $pf_rules
        echo "pass in quick on lo0 all" >> $pf_rules
        # Allow all outgoing traffic
        echo "pass out keep state" >> $pf_rules
        echo 'table <blacklist> persist file "/etc/blacklist"'  >> $pf_rules
        echo "pass inet proto icmp from any to any" >> $pf_rules
        #############################################################
        # Ports from 49152 to 65535 is needed for SMB and other connectivity
        echo "pass in proto {tcp,udp} from any to any port 49152:65535 keep state" >> $pf_rules
       for inf in `ifconfig -l` ; do
                if `echo $inf | egrep -v 'lo|plip|gif|tun|pfsync' 1>/dev/null` ; then
                        # Check if we have a /etc/pf.inports file, and open those ports
                        if [ -e "/etc/pf.inports" ]
                        then
                          for PORT in `cat /etc/pf.inports | grep "^udp: " | cut -d " " -f 2`
                          do
                            echo "pass in on $inf proto udp from any to ($inf) port $PORT keep state" >> $pf_rules
                          done
                        fi
                        if [ -e "/etc/pf.inports" ]
                        then
                          for PORT in `cat /etc/pf.inports | grep "^tcp: " | cut -d " " -f 2`
                          do
                            echo "pass in on $inf proto tcp from any to ($inf) port $PORT keep state" >> $pf_rules
                          done
                        fi

                        # Deny all from our blacklist
                        echo "block on $inf from <blacklist> to any" >> $pf_rules
                fi
        done
        # restart PF firewall
        pfctl -f /etc/pf.conf
}


load_rc_config $name
run_rc_command "$1"