Unify rc.firewall and rc.firewall6, and obsolete rc.firewall6

and rc.d/ip6fw.

Reviewed by:	dougb, jhb
MFC after:	1 month

3 files changed, 13 insertions, 50 deletions

diff --git a/etc/rc.d/Makefile b/etc/rc.d/Makefile
index fbfac8a..7f72303 100755
--- a/etc/rc.d/Makefile
+++ b/etc/rc.d/Makefile
@@ -15,7 +15,7 @@ FILES=	DAEMON FILESYSTEMS LOGIN NETWORKING SERVERS \
 	hcsecd \
 	hostapd hostid hostid_save hostname \
 	inetd initrandom \
-	ip6addrctl ip6fw ipfilter ipfs ipfw ipmon \
+	ip6addrctl ipfilter ipfs ipfw ipmon \
 	ipnat ipsec ipxrouted \
 	jail \
 	kadmind kerberos keyserv kldxref kpasswdd \
diff --git a/etc/rc.d/ip6fw b/etc/rc.d/ip6fw
deleted file mode 100755
index ca95d36..0000000
--- a/etc/rc.d/ip6fw
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/sh
-#
-# $FreeBSD$
-#
-
-# PROVIDE: ip6fw
-# REQUIRE: routing
-# KEYWORD: nojail
-
-. /etc/rc.subr
-
-name="ip6fw"
-rcvar=`set_rcvar ipv6_firewall`
-start_cmd="ip6fw_start"
-stop_cmd="${SYSCTL_W} net.inet6.ip6.fw.enable=0"
-required_modules="ipfw"
-
-ip6fw_start()
-{
-	# Specify default rules file if none provided
-	if [ -z "${ipv6_firewall_script}" ]; then
-		ipv6_firewall_script=/etc/rc.firewall6
-	fi
-
-	# Load rules
-	#
-	if [ -r "${ipv6_firewall_script}" ]; then
-		/bin/sh "${ipv6_firewall_script}"
-		echo 'IPv6 Firewall rules loaded.'
-	elif [ "`ipfw show 65535`" = "65535 deny ip from any to any" ]; then
-		warn 'IPv6 firewall rules have not been loaded. Default' \
-		    ' to DENY all access.'
-	fi
-
-	# Enable firewall logging
-	#
-	if checkyesno ipv6_firewall_logging; then
-		echo 'IPv6 Firewall logging=YES'
-		sysctl net.inet.ip.fw.verbose=1 >/dev/null
-	fi
-
-	# Enable the firewall
-	#
-	${SYSCTL_W} net.inet6.ip6.fw.enable=1
-}
-
-load_rc_config $name
-run_rc_command "$1"
diff --git a/etc/rc.d/ipfw b/etc/rc.d/ipfw
index 872f278..dd7ab55 100755
--- a/etc/rc.d/ipfw
+++ b/etc/rc.d/ipfw
@@ -17,6 +17,8 @@ start_precmd="ipfw_prestart"
 stop_cmd="ipfw_stop"
 required_modules="ipfw"
 
+set_rcvar_obsolete ipv6_firewall_enable
+
 ipfw_prestart()
 {
 	if checkyesno dummynet_enable; then
@@ -61,7 +63,13 @@ ipfw_start()
 	# Enable the firewall
 	#
 	if ! ${SYSCTL_W} net.inet.ip.fw.enable=1 1>/dev/null 2>&1; then
-		warn "failed to enable firewall"
+		warn "failed to enable IPv4 firewall"
+	fi
+	if afexists inet6; then
+		if ! ${SYSCTL_W} net.inet6.ip6.fw.enable=1 1>/dev/null 2>&1
+		then
+			warn "failed to enable IPv6 firewall"
+		fi
 	fi
 }
 
@@ -70,6 +78,9 @@ ipfw_stop()
 	# Disable the firewall
 	#
 	${SYSCTL_W} net.inet.ip.fw.enable=0
+	if afexists inet6; then
+		${SYSCTL_W} net.inet6.ip6.fw.enable=0
+	fi
 	if [ -f /etc/rc.d/natd ] ; then
 		/etc/rc.d/natd quietstop
 	fi