Date: Sun, 13 Mar 2005 03:18:14 GMT From: Jonathan Wallace <jonw@whoweb.com> To: freebsd-gnats-submit@FreeBSD.org Subject: i386/78762: /etc/rc.d/ipfw should excecute $firewall_script not read it Message-ID: <200503130318.j2D3IE3Z087532@www.freebsd.org> Resent-Message-ID: <200503130320.j2D3K2vg000229@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 78762
>Category: i386
>Synopsis: /etc/rc.d/ipfw should excecute $firewall_script not read it
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-i386
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Mar 13 03:20:01 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Jonathan Wallace
>Release: 5.3-RELEASE
>Organization:
>Environment:
FreeBSD wallace 5.3-RELEASE FreBSD 5.3-RELEASE #3: Feb 27 23:03:55 EST 2005 root@wallace:/usr/obj/usr/src/sys/WALLACE i386
>Description:
/etc/rc.d/ipfw has been coded with the command '. "${firewall_script}"' and fails to complete successfully if firewall_script contains an "exit" statement. Given that it is common, not to mention good coding practice, to utilize an "exit" when finishing execution of a program, the /etc/rc.d/ipfw script should execute firewall_script by calling it with a path instead of using the shell "." command to read the file.
>How-To-Repeat:
1) Configure a multi-homed system with ipfw and natd
2) Create a shell script (/etc/myfwscript) with a small set of firewall rules. At the end of the file make sure you include an "exit" statement.
3) Add firewall_script="myfwscript" to /etc/rc.conf
4) Make sure your natd definitions are set up correctly in /etc/rc.conf
5) Restart your machine and check to see if natd is running. It won't be.
6) Re-edit /etc/myfwscript and remove the "exit" statement.
7) Restart your machine and check to see if natd is running. It will be.
>Fix:
In /etc/rc.d/ipfw:
change
. "$firewall_script"
to
$firewall_script
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503130318.j2D3IE3Z087532>