From owner-freebsd-i386@FreeBSD.ORG Sun Mar 13 03:20:02 2005 Return-Path: Delivered-To: freebsd-i386@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AED4E16A4CE for ; Sun, 13 Mar 2005 03:20:02 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6061A43D41 for ; Sun, 13 Mar 2005 03:20:02 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j2D3K242000230 for ; Sun, 13 Mar 2005 03:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j2D3K2vg000229; Sun, 13 Mar 2005 03:20:02 GMT (envelope-from gnats) Resent-Date: Sun, 13 Mar 2005 03:20:02 GMT Resent-Message-Id: <200503130320.j2D3K2vg000229@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-i386@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jonathan Wallace Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9B11D16A4CE for ; Sun, 13 Mar 2005 03:18:14 +0000 (GMT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 75F6843D3F for ; Sun, 13 Mar 2005 03:18:14 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j2D3IEMR087533 for ; Sun, 13 Mar 2005 03:18:14 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j2D3IE3Z087532; Sun, 13 Mar 2005 03:18:14 GMT (envelope-from nobody) Message-Id: <200503130318.j2D3IE3Z087532@www.freebsd.org> Date: Sun, 13 Mar 2005 03:18:14 GMT From: Jonathan Wallace To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: i386/78762: /etc/rc.d/ipfw should excecute $firewall_script not read it X-BeenThere: freebsd-i386@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: I386-specific issues for FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2005 03:20:02 -0000 >Number: 78762 >Category: i386 >Synopsis: /etc/rc.d/ipfw should excecute $firewall_script not read it >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-i386 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Mar 13 03:20:01 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Jonathan Wallace >Release: 5.3-RELEASE >Organization: >Environment: FreeBSD wallace 5.3-RELEASE FreBSD 5.3-RELEASE #3: Feb 27 23:03:55 EST 2005 root@wallace:/usr/obj/usr/src/sys/WALLACE i386 >Description: /etc/rc.d/ipfw has been coded with the command '. "${firewall_script}"' and fails to complete successfully if firewall_script contains an "exit" statement. Given that it is common, not to mention good coding practice, to utilize an "exit" when finishing execution of a program, the /etc/rc.d/ipfw script should execute firewall_script by calling it with a path instead of using the shell "." command to read the file. >How-To-Repeat: 1) Configure a multi-homed system with ipfw and natd 2) Create a shell script (/etc/myfwscript) with a small set of firewall rules. At the end of the file make sure you include an "exit" statement. 3) Add firewall_script="myfwscript" to /etc/rc.conf 4) Make sure your natd definitions are set up correctly in /etc/rc.conf 5) Restart your machine and check to see if natd is running. It won't be. 6) Re-edit /etc/myfwscript and remove the "exit" statement. 7) Restart your machine and check to see if natd is running. It will be. >Fix: In /etc/rc.d/ipfw: change . "$firewall_script" to $firewall_script >Release-Note: >Audit-Trail: >Unformatted: