Date: Thu, 19 Aug 2004 12:04:14 -0400 From: "Jonathan T. Sage" <sagejona@theatre.msu.edu> Cc: current@freebsd.org Subject: Re: RELENG_5 kernel b0rken with IPFIREWALL and without PFIL_HOOKS Message-ID: <4124CF7E.7010802@theatre.msu.edu> In-Reply-To: <20040819155413.GB82175@ip.net.ua> References: <41249DEA.80404@portaone.com> <200408191300.i7JD0wvm006811@the-macgregors.org> <20040819154334.GA23926@pit.databus.com> <20040819155413.GB82175@ip.net.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig4F69D93D259F4CE956B16FB4
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Ruslan Ermilov wrote:
> On Thu, Aug 19, 2004 at 11:43:34AM -0400, Barney Wolff wrote:
>
>>I was inspired by the PFIL_HOOKS discussion to check my firewall rules :)
>>There were none, other than 65535. Apparently, /etc/rc.d/ipfw attempts
>>to kldload ipfw, which will fail if ipfw is compiled into the kernel,
>>and since the precmd failed, the _cmd will not be run. When did it
>>become mandatory to have ipfw as a module, not compiled in? Is there
>>some rationale for this? It strikes me as rather dangerous, especially
>>for firewalls, especially when default-to-accept is chosen. Am I just
>>confused, and missing some obvious bit of config?
>>
>>Is it relevant that my /usr is on vinum, and the rules are in /usr/local/etc?
>>
>
> net.inet.ip.fw.enable is gone, and it upsets /etc/rc.d/ipfw.
> I asked Andre to follow up on this.
>
>
> Cheers,
this in mind, changing
ipfw_precmd()
{
if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
if ! kldload ipfw; then
warn unable to load firewall module.
return 1
fi
fi
to something along the lines of :
ipfw_precmd()
{
if ! ${SYSCTL} net.inet.ip.fw > /dev/null 2>&1; then
if ! kldload ipfw; then
warn unable to load firewall module.
return 1
fi
fi
should correct the problem until the script maintainer has a chance to
take a look at exactlly what he/she may want to do.
hope this helps
~j
--
Jonathan T. Sage
Theatrical Lighting / Set Designer
Professional Web Design
"He said he likes me, but he's not in-like with me."- Connie, King of
the Hill
[HTTP://www.JTSage.com]
[HTTP://design.JTSage.com]
[sagejona@msu.edu]
[See Headers for Contact Info]
--------------enig4F69D93D259F4CE956B16FB4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFBJM+BoVmW2UUup/ERAr0JAKCIKVEor3/i7YPdd2k9HcB8VzMFNgCbB6XQ
nkaK8wiRcB/BIVpiMjdT/w0=
=z+Fh
-----END PGP SIGNATURE-----
--------------enig4F69D93D259F4CE956B16FB4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4124CF7E.7010802>