From owner-freebsd-current@FreeBSD.ORG  Thu Aug 19 16:53:00 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B4BDF16A4CE
	for <current@FreeBSD.org>; Thu, 19 Aug 2004 16:53:00 +0000 (GMT)
Received: from mail1.speakeasy.net (mail1.speakeasy.net [216.254.0.201])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8D59343D1D
	for <current@FreeBSD.org>; Thu, 19 Aug 2004 16:53:00 +0000 (GMT)
	(envelope-from jhb@FreeBSD.org)
Received: (qmail 26337 invoked from network); 19 Aug 2004 16:53:00 -0000
Received: from dsl027-160-063.atl1.dsl.speakeasy.net (HELO server.baldwin.cx)
	([216.27.160.63])          (envelope-sender <jhb@FreeBSD.org>)
	encrypted SMTP
	for <current@FreeBSD.org>; 19 Aug 2004 16:52:59 -0000
Received: from [10.50.40.208] (gw1.twc.weather.com [216.133.140.1])
	(authenticated bits=0)
	by server.baldwin.cx (8.12.11/8.12.11) with ESMTP id i7JGqqba056238;
	Thu, 19 Aug 2004 12:52:56 -0400 (EDT)
	(envelope-from jhb@FreeBSD.org)
From: John Baldwin <jhb@FreeBSD.org>
To: freebsd-current@FreeBSD.org
Date: Thu, 19 Aug 2004 12:52:30 -0400
User-Agent: KMail/1.6.2
References: <20040819154334.GA23926@pit.databus.com>
	<20040819161315.GB29937@pit.databus.com> <4124D2F0.8050000@theatre.msu.edu>
In-Reply-To: <4124D2F0.8050000@theatre.msu.edu>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200408191252.30593.jhb@FreeBSD.org>
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on server.baldwin.cx
cc: Barney Wolff <barney@databus.com>
cc: "Jonathan T. Sage" <sagejona@theatre.msu.edu>
cc: current@FreeBSD.org
Subject: Re: RELENG_5 kernel b0rken with IPFIREWALL and without PFIL_HOOKS
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Aug 2004 16:53:00 -0000

On Thursday 19 August 2004 12:18 pm, Jonathan T. Sage wrote:
> Barney Wolff wrote:
> > Sure, invoking ipfw directly works fine when ipfw's compiled into the
> > kernel, as does dotting /etc/rc.firewall.  But /etc/rc.d/ipfw is what's
> > run at boot time, and that would seem, at least as I read it, to require
> > that ipfw be a module, not compiled in.
>
> no, it dosn't, kinda.
>
>          if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
>
> if the sysctl item net.inet.ip.fw.enable does NOT exist, then try and
> load the module.  otherwise, return 0 (all ok)
>
>                  if ! kldload ipfw; then
>                          warn unable to load firewall module.
>                          return 1
>                  fi
>          fi
>
> it is failing because the net.inet.ip.fw.enable sysctl was removed.  the
> script needs to be updated to rely on one of the still existing sysctls.
>   as of right now, with no edits, the script cannot complete succesfully
> unless ipfw is left as a module.  No doubt this will be fixed shortly.

Does it work ok if you change it to be 'net.inet.ip.fw'?

-- 
John Baldwin <jhb@FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org