Date: Thu, 19 Aug 2004 13:04:55 -0400 From: "Jonathan T. Sage" <sagejona@theatre.msu.edu> To: John Baldwin <jhb@FreeBSD.org> Cc: freebsd-current@FreeBSD.org Subject: Re: RELENG_5 kernel b0rken with IPFIREWALL and without PFIL_HOOKS Message-ID: <4124DDB7.5000904@theatre.msu.edu> In-Reply-To: <200408191252.30593.jhb@FreeBSD.org> References: <20040819154334.GA23926@pit.databus.com> <20040819161315.GB29937@pit.databus.com> <4124D2F0.8050000@theatre.msu.edu> <200408191252.30593.jhb@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig51EA7E9AF34EBAEF12D3C637
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
John Baldwin wrote:
> On Thursday 19 August 2004 12:18 pm, Jonathan T. Sage wrote:
>
>>Barney Wolff wrote:
>>
>>>Sure, invoking ipfw directly works fine when ipfw's compiled into the
>>>kernel, as does dotting /etc/rc.firewall. But /etc/rc.d/ipfw is what's
>>>run at boot time, and that would seem, at least as I read it, to require
>>>that ipfw be a module, not compiled in.
>>
>>no, it dosn't, kinda.
>>
>> if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
>>
>>if the sysctl item net.inet.ip.fw.enable does NOT exist, then try and
>>load the module. otherwise, return 0 (all ok)
>>
>> if ! kldload ipfw; then
>> warn unable to load firewall module.
>> return 1
>> fi
>> fi
>>
>>it is failing because the net.inet.ip.fw.enable sysctl was removed. the
>>script needs to be updated to rely on one of the still existing sysctls.
>> as of right now, with no edits, the script cannot complete succesfully
>>unless ipfw is left as a module. No doubt this will be fixed shortly.
>
>
> Does it work ok if you change it to be 'net.inet.ip.fw'?
>
maybe. I don't have a system with this change compiled in, so I can
only speculate, and I am by no means a shell scripting wizard. If that
line is expecting only a non-error shell return, yes, substituting
net.inet.ip.fw should work. If it is expecting a "1" returned (which
net.inet.ip.fw.enable would have been set to), then no, the script needs
a bit more tweaking. like I said, I know enough to read a script and
understand what it does, but sh is not my thing.
~j
--
Jonathan T. Sage
Theatrical Lighting / Set Designer
Professional Web Design
"He said he likes me, but he's not in-like with me."- Connie, King of
the Hill
[HTTP://www.JTSage.com]
[HTTP://design.JTSage.com]
[sagejona@msu.edu]
[See Headers for Contact Info]
--------------enig51EA7E9AF34EBAEF12D3C637
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFBJN26oVmW2UUup/ERAuxLAJ4ykrcrJbIoXEC7C0Zf2kzMW/oiTQCfYqUK
nct6/KacBY2YOILZmkw37Lk=
=9hq5
-----END PGP SIGNATURE-----
--------------enig51EA7E9AF34EBAEF12D3C637--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4124DDB7.5000904>