From owner-freebsd-net@FreeBSD.ORG Thu Jan 31 19:40:26 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9360116A46B for ; Thu, 31 Jan 2008 19:40:26 +0000 (UTC) (envelope-from ndenev@gmail.com) Received: from rv-out-0910.google.com (rv-out-0910.google.com [209.85.198.189]) by mx1.freebsd.org (Postfix) with ESMTP id 9A44013C4EC for ; Thu, 31 Jan 2008 19:40:20 +0000 (UTC) (envelope-from ndenev@gmail.com) Received: by rv-out-0910.google.com with SMTP id g13so684668rvb.43 for ; Thu, 31 Jan 2008 11:40:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; bh=dRKKLnEPdptsI+WrESjJt6Mz5JjYLCXkvHykDrXv2mg=; b=NAopZH9ieVICw3510slp5ELyx0O3mKlqMqU6qWaT3PcOMa8wEt6+yj6pAvBVwBwgb2teyfgUxo1x9INJqTFvHJrILCmidMgbOOwhf/5X5OdnDQa/c7AWABex0pPv3znuQIpnVt+ukiVQWHC8DoNbBdEjVO57mCv4JTXSWN70b0A= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=jzjQDrO6Q2LXSj8D/nETgbIQOK1QAPPaq3nkDLBenSFMAXBJBnjz2oMv6MxxkNi7w5x6CWyf5RwhfqUN/q1YPEAR1hAHga1LeOGf1udyqzE7INaQX8HiyzpVjT6tbJSir7yqoqVrVzdIt3/nllWWJuf31UJJer5/L2l+Uc5iKVU= Received: by 10.141.13.16 with SMTP id q16mr1795102rvi.99.1201808417272; Thu, 31 Jan 2008 11:40:17 -0800 (PST) Received: by 10.141.170.18 with HTTP; Thu, 31 Jan 2008 11:40:17 -0800 (PST) Message-ID: <2e77fc10801311140i7ed440fcp9337c28b4b9aa179@mail.gmail.com> Date: Thu, 31 Jan 2008 21:40:17 +0200 From: "Niki Denev" Sender: ndenev@gmail.com To: freebsd-net@freebsd.org In-Reply-To: <2e77fc10801211326t21239b58o5b5c7604a2980543@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <2e77fc10801210142g560f6f65p9908957d0c7a799e@mail.gmail.com> <2e77fc10801211326t21239b58o5b5c7604a2980543@mail.gmail.com> X-Google-Sender-Auth: 7a5abfa02e3c7dce Subject: Re: [PATCH] "/etc/rc.d/pf reload" fails if there are macros defined in pf_flags rcvar. X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jan 2008 19:40:26 -0000 On Jan 21, 2008 11:26 PM, Niki Denev wrote: > > On Jan 21, 2008 11:42 AM, Niki Denev wrote: > > Hi, > > > > I'm using the pf_flags rc var to set macros for pf.conf files i use in > > redundant router configuration. > > This way i can have exactly the same pf.conf on all of the routers, > > and still set host specific > > options as "hostid" used by pfsync via rc.conf > > The problem is that when i use "/etc/rc.d/pf reload" to reload the rules, > > the rc.d/pf script first executes pfctl with -n option to check the > > pf.conf syntax, but fails to include > > the $pf_flags var, and fails because of undefined macros. > > The following patch fixed this for me. > > > > --- pf.orig 2008-01-21 11:18:27.000000000 +0200 > > +++ pf 2008-01-21 11:29:56.000000000 +0200 > > @@ -50,7 +50,7 @@ > > pf_reload() > > { > > echo "Reloading pf rules." > > - $pf_program -n -f "$pf_rules" || return 1 > > + $pf_program -n -f "$pf_rules" $pf_flags || return 1 > > # Flush everything but existing state entries that way when > > # rules are read in, it doesn't break established connections. > > $pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables > > -Fosfp > /dev/null 2>&1 > > > > > > > > -- > > Niki > > > > Just filed under misc/119874 > The patch in the PR is incomplete, this one adds $pf_flags also to pf_check() : --- pf.orig 2008-01-31 21:30:33.000000000 +0200 +++ pf 2008-01-31 21:34:23.000000000 +0200 @@ -44,13 +44,13 @@ pf_check() { echo "Checking pf rules." - $pf_program -n -f "$pf_rules" + $pf_program -n -f "$pf_rules" $pf_flags } pf_reload() { echo "Reloading pf rules." - $pf_program -n -f "$pf_rules" || return 1 + $pf_program -n -f "$pf_rules" $pf_flags || return 1 # Flush everything but existing state entries that way when # rules are read in, it doesn't break established connections. $pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1 -- Niki