From owner-cvs-all@FreeBSD.ORG  Thu Aug 19 16:47:31 2004
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 5941C16A4CE; Thu, 19 Aug 2004 16:47:31 +0000 (GMT)
Received: from www.cryptography.com (li-22.members.linode.com [64.5.53.22])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id D99F343D48; Thu, 19 Aug 2004 16:47:30 +0000 (GMT)
	(envelope-from nate@root.org)
Received: from [10.0.0.34] (adsl-67-127-84-57.dsl.snfc21.pacbell.net
	[67.127.84.57])
	by www.cryptography.com (8.12.8/8.12.8) with ESMTP id i7JGlR8U010283;
	Thu, 19 Aug 2004 09:47:27 -0700
Message-ID: <4124D99F.7010306@root.org>
Date: Thu, 19 Aug 2004 09:47:27 -0700
From: Nate Lawson <nate@root.org>
User-Agent: Mozilla Thunderbird 0.7 (X11/20040702)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Andre Oppermann <andre@freebsd.org>
References: <200408172205.i7HM5sDs087606@repoman.freebsd.org>
	<20040819030854.GM99521@freebsd3.cimlogic.com.au> <41242606.6070604@root.org>
	<41247C7A.B21E7660@freebsd.org>
In-Reply-To: <41247C7A.B21E7660@freebsd.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: cvs-src@freebsd.org
cc: src-committers@freebsd.org
cc: cvs-all@freebsd.org
cc: John Birrell <jb@cimlogic.com.au>
Subject: Re: cvs commit: src/sys/conf files options src/sys/modules/ipfw 
 Makefilesrc/sys/net bridge.c src/sys/netgraph ng_bridge.c  src/sys/netinet
 ip_fw_pfil.c ip_input.cip_output.c ...
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Aug 2004 16:47:31 -0000

Andre Oppermann wrote:
> Nate Lawson wrote:
> 
>>John Birrell wrote:
>>
>>>On Tue, Aug 17, 2004 at 10:05:54PM +0000, Andre Oppermann wrote:
>>>
>>>
>>>>andre       2004-08-17 22:05:54 UTC
>>>>
>>>> FreeBSD src repository
>>>>
>>>> Modified files:
>>>>   sys/conf             files options
>>>>   sys/modules/ipfw     Makefile
>>>>   sys/net              bridge.c
>>>>   sys/netgraph         ng_bridge.c
>>>>   sys/netinet          ip_divert.c ip_dummynet.c ip_dummynet.h
>>>>                        ip_fastfwd.c ip_fw.h ip_fw2.c ip_input.c
>>>>                        ip_output.c ip_var.h raw_ip.c tcp_input.c
>>>>                        tcp_sack.c
>>>>   sys/sys              mbuf.h
>>>> Added files:
>>>>   sys/netinet          ip_fw_pfil.c
>>>
>>>
>>>A kernel config file which includes IPFIREWALL, but not PFIL_HOOKS will
>>>not link (for obvious reasons).
>>>
>>>Also, the script /etc/rc.d/ipfw tests the 'enable' sysctl which is removed
>>>by this commit. The result is that if a kernel is booted with ipfw built
>>>in, the /etc/rc.d/ipfw script tries to load the ipfw module. The module
>>>load fails (for obvious reasons), causing the ipfw initialisation to fail
>>>leaving the firewall in the deny-everything mode regardless of what is
>>>configured in /etc/rc.conf.
>>>
>>>This is an issue for 5.3. [ I assume re@ are reading this list ]
>>
>>I've been bitten by both.  Actually, ipfw.ko won't load into a kernel
>>built without PFIL_HOOKS.  The duplicate load attempt also happens to me.
> 
> 
> I'm looking into this and will have a fix later today.

Thanks, Andre.

-Nate