From owner-freebsd-bugs@FreeBSD.ORG Sat Jan 31 14:50:28 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DCB4D16A4CF for ; Sat, 31 Jan 2004 14:50:27 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7AB4D43D48 for ; Sat, 31 Jan 2004 14:50:22 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i0VMoMFR091393 for ; Sat, 31 Jan 2004 14:50:22 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i0VMoMGr091392; Sat, 31 Jan 2004 14:50:22 -0800 (PST) (envelope-from gnats) Resent-Date: Sat, 31 Jan 2004 14:50:22 -0800 (PST) Resent-Message-Id: <200401312250.i0VMoMGr091392@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, abowhill Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DBCA716A4E6 for ; Sat, 31 Jan 2004 14:49:51 -0800 (PST) Received: from kosmos.my.net (c-24-16-193-147.client.comcast.net [24.16.193.147]) by mx1.FreeBSD.org (Postfix) with ESMTP id 012BF43D31 for ; Sat, 31 Jan 2004 14:49:50 -0800 (PST) (envelope-from kosmos@kosmos.my.net) Received: from kosmos.my.net (localhost [127.0.0.1]) by kosmos.my.net (8.12.10/8.12.10) with ESMTP id i0VMkwsN000351 for ; Sat, 31 Jan 2004 14:47:02 -0800 (PST) (envelope-from kosmos@kosmos.my.net) Received: (from kosmos@localhost) by kosmos.my.net (8.12.10/8.12.10/Submit) id i0VMkv5e000350; Sat, 31 Jan 2004 14:46:57 -0800 (PST) (envelope-from kosmos) Message-Id: <200401312246.i0VMkv5e000350@kosmos.my.net> Date: Sat, 31 Jan 2004 14:46:57 -0800 (PST) From: kosmos To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: kern/62193: firewall klm fails to parse divert keyword properly X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: abowhill List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Jan 2004 22:50:28 -0000 >Number: 62193 >Category: kern >Synopsis: firewall klm fails to parse divert keyword properly >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jan 31 14:50:22 PST 2004 >Closed-Date: >Last-Modified: >Originator: abowhill >Release: FreeBSD 4.9-STABLE i386 >Organization: NA >Environment: System: FreeBSD kosmos.my.net 4.9-STABLE FreeBSD 4.9-STABLE #1: Sat Jan 31 13:49:20 PST 2004 root@kosmos.my.net:/usr/obj/usr/src/sys/KOSMOS i386 >Description: When a default GENERIC 4.9-STABLE system is configured for natd and OPEN firewall type, when system boots and tries to add an ipfw rule using the divert keyword, it fails: Jan 31 13:27:01 kosmos /kernel: IP packet filtering initialized, divert disabled, rule-based forwarding enabled, default to d$ Jan 31 13:27:01 kosmos /kernel: ip_fw_ctl: invalid command In /etc/rc.firewall (Network Address Translation Section, near line 110) the following line triggers the error: ${fwcmd} add 50 divert natd all from any to any via ${natd_interface} This error only happens when using the firewall klm, as when the sytem is built with a default GENERIC kernel. If the kernel is rebuilt with firewall options enabled: options IPFIREWALL options IPDIVERT the divert command in /etc/rc.firewall works fine, becuase the klm is not loaded >How-To-Repeat: 1.) Obtain latest 4.9-STABLE source tree (probably post Jan. 26th) 2.) Modify /etc/rc.conf to set system up for nat forwarding natd_enable="YES" firewall_enable="YES" firewall_type="OPEN" 3.) Build and install a system using GENERIC kernel configuration to force firewall klm to load 4.) Reboot, noting "Invalid command" error message on screen and in /var/log/messages 5.) rebuild kernel with options options IPFIREWALL options IPDIVERT 6.) reboot system, noting that firewall divert command works correctly >Fix: Workaround: build kernel with IPFIREWALL and IPDIVERT options, circumventing the firewall kernel loadable module. >Release-Note: >Audit-Trail: >Unformatted: