From owner-freebsd-pf@FreeBSD.ORG Thu Dec 29 08:20:39 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DAB0616A41F for ; Thu, 29 Dec 2005 08:20:39 +0000 (GMT) (envelope-from wash@wananchi.com) Received: from ns2.wananchi.com (ns2.wananchi.com [62.8.64.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 671F943D5A for ; Thu, 29 Dec 2005 08:20:35 +0000 (GMT) (envelope-from wash@wananchi.com) Received: from wash by ns2.wananchi.com with local (Exim 4.60 #0 (FreeBSD 4.11-STABLE)) id 1Ert1T-000GfN-Pn by authid for ; Thu, 29 Dec 2005 11:20:31 +0300 Date: Thu, 29 Dec 2005 11:20:31 +0300 From: Odhiambo Washington To: freebsd-pf@freebsd.org Message-ID: <20051229082031.GA55581@ns2.wananchi.com> Mail-Followup-To: Odhiambo Washington , freebsd-pf@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Disclaimer: Any views expressed in this message, where not explicitly attributed otherwise, are mine alone!. X-Mailer: Mutt 1.5.11 (2005-09-15) X-Designation: Systems Administrator, Wananchi Online Ltd. X-Location: Nairobi, KE, East Africa. User-Agent: Mutt/1.5.11 Subject: PF and MAC framework - panic X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2005 08:20:40 -0000 Hello everyone, I'm a PF newbie only from this week. I've been using IPFilter all along. On my 6.0 box acting as a router, I was also playing with Mandatory Access Control, especially mac_lomac. This seemed to work with IPFilter but the moment I switched to PF, the machine would panic and reboot. I had mac_lomac_enable="YES" in /boot/loader.conf. This is after I compiled a kernel with " options MAC". in /etc/sysctl.conf I had the following: security.mac.lomac.enabled=1 security.mac.lomac.revocation_enabled=1 security.mac.lomac.ptys_equal=1 And in /etc/rc.conf, all active interfaces were configured with "maclabel lomac/equal" added to the ifconfig args. I'd switch from ipfilter/ipnat to PF by flushing rules in this order: ipf -Fa ipnat -FC pfctl -e pfctl -f /etc/pf.conf At this juncture, the box would panic: panic: mac_lomac_dominate_element: a->mle_type invalid. A memory dump would then occur and the box reboots. I went a step ahead: disabled IPFilter in rc.conf and enabled PF and rebooted. The box would fail to reboot in this case and panic over and over until I disabled mac_lomac_enable="YES" in /boot/loader.conf, the relevant entries in rc.conf and sysctl.conf Anyone using MAC who can reproduce the same? -Wash http://www.netmeister.org/news/learn2quote.html -- +======================================================================+ |\ _,,,---,,_ | Odhiambo Washington Zzz /,`.-'`' -. ;-;;,_ | Wananchi Online Ltd. www.wananchi.com |,4- ) )-,_. ,\ ( `'-'| Tel: +254 20 313985-9 +254 20 313922 '---''(_/--' `-'\_) | GSM: +254 722 743223 +254 733 744121 +======================================================================+ If life is a stage, I want some better lighting.