Date: Mon, 21 Jan 2008 21:14:40 GMT From: Niki Denev <nike_d@cytexbg.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/119874: "/etc/rc.d/pf reload" fails if there are macros defined in pf_flags rc variable Message-ID: <200801212114.m0LLEe5E076142@www.freebsd.org> Resent-Message-ID: <200801212120.m0LLK1mg099256@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 119874
>Category: misc
>Synopsis: "/etc/rc.d/pf reload" fails if there are macros defined in pf_flags rc variable
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Jan 21 21:20:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Niki Denev
>Release: FreeBSD 7.0-PRERELEASE
>Organization:
>Environment:
FreeBSD rtr1 7.0-PRERELEASE FreeBSD 7.0-PRERELEASE #1: Mon Jan 21 17:24:53 UTC 2008 root@rtr3:/usr/obj/usr/src/sys/RTR amd64
>Description:
I'm using the pf_flags rc var to set macros for pf.conf
files i use in redundant router configuration.
This way i can have exactly the same pf.conf on all
of the routers, and still set host specific
options as "hostid" used by pfsync via rc.conf
The problem is that when i use "/etc/rc.d/pf reload" to reload the rules,
the rc.d/pf script first executes pfctl with -n option to check the
pf.conf syntax, but fails to include
the $pf_flags var, and fails because of undefined macros.
>How-To-Repeat:
use macros in pf.conf defined in rc.conf as pf_flags="-D macro=value"
and then do
# /etc/rc.d/pf reload
and it will fail because when the rules are checked on reloading the $pf_flags variable is not included in the command.
>Fix:
Small patch to /etc/rc.d/pf which adds $pf_flags variable when executing pfctl with "-n" flag to check ruleset syntax.
Patch attached with submission follows:
--- /etc/rc.d/pf.orig 2008-01-21 11:18:27.000000000 +0200
+++ /etc/rc.d/pf 2008-01-21 11:29:56.000000000 +0200
@@ -50,7 +50,7 @@
pf_reload()
{
echo "Reloading pf rules."
- $pf_program -n -f "$pf_rules" || return 1
+ $pf_program -n -f "$pf_rules" $pf_flags || return 1
# Flush everything but existing state entries that way when
# rules are read in, it doesn't break established connections.
$pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200801212114.m0LLEe5E076142>