Re: RELENG_5 kernel b0rken with IPFIREWALL and without PFIL_HOOKS

From: Jonathan T. Sage <sagejona_at_theatre.msu.edu>
Date: Thu, 19 Aug 2004 13:04:55 -0400
John Baldwin wrote:
> On Thursday 19 August 2004 12:18 pm, Jonathan T. Sage wrote:
> 
>>Barney Wolff wrote:
>>
>>>Sure, invoking ipfw directly works fine when ipfw's compiled into the
>>>kernel, as does dotting /etc/rc.firewall.  But /etc/rc.d/ipfw is what's
>>>run at boot time, and that would seem, at least as I read it, to require
>>>that ipfw be a module, not compiled in.
>>
>>no, it dosn't, kinda.
>>
>>         if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
>>
>>if the sysctl item net.inet.ip.fw.enable does NOT exist, then try and
>>load the module.  otherwise, return 0 (all ok)
>>
>>                 if ! kldload ipfw; then
>>                         warn unable to load firewall module.
>>                         return 1
>>                 fi
>>         fi
>>
>>it is failing because the net.inet.ip.fw.enable sysctl was removed.  the
>>script needs to be updated to rely on one of the still existing sysctls.
>>  as of right now, with no edits, the script cannot complete succesfully
>>unless ipfw is left as a module.  No doubt this will be fixed shortly.
> 
> 
> Does it work ok if you change it to be 'net.inet.ip.fw'?
> 

maybe.  I don't have a system with this change compiled in, so I can 
only speculate, and I am by no means a shell scripting wizard.  If that 
line is expecting only a non-error shell return, yes, substituting 
net.inet.ip.fw should work.  If it is expecting a "1" returned (which 
net.inet.ip.fw.enable would have been set to), then no, the script needs 
a bit more tweaking.  like I said, I know enough to read a script and 
understand what it does, but sh is not my thing.

~j



-- 
Jonathan T. Sage
Theatrical Lighting / Set Designer
Professional Web Design

"He said he likes me, but he's not in-like with me."- Connie, King of 
the Hill

[HTTP://www.JTSage.com]
[HTTP://design.JTSage.com]
[sagejona_at_msu.edu]
[See Headers for Contact Info]

Received on Thu Aug 19 2004 - 15:04:59 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:07 UTC