From owner-freebsd-bugs@FreeBSD.ORG Wed Mar 11 18:20:01 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 44E37106564A for ; Wed, 11 Mar 2009 18:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 1E7718FC1C for ; Wed, 11 Mar 2009 18:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n2BIK0xY027130 for ; Wed, 11 Mar 2009 18:20:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n2BIK0V4027129; Wed, 11 Mar 2009 18:20:00 GMT (envelope-from gnats) Resent-Date: Wed, 11 Mar 2009 18:20:00 GMT Resent-Message-Id: <200903111820.n2BIK0V4027129@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, axel@axel.truedestiny.net Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 357E21065695 for ; Wed, 11 Mar 2009 18:16:29 +0000 (UTC) (envelope-from axel@axel.truedestiny.net) Received: from taliesin.thuis.net (tunnel3416.ipv6.xs4all.nl [IPv6:2001:888:10:d58::2]) by mx1.freebsd.org (Postfix) with ESMTP id A12EE8FC2C for ; Wed, 11 Mar 2009 18:16:28 +0000 (UTC) (envelope-from axel@axel.truedestiny.net) Received: from taliesin.thuis.net (localhost [127.0.0.1]) by taliesin.thuis.net (8.14.3/8.14.3) with ESMTP id n2BIGQgY023610 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 11 Mar 2009 19:16:26 +0100 (CET) (envelope-from axel@taliesin.thuis.net) Received: (from root@localhost) by taliesin.thuis.net (8.14.3/8.14.3/Submit) id n2BIGQfb023609; Wed, 11 Mar 2009 19:16:26 +0100 (CET) (envelope-from axel) Message-Id: <200903111816.n2BIGQfb023609@taliesin.thuis.net> Date: Wed, 11 Mar 2009 19:16:26 +0100 (CET) From: axel@axel.truedestiny.net To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/132554: There is no ippool start script/ipfilter magic to load them X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: axel@axel.truedestiny.net List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Mar 2009 18:20:01 -0000 >Number: 132554 >Category: kern >Synopsis: There is no ippool start script/ipfilter magic to load them >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Mar 11 18:20:00 UTC 2009 >Closed-Date: >Last-Modified: >Originator: >Release: FreeBSD 7.1-RELEASE-p3 i386 >Organization: Private home user >Environment: System: FreeBSD taliesin.thuis.net 7.1-RELEASE-p3 FreeBSD 7.1-RELEASE-p3 #1: Tue Feb 17 14:34:30 CET 2009 axel@awen.thuis.net:/usr/obj/usr/src/sys/TALIESIN i386 >Description: When using IPFilter there is a way to store ip pools, sort of like pf tables, in a configuration file (/etc/ippool.conf) which you can use in your ruleset. See manpages for ippool for details. These pools should be loaded before the ruleset but there is no /etc/rc.d/ippool or magic in /etc/rc.d/ipfilter to do so, I've created this small quick 'n dirty diff for /etc/rc.d/ipfilter, I don't know if it's better to include a seperate startup script since these pools are kind of static, you can't edit them on the fly without having to reload ipfilter anyway. :( --- ipfilter.orig 2009-03-11 16:31:53.000000000 +0100 +++ ipfilter 2009-03-11 16:34:51.000000000 +0100 @@ -33,6 +33,11 @@ if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then ${ipfilter_program:-/sbin/ipf} -E fi + # load ippools if needed + if [ -f /etc/ippool.conf ]; then + /sbin/ippool -F + /sbin/ippool -f /etc/ippool.conf + fi ${ipfilter_program:-/sbin/ipf} -Fa if [ -r "${ipfilter_rules}" ]; then ${ipfilter_program:-/sbin/ipf} \ >How-To-Repeat: create an ip pool in /etc/ippool.conf, use it in your ipfilter rules and see they're not loaded. >Fix: Either fiddle in the magic in /etc/rc.d/ipfilter or provide an /etc/rc.d/ippool >Release-Note: >Audit-Trail: >Unformatted: