misc/111225: missing option "syncpeer" in pfsync startup script

[Bas van Beek]

>Number:         111225
>Category:       misc
>Synopsis:       missing option "syncpeer" in pfsync startup script
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 04 13:20:07 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Bas van Beek
>Release:        6.1 RELEASE
>Organization:
>Environment:
FreeBSD fw1.tobin.nl 6.1-RELEASE FreeBSD 6.1-RELEASE #2: Tue Apr  3 15:12:20 UTC 2007     bas at fw1.tobin.nl:/usr/obj/usr/src/sys/FW  i386
>Description:

pfsync can take the argument syncpeer so it will use a single peer ip address instead of a multicast address to inform the other pf firewall of state changes.

The /etc/rc.d/pfsync startup script does not facilitate this option.


>How-To-Repeat:

>Fix:
A minor update of the pfsync script would allow for this option to be included in the rc.conf script:

if  [ -z  "$pfsync_syncpeer" ] ; then
    ifconfig pfsync0 syncdev $pfsync_syncdev $pfsync_ifconfig up
else
    ifconfig pfsync0 syncpeer $pfsync_syncpeer syncdev $pfsync_syncdev $pfsync_ifconfig up
fi

this would allow for the following configuration in rc.conf

pfsync_enable="YES"
pfsync_syncdev="em3"
pfsync_syncpeer="10.0.0.1"

>Release-Note:
>Audit-Trail:
>Unformatted: