svn commit: r225793 - in head/sys: modules/ipfw netinet/ipfw

[Sergey Kandaurov]

On 2 November 2011 16:53, Bjoern A. Zeeb <bz at freebsd.org> wrote:
> On Wed, 2 Nov 2011, Sergey Kandaurov wrote:
>
>> On 27 September 2011 17:27, Bjoern A. Zeeb <bz at freebsd.org> wrote:
>>>
>>> Author: bz
>>> Date: Tue Sep 27 13:27:17 2011
>>> New Revision: 225793
>>> URL: http://svn.freebsd.org/changeset/base/225793
>>>
>>> Log:
>>>  Unbreak no-ip and no-inet6 module builds with ipfw.  For now continue to
>>>  build the ip_fw_pfil.c hooks and ipfw even in case of no-ip under the
>>>  assumption that the private L2 hook (which hopefully eventually will be
>>> a
>>>  pfil hook as well) can still be useful.
>>>
>>>  Allow building the module without inet as well.
>>>
>>>  Glanced at by:        jhb
>>>  MFC after:    3 days
>>>
>>> Modified:
>>>  head/sys/modules/ipfw/Makefile
>>>  head/sys/netinet/ipfw/ip_fw_pfil.c
>>>
>>> Modified: head/sys/modules/ipfw/Makefile
>>>
>>> ==============================================================================
>>> --- head/sys/modules/ipfw/Makefile      Tue Sep 27 13:20:41 2011
>>>  (r225792)
>>> +++ head/sys/modules/ipfw/Makefile      Tue Sep 27 13:27:17 2011
>>>  (r225793)
>>> @@ -8,7 +8,7 @@ KMOD=   ipfw
>>>  SRCS=  ip_fw2.c ip_fw_pfil.c
>>>  SRCS+= ip_fw_dynamic.c ip_fw_log.c
>>>  SRCS+= ip_fw_sockopt.c ip_fw_table.c
>>> -SRCS+= opt_inet6.h opt_ipfw.h opt_ipsec.h
>>> +SRCS+= opt_inet.h opt_inet6.h opt_ipfw.h opt_ipsec.h
>>>
>>>  CFLAGS+= -DIPFIREWALL
>>>  CFLAGS+= -I${.CURDIR}/../../contrib/pf
>>> @@ -22,6 +22,10 @@ CFLAGS+= -I${.CURDIR}/../../contrib/pf
>>>  #
>>>
>>>  .if !defined(KERNBUILDDIR)
>>> +.if ${MK_INET_SUPPORT} != "no"
>>> +opt_inet.h:
>>> +       echo "#define INET 1" > ${.TARGET}
>>> +.endif
>>>  .if ${MK_INET6_SUPPORT} != "no"
>>>  opt_inet6.h:
>>>        echo "#define INET6 1" > ${.TARGET}
>>>
>>> Modified: head/sys/netinet/ipfw/ip_fw_pfil.c
>>>
>>> ==============================================================================
>>> --- head/sys/netinet/ipfw/ip_fw_pfil.c  Tue Sep 27 13:20:41 2011
>>>  (r225792)
>>> +++ head/sys/netinet/ipfw/ip_fw_pfil.c  Tue Sep 27 13:27:17 2011
>>>  (r225793)
>>> @@ -31,11 +31,11 @@ __FBSDID("$FreeBSD$");
>>>  #if !defined(KLD_MODULE)
>>>  #include "opt_ipdn.h"
>>>  #include "opt_inet.h"
>>> +#include "opt_inet6.h"
>>>  #ifndef INET
>>>  #error IPFIREWALL requires INET.
>>>  #endif /* INET */
>>>  #endif /* KLD_MODULE */
>>> -#include "opt_inet6.h"
>>
>> Hello.
>>
>> This chunk seems to stop building inet6 part of ipfw.ko w/ INET6 enabled
>> kernel.
>>
>> Found by /etc/rc.d/ipfw restart:
>> [...]
>> /etc/rc.d/ipfw: WARNING: failed to enable IPv6 firewall
>>
>> i.e. sysctl net.inet6.ip6.fw.enable doesn't present.
>>
>> Reversion of this hunk fixed the problem.
>> NO_INET[46] lints aren't tested though.
>
>
> Just to double-check -- this only happens for you if you build and
> use the module, not when you link it into the kernel?
>
> As in that case I do have:
> lion3#  sysctl net.inet6.ip6.fw.enable net.inet6.ip6.fw.enable: 1

ipfw is built and installed as a module as part of make kernel target.
There is no ipfw related options in KERNCONF itself.
ipfw.ko loads during rc(8) phase.

> What's your src.conf and make.conf files looking like in /etc should
> you have them?  Any WITHOUT_INET6 or WITHOUT_INET6_SUPPORT in there?

Nothing suspicious.

# cat /etc/src.conf
WITHOUT_CLANG=  yes

# cat /etc/make.conf
MODULES_OVERRIDE=       coretemp libalias nfsclient nfslockd nfslock \
                        nfs_common krpc nfssvc ipfw linux linprocfs \
                        mac_biba netgraph cyclic opensolaris dtrace \
                        dtrace/dtraceall cpufreq nullfs
KERNCONF=TST
WRKDIRPREFIX=/usr/works
# added by use.perl 2010-11-29 19:07:35
PERL_VERSION=5.10.1
WITHOUT_X11=yes

(TST config has extra debugging changes, oldnfs and commented out devices.)

-- 
wbr,
pluknet