kern/132554: There is no ippool start script/ipfilter magic to load them

[axel at axel.truedestiny.net]

>Number:         132554
>Category:       kern
>Synopsis:       There is no ippool start script/ipfilter magic to load them
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Mar 11 18:20:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     
>Release:        FreeBSD 7.1-RELEASE-p3 i386
>Organization:
Private home user
>Environment:
System: FreeBSD taliesin.thuis.net 7.1-RELEASE-p3 FreeBSD 7.1-RELEASE-p3 #1: Tue Feb 17 14:34:30 CET 2009 axel at awen.thuis.net:/usr/obj/usr/src/sys/TALIESIN i386
>Description:
When using IPFilter there is a way to store ip pools, sort of like pf tables, 
in a configuration file (/etc/ippool.conf) which you can use in your ruleset.
See manpages for ippool for details.

These pools should be loaded before the ruleset but there is no /etc/rc.d/ippool
or magic in /etc/rc.d/ipfilter to do so, I've created this small quick 'n dirty
diff for /etc/rc.d/ipfilter, I don't know if it's better to include a seperate
startup script since these pools are kind of static, you can't edit them on the
fly without having to reload ipfilter anyway. :(

--- ipfilter.orig       2009-03-11 16:31:53.000000000 +0100
+++ ipfilter    2009-03-11 16:34:51.000000000 +0100
@@ -33,6 +33,11 @@
        if [ `sysctl -n net.inet.ipf.fr_running` -le 0 ]; then
                ${ipfilter_program:-/sbin/ipf} -E
        fi
+        # load ippools if needed
+        if [ -f /etc/ippool.conf ]; then 
+            /sbin/ippool -F
+            /sbin/ippool -f /etc/ippool.conf
+        fi
        ${ipfilter_program:-/sbin/ipf} -Fa
        if [ -r "${ipfilter_rules}" ]; then
                ${ipfilter_program:-/sbin/ipf} \


>How-To-Repeat:
create an ip pool in /etc/ippool.conf, use it in your ipfilter rules and see
they're not loaded.

>Fix:
Either fiddle in the magic in /etc/rc.d/ipfilter or provide an /etc/rc.d/ippool

>Release-Note:
>Audit-Trail:
>Unformatted: