From kosmos@kosmos.my.net  Sat Jan 31 14:49:51 2004
Return-Path: <kosmos@kosmos.my.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DBCA716A4E6
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 31 Jan 2004 14:49:51 -0800 (PST)
Received: from kosmos.my.net (c-24-16-193-147.client.comcast.net [24.16.193.147])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 012BF43D31
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 31 Jan 2004 14:49:50 -0800 (PST)
	(envelope-from kosmos@kosmos.my.net)
Received: from kosmos.my.net (localhost [127.0.0.1])
	by kosmos.my.net (8.12.10/8.12.10) with ESMTP id i0VMkwsN000351
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 31 Jan 2004 14:47:02 -0800 (PST)
	(envelope-from kosmos@kosmos.my.net)
Received: (from kosmos@localhost)
	by kosmos.my.net (8.12.10/8.12.10/Submit) id i0VMkv5e000350;
	Sat, 31 Jan 2004 14:46:57 -0800 (PST)
	(envelope-from kosmos)
Message-Id: <200401312246.i0VMkv5e000350@kosmos.my.net>
Date: Sat, 31 Jan 2004 14:46:57 -0800 (PST)
From: kosmos <kosmos@kosmos.my.net>
Reply-To: abowhill <abowhill@blarg.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: firewall klm fails to parse divert keyword properly
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         62193
>Category:       kern
>Synopsis:       firewall klm fails to parse divert keyword properly
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    ipfw
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jan 31 14:50:22 PST 2004
>Closed-Date:    Sat Aug 28 19:00:07 GMT 2004
>Last-Modified:  Sat Aug 28 19:00:07 GMT 2004
>Originator:     abowhill
>Release:        FreeBSD 4.9-STABLE i386
>Organization:
NA
>Environment:
System: FreeBSD kosmos.my.net 4.9-STABLE FreeBSD 4.9-STABLE #1: Sat Jan 31 13:49:20 PST 2004 root@kosmos.my.net:/usr/obj/usr/src/sys/KOSMOS i386


>Description:
When a default GENERIC 4.9-STABLE system is configured for natd and OPEN firewall type, when system boots and tries to add an ipfw rule using the divert keyword, it fails:

Jan 31 13:27:01 kosmos /kernel: IP packet filtering initialized, divert disabled, rule-based forwarding enabled, default to d$
Jan 31 13:27:01 kosmos /kernel: ip_fw_ctl: invalid command

In /etc/rc.firewall (Network Address Translation Section, near line 110) the following line triggers the error:

${fwcmd} add 50 divert natd all from any to any via ${natd_interface}

This error only happens when using the firewall klm, as when the sytem is built with a default GENERIC kernel.

If the kernel is rebuilt with firewall options enabled:

options         IPFIREWALL
options         IPDIVERT

the divert command in /etc/rc.firewall works fine, becuase the klm is not loaded

>How-To-Repeat:

	1.) Obtain latest 4.9-STABLE source tree (probably post Jan. 26th)
	2.) Modify /etc/rc.conf to set system up for nat forwarding

	natd_enable="YES"
	firewall_enable="YES"
	firewall_type="OPEN"

	3.) Build and install a system using GENERIC kernel configuration to force firewall klm to load
	4.) Reboot, noting "Invalid command" error message on screen and in /var/log/messages

	5.) rebuild kernel with options 
		options         IPFIREWALL
		options         IPDIVERT

	6.) reboot system, noting that firewall divert command works correctly

>Fix:

	Workaround: build kernel with IPFIREWALL and IPDIVERT options, circumventing the firewall kernel loadable module.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->ipfw 
Responsible-Changed-By: arved 
Responsible-Changed-When: Sat Aug 28 18:29:54 GMT 2004 
Responsible-Changed-Why:  
Over to ipfw Mailinglist for review 

http://www.freebsd.org/cgi/query-pr.cgi?pr=62193 
State-Changed-From-To: open->closed 
State-Changed-By: maxim 
State-Changed-When: Sat Aug 28 18:56:40 GMT 2004 
State-Changed-Why:  
From divert(4) man page: 

:DETAILS 
:    To enable divert sockets, your kernel must be compiled with the option 
:    IPDIVERT. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=62193 
>Unformatted:
