>Number:         12518
>Category:       kern
>Synopsis:       ipf doesn't know dhcp assigned address
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 31 13:05:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator:     Dan McMahill
>Release:        1.5<NetBSD-current source date>
>Organization:
NetBSD
>Environment:
	
System: NetBSD cowboy-burt 1.4.1 NetBSD 1.4.1 (COWBOY-BURT) #1: Sat Oct 2 21:08:08 EDT 1999 dan@cowboy-burt:/amd/dinah-moe/export/src/sys/arch/sparc/compile/COWBOY-BURT sparc


>Description:

ipf doesn't know about addresses assigned by dhcp.  This means that if you have
your address assigned by dhcp you can't have a rule like:

block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to IP_ADDR_OF_AE1
block in quick on ae1 proto udp from any to any

in this case ae1 is the network interface configured with dhcp.  You don't want to just do:

block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to any

because you'll catch broadcast packets and reply to them

	
>How-To-Repeat:
try and figure out how to have a 'catch-all' rule which returns port-unr for all
UDP packets destined for us.

	
>Fix:

not sure.  I don't understand the internals nearly well enough.  Perhaps as a work around
one of the dhclient hooks could be used along with sed to do something like

ipf.conf.in:

block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to @my_ip@


and then put the following in dhclient-exit-hooks 

sed "s;@my_ip@;$new_network_number";g" /etc/ipf.conf.in > /etc/ipf.conf
ipf -D ; ipf -E -Fa -f /etc/ipf.conf ; ipnat -F ; ipnat -f /etc/ipnat.conf

but this seems ugly.

	
>Release-Note:
>Audit-Trail:
>Unformatted: