Subject: kern/12518: ipf doesn't know dhcp assigned address
To: None <gnats-bugs@gnats.netbsd.org>
From: None <dmcmahill@netbsd.org>
List: netbsd-bugs
Date: 03/31/2001 16:03:45
>Number: 12518
>Category: kern
>Synopsis: ipf doesn't know dhcp assigned address
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: change-request
>Submitter-Id: net
>Arrival-Date: Sat Mar 31 13:05:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator: Dan McMahill
>Release: 1.5<NetBSD-current source date>
>Organization:
NetBSD
>Environment:
System: NetBSD cowboy-burt 1.4.1 NetBSD 1.4.1 (COWBOY-BURT) #1: Sat Oct 2 21:08:08 EDT 1999 dan@cowboy-burt:/amd/dinah-moe/export/src/sys/arch/sparc/compile/COWBOY-BURT sparc
>Description:
ipf doesn't know about addresses assigned by dhcp. This means that if you have
your address assigned by dhcp you can't have a rule like:
block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to IP_ADDR_OF_AE1
block in quick on ae1 proto udp from any to any
in this case ae1 is the network interface configured with dhcp. You don't want to just do:
block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to any
because you'll catch broadcast packets and reply to them
>How-To-Repeat:
try and figure out how to have a 'catch-all' rule which returns port-unr for all
UDP packets destined for us.
>Fix:
not sure. I don't understand the internals nearly well enough. Perhaps as a work around
one of the dhclient hooks could be used along with sed to do something like
ipf.conf.in:
block return-icmp-as-dest(port-unr) in log quick on ae1 proto udp from any to @my_ip@
and then put the following in dhclient-exit-hooks
sed "s;@my_ip@;$new_network_number";g" /etc/ipf.conf.in > /etc/ipf.conf
ipf -D ; ipf -E -Fa -f /etc/ipf.conf ; ipnat -F ; ipnat -f /etc/ipnat.conf
but this seems ugly.
>Release-Note:
>Audit-Trail:
>Unformatted: