From: "Luke Mewburn" <lukem@NetBSD.org>
Sent: Thursday, October 02, 2003 1:12 PM


> On Wed, Oct 01, 2003 at 07:14:37PM +0200, Nino Dehne wrote:
>   | I worked around the problem by using one of 2 ways:
>   |
>   | 1. Modify /etc/rc.conf.d/ipnat to also contain ipfilter="YES"
>   | 2. Change the relevant check in /etc/rc.d/ipnat to:
>   |
>   |    load_rc_config ipfilter
>   |    if ! checkyesno ipfilter || [ ! -f /etc/ipf.conf ]; then
>   |       echo "Enabling ipfilter for NAT."
>   |       /sbin/ipf -E -Fa
>   |    fi
>   |
>   | I chose step 1 to be independant from modifying essential startup
>   | scripts. I haven't rebooted since then. All of the above I gathered
from
>   | reading through rc scripts, i.e. it's not tested.
>
> Step 2 (or a varient) is probably the correct solution for rc.d/ipnat
> and other similar scripts.
>
> Can you please submit a PR for this problem so I don't forget about
> it?

Wouldn't it make better sense to do it like thus (psuedo code)...

load_rc_config ipfilter
if ! checkyesno ipfilter || [ ! -f /etc/ipf.conf ]; then
  echo "ipfilter not enabled, exiting ipnat startup"
  exit
fi

This way if the SysAdmin wanted to disable ipfilter then the dependant
software would not start it, inadvertantly.

IMHO: It would a bad thing to have other packages starting starting software
from multiple points during the startup sequence.

--
Stephen