i386/78762: /etc/rc.d/ipfw should excecute $firewall_script not read it

[Jonathan Wallace]

>Number:         78762
>Category:       i386
>Synopsis:       /etc/rc.d/ipfw should excecute $firewall_script not read it
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-i386
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 13 03:20:01 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Jonathan Wallace
>Release:        5.3-RELEASE
>Organization:
>Environment:
FreeBSD wallace 5.3-RELEASE FreBSD 5.3-RELEASE #3: Feb 27 23:03:55 EST 2005 root at wallace:/usr/obj/usr/src/sys/WALLACE i386
>Description:
/etc/rc.d/ipfw has been coded with the command '. "${firewall_script}"' and fails to complete successfully if firewall_script contains an "exit" statement.  Given that it is common, not to mention good coding practice, to utilize an "exit" when finishing execution of a program, the /etc/rc.d/ipfw script should execute firewall_script by calling it with a path instead of using the shell "." command to read the file.
>How-To-Repeat:
1) Configure a multi-homed system with ipfw and natd
2) Create a shell script (/etc/myfwscript) with a small set of firewall rules.  At the end of the file make sure you include an "exit" statement.
3) Add firewall_script="myfwscript" to /etc/rc.conf
4) Make sure your natd definitions are set up correctly in /etc/rc.conf
5) Restart your machine and check to see if natd is running.  It won't be.
6) Re-edit /etc/myfwscript and remove the "exit" statement.
7) Restart your machine and check to see if natd is running.  It will be.
>Fix:
In /etc/rc.d/ipfw:
change
. "$firewall_script"
to
$firewall_script
>Release-Note:
>Audit-Trail:
>Unformatted: