IPFilter with miniupnpd

Roy Marples <[email protected]> Thu, 03 Sep 2009 23:32:03 +0100

Newsgroups	gmane.comp.security.firewalls.ipfilter
Message-ID	<25950_1252017250_4AA04462_25950_5575_1_4AA043E3.1080106@marples.name>

Hi List!

I use stock IPFilter in NetBSD-5 with miniupnpd-20090820 [1].
It fails to work.

So I tried the tarball from Darrens blog [2].
This doesn't work either.

So I went back to miniupnpd-20090820 and cut this patch (attached).
This almost works - it adds and reports correctly. However, it won't 
delete filter rules.
The error it gives is ioctl(SIOCRMAFR): Device busy from line 441 in 
src/ipf/ipfrdr.c
According to my testing, it is trying to delete the correct rule.

So, what is wrong?

Thanks

Roy

[1] http://miniupnp.free.fr/files/
[2] http://blogs.sun.com/avalon/entry/upnp_daemon_for_solaris_ipfilter

miniupnpd.diff (text/plain, 788 B)

--- miniupnpd-20090820/ipf/ipfrdr.c	2008-08-24 20:54:57.000000000 +0100
+++ xxx/ipf/ipfrdr.c	2009-09-03 23:12:29.000000000 +0100
@@ -249,7 +249,7 @@
 			if (bytes != NULL)
 				*bytes = 0;
 			if (iport != NULL)
-				*iport = ipn.in_pnext;
+				*iport = ntohs(ipn.in_pnext);
 			inet_ntop(AF_INET, &ipn.in_in[0].in4, iaddr, iaddrlen);
 			return 0;
 		}
@@ -395,7 +395,7 @@
 	wobj.ipfo_size = sizeof(fio);
 	wobj.ipfo_ptr = &fio;
 
-	if (ioctl(dev, SIOCGETFS, &wobj) == -1) {
+	if (ioctl(dev_ipl, SIOCGETFS, &wobj) == -1) {
 		syslog(LOG_ERR, "ioctl(SIOCGETFS): %m");
 		goto error;
 	}
@@ -416,6 +416,7 @@
 	rule.iri_v = 4;
 #endif
 	rule.iri_rule = fp;
+	strlcpy(rule.iri_group, group_name, sizeof(rule.iri_group));
 
 	dobj.ipfo_rev = IPFILTER_VERSION;
 	dobj.ipfo_size = sizeof(*fp);