Upgrading IPFilter on OpenBSD
By Pat Lougheed
Last Update: 14 December 2000


This article assumes a few things. First, that you've built an OpenBSD kernel before and are relatively comfortable with the process. Second, that you know how to download OpenBSD's CVS trees to your machine. Third, that you are familiar with the process of setting up IPFilter, including changes to rc.conf, etc. If you require guidance with any of these, I suggest you visit OpenBSD's web site for help.


Useful links:

  1. Start with a fresh OpenBSD source tree, and a kernel configuration file that you know works.
  2. Download the IPFilter tarball off the web site and unzip to a suitable temporary directory of your choice.
  3. Unzip the tarball.
  4. Change to the directory created when you unzipped the tarball.
  5. Run make openbsd
  6. Run make install-bsd
  7. Change to the OpenBSD/ subdirectory.
  8. Run ./kinstall
  9. Under the assumption you already have a working config file, give kinstall the name of the config file.
  10. Change to the /usr/src/sys/net directory.
  11. Edit if.c
  12. Change the following block to code (around line 377 for OpenBSD 2.8):

    #ifdef IPFILTER
        /* XXX More ipf & ipnat cleanup needed.  */
        nat_ifdetach(ifp);
#endif
    to:

    #ifdef IPFILTER
        /* XXX More ipf & ipnat cleanup needed.  */
        frsync();
#endif
  13. Change to the /usr/src/sys/arch//conf directory.
  14. Run config on the kernel config file you gave to kinstall.
  15. Change to the /usr/src/sys/arch//compile/ directory
  16. Run make clean (if needed)
  17. Run make depend
  18. Run make
  19. Back up your old kernel.
  20. Install the newly created kernel.
  21. Reboot.
  22. After the machine comes back up, login.
  23. Run ipf -V and make sure the kernel version string is correct for the version you're installing.

Notes

This method's been tested on both OpenBSD 2.7 and 2.8, with IPFilter version 3.4.11 and higher (yes, I'm a relative newbie to ipf).
It's only been tested on i386 architecture machines.
The source change from nat_ifdetach() to frsync() is based on several discussions on the IPFilter mailing list, and based on Darren's comment in this post.