cvs commit: src/sys/contrib/pf/net if_pflog.c if_pflog.h
if_pfsync.c if_pfsync.h pf.c pf_ioctl.c pf_norm.c pf_osfp.c
pf_table.c pfvar.h src/sys/contrib/pf/netinet in4_cksum.c
Steve Kargl
sgk at troutmask.apl.washington.edu
Fri Feb 27 10:23:26 PST 2004
On Thu, Feb 26, 2004 at 06:18:46AM +0000, Bruce M Simpson wrote:
> On Wed, Feb 25, 2004 at 10:01:26PM -0800, Steve Kargl wrote:
> > > Log:
> > > Bring diff from the security/pf port. This has code been tested as a port
> > > for a long time and is run in production use. This is the code present in
> > > portversion 2.03 with some additional tweaks.
> >
> > Was this import discussed on arch@ or current@? We now have ipfw, ipfilter,
> > and pf in the base system. How many more firewall packages are we going
> > to import into the base system? Are you going to remove ipfw or ipfilter?
> > Is there a NO_PF make.conf knob?
>
> PF is not in the base system at this time. The import is the product of
> ongoing discussions between several of the network developers; core@
> have also been involved (Max was brought onto the team explicitly for
> this purpose).
Q: "Was this import discussed on arch@ or current@?"
A: No. We held private discussions.
>
> The benefits (many) outweigh the disadvantages (few); pf development and
> maintenance is extremely active compared to the other firewall
> implementations we have. The IPv6 support is also very mature and
> extensive. Maintenance of pf outside of the main kernel source tree is
> difficult because of the API differences between OpenBSD and FreeBSD.
>
> We do not plan to remove ipfw or ipfilter at this time nor do we have
> plans to remove them, until pf receives further evaluation by the user
> base, there would be no mandate or grounding for such a decision.
If any of ipfw, ipfilter, or ip6fw are candidates for removal, then
it needs to be done before 5-STABLE is branched. Otherwise, we need
to find individuals to actively maintain each of these throughout the
lifetime of 5.X (a 3 to 5 year time span).
> I also have Evil Plans(tm) for pf on FreeBSD.
Care to summarize your plans?
--
Steve
More information about the cvs-src
mailing list