cvs commit: src/sys/contrib/pf/net if_pflog.c if_pflog.h if_pfsync.c if_pfsync.h pf.c pf_ioctl.c pf_norm.c pf_osfp.c pf_table.c pfvar.h src/sys/contrib/pf/netinet in4_cksum.c

[Steve Kargl]

On Thu, Feb 26, 2004 at 06:18:46AM +0000, Bruce M Simpson wrote:
> On Wed, Feb 25, 2004 at 10:01:26PM -0800, Steve Kargl wrote:
> > >   Log:
> > >   Bring diff from the security/pf port. This has code been tested as a port
> > >   for a long time and is run in production use. This is the code present in
> > >   portversion 2.03 with some additional tweaks.
> > 
> > Was this import discussed on arch@ or current@?  We now have ipfw, ipfilter,
> > and pf in the base system.  How many more firewall packages are we going
> > to import into the base system?  Are you going to remove ipfw or ipfilter?
> > Is there a NO_PF make.conf knob?
> 
> PF is not in the base system at this time. The import is the product of
> ongoing discussions between several of the network developers; core@
> have also been involved (Max was brought onto the team explicitly for
> this purpose).

Q: "Was this import discussed on arch@ or current@?"
A: No.  We held private discussions.

> 
> The benefits (many) outweigh the disadvantages (few); pf development and
> maintenance is extremely active compared to the other firewall
> implementations we have. The IPv6 support is also very mature and
> extensive. Maintenance of pf outside of the main kernel source tree is
> difficult because of the API differences between OpenBSD and FreeBSD.
> 
> We do not plan to remove ipfw or ipfilter at this time nor do we have
> plans to remove them, until pf receives further evaluation by the user
> base, there would be no mandate or grounding for such a decision.

If any of ipfw, ipfilter, or ip6fw are candidates for removal, then
it needs to be done before 5-STABLE is branched.  Otherwise, we need
to find individuals to actively maintain each of these throughout the
lifetime of 5.X (a 3 to 5 year time span).

> I also have Evil Plans(tm) for pf on FreeBSD.

Care to summarize your plans?

-- 
Steve