svn commit: r349929 - head/sys/contrib/ipfilter/netinet

[Gleb Smirnoff]

  Hi,

On Fri, Jul 12, 2019 at 01:59:09AM +0000, Cy Schubert wrote:
C> Log:
C>   Move the new ipf_pcksum6() function from ip_fil_freebsd.c to fil.c.
C>   The reason for this is that ipftest(8), which still works on FreeBSD-11,
C>   fails to link to it, breaking stable/11 builds.
C>   
C>   ipftest(8) was broken (segfault) sometime during the FreeBSD-12 cycle.
C>   glebius@ suggested we disable building it until I can get around to
C>   fixing it. Hence this was not caught in -current.
C>   
C>   The intention is to fix ipftest(8) as it is used by the netbsd-tests
C>   (imported by ngie@ many moons ago) for regression testing.

AFAIR, maintaining ipftest always was a PITA, as it wants to compile
lots of kernel code into a userland utility. Of course, once disabled
it will bitrot very quickly.

I'd suggest to achive functionality of ipftest in a different way. Add
a new ioctl() to the pfil(9), that will read a packet from the userland
and match it against a given pfil head and report the result. This will
make a universal tool for packet against ruleset checking for all existing
firewalls, including ipfw and pf. Let's call it pfiltest utility. It can
also be a part of existing pfilctl, invoked as "pfilctl test".

The second missing bit of functionality is that ipftest can test against
not the running ruleset, but some other ruleset. This can be achieved by
adding multiple ruleset feature into existing firewalls. The pfil(9) already
has notion of ruleset names, but so far ipfw, pf and ipf provide only "default".
Once a firewall is able to make alternative rulesets, we can match this
functionality: ipftest would install temporary ruleset, don't connect it
to any head, run the new ioctl() on it, then destroy the ruleset.

I'm sorry to come with a suggestion but can't contribute any time into it.

-- 
Gleb Smirnoff