From owner-freebsd-questions@FreeBSD.ORG Thu Jul 31 12:02:28 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BBBBA7D0; Thu, 31 Jul 2014 12:02:28 +0000 (UTC) Received: from mail.unitedinsong.com.au (mail.unitedinsong.com.au [150.101.178.33]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 34120221A; Thu, 31 Jul 2014 12:02:28 +0000 (UTC) Received: from laptop3.herveybayaustralia.com.au (laptop3.herveybayaustralia.com.au [192.168.0.185]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.unitedinsong.com.au (Postfix) with ESMTPSA id 34F4B27363; Thu, 31 Jul 2014 22:02:23 +1000 (EST) Message-ID: <53DA304E.6020105@herveybayaustralia.com.au> Date: Thu, 31 Jul 2014 22:02:22 +1000 From: Da Rock User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Gleb Smirnoff , "Mike." Subject: Re: Future of pf / firewall in FreeBSD ? - does it have one ? References: <53C706C9.6090506@com.jkkn.dk> <6326AB9D-C19A-434B-9681-380486C037E2@lastsummer.de> <53CB4736.90809@bluerosetech.com> <201407200939020335.0017641F@smtp.24cl.home> <788274E2-7D66-45D9-89F6-81E8C2615D14@lastsummer.de> <201407201230590265.00B479C4@smtp.24cl.home> <20140729103512.GC89995@FreeBSD.org> In-Reply-To: <20140729103512.GC89995@FreeBSD.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-current@freebsd.org, freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Jul 2014 12:02:28 -0000 On 07/29/14 20:35, Gleb Smirnoff wrote: > On Sun, Jul 20, 2014 at 12:30:59PM -0400, Mike. wrote: > M> |> imho, the root problem here is that an effort to implement a > M> single > M> |> feature improvement (multi-threading) has caused the FreeBSD > M> version > M> |> of pf to apparently reach a near-unmaintainable position in the > M> |> FreeBSD community because improvements from OpenBSD can no longer > M> be > M> |> ported over easily. FreeBSD's pf has been put in a virtual > M> |> isolation chamber due to the multi-threaded enhancement. > M> |> > M> |> Was it worth it? > M> | > M> |Yes. This happened *three times* in BSD land now. How much more > M> |proof does it take to make that clear? > M> |[snip] > M> > M> In this instance, more proof would consist of pf development not > M> wallowing in inactivity. > M> > M> imo, tactical changes were implemented in pf without the strategic > M> negative consequences affecting the decision process guiding the > M> implementation of those tactical features. And that's backwards. > M> Strategies direct tactics, not vice versa. > > I would strongly disagree with you. I would claim that directions > I've put in pf in 2012 are strategically correct, while previous > life of pf in FreeBSD was not. > > History: pf appeared in FreeBSD in 2004 in 5.3-RELEASE. It was already > outdated. It isn't possible otherwise. While Max spent time on porting > some stable version, the OpenBSD moved forward. It was later updated > again by Max, and again right after update it was outdated. I mean > that people who a) believe that OpenBSD pf is the one true b) eager > for bleeding edge version, these people simply cannot be satisfied. > A porter needs to take latest stable version from OpenBSD and spend > some time working on it. So, pf in FreeBSD was always "outdated", > even before my SMP work on it. > Further history: in 2012 Ermal updates pf and 9.0-RELEASE is shipped. > In 2004 we've got 10 years of diverging developement between FreeBSD > and OpenBSD. In 2012 it was 18 years. Porting got harder. The pf in > 9.x is again outdated and introduces a number of bugs that were not > present in 8.x (regressions). Most regressions didn't came from OpenBSD, > but were artifacts of porting. Also, the number of #ifdefs in code > became so unbearable that no one would want to go through code > fixing bugs. > > In 2012 for me it was obvious that following this route is strategically > incorrect. You are never "up to date". You need more efforts to port > pf, and you yield in a port of worse and worse quality over time. > > So, in 2012 I put a lot of efforts to not only bring pf out of a > single mutex, but also make it more native to FreeBSD. You can > read this through commit logs. > > The net result is that we got our own pf, that can be maintained > further. Unfortunately, still no person is seen on horizon who can > take maintainership. > That explains it rather well. Thank you for the enlightenment on this. Without diminishing your efforts so far, what do you think about pitching all efforts into IPFW to combine effort and reduce overhead of maintaining separate firewalls in the core? Is there an advantage to having our own pf?