From owner-cvs-src@FreeBSD.ORG Mon Mar 8 20:12:00 2004 Return-Path: Delivered-To: cvs-src@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 680) id 41CB516A4CF; Mon, 8 Mar 2004 20:12:00 -0800 (PST) In-Reply-To: <5D79345A-68E3-11D8-AE91-000A95AD0668@errno.com> To: Sam Leffler Date: Mon, 8 Mar 2004 20:12:00 -0800 (PST) X-Mailer: ELM [version 2.4ME+ PL112 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Message-Id: <20040309041200.41CB516A4CF@hub.freebsd.org> From: darrenr@FreeBSD.ORG (Darren Reed) cc: Max Laier cc: Steve Kargl cc: Luigi Rizzo cc: cvs-all@FreeBSD.org cc: src-committers@FreeBSD.org cc: Tim Robbins cc: cvs-src@FreeBSD.org Subject: ideal firewall solution X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Mar 2004 04:12:00 -0000 In some mail I received from Sam Leffler, sie wrote > > > To me there is no clear winner. Agreed. The question that should have been asked and clearly answered is: What does FreeBSD gain from having pf in the base tree ? > > Honestly, i believe that the microcode-based approach of ipfw2 is > > a lot simpler to maintain and extend than the one used in pf > > (which resembles a lot the original ipfw), and dropping it would > > be a step backward. > > ipfw2 has some instructions (e.g. the 'address set') that greatly > > simplify the writing of rulesets. Has anone reviewed the Checkpoint patent with respect to whether or not ipfw2 violates it ? They patent an instruction/virtual mechanism for evaluating filter rules that is compiled by some user program. I haven't looked at it in detail because ipfw2 isn't my area of responsiblity but someone should (if they haven't.) When/if that is done, if someone can think about what it would be to use BPF instead of ipfw2 and if that makes any difference to the Checkpoint patent, I'd be further interested to know. Patent #5,606,668 - read clause 8. > I agree with Luigi about much of this. I'm happy to see pf brought > into the tree because it's actively being developed and folks look to > be using it (it looks to me like it's going to become the most often > used filtering package for folks with *bsd systems). Only if all those who use ipf/ipfw stop using that. > However I think > the "microcode-based" architecture used by ipfw2 and the BSD/OS ipfw > code are a better design. See again referene to above patent. It was filed in 1993, well before BSD/OS did anything like this. The standard /dev/bpf* is not a case of "prior art", in this instance. Darren