Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 27 Feb 2004 10:23:25 -0800
From:      Steve Kargl <sgk@troutmask.apl.washington.edu>
To:        Max Laier <mlaier@freebsd.org>, src-committers@freebsd.org, cvs-src@freebsd.org, cvs-all@freebsd.org
Subject:   Re: cvs commit: src/sys/contrib/pf/net if_pflog.c if_pflog.h if_pfsync.c if_pfsync.h pf.c pf_ioctl.c pf_norm.c pf_osfp.c pf_table.c pfvar.h src/sys/contrib/pf/netinet in4_cksum.c
Message-ID:  <20040227182325.GA81744@troutmask.apl.washington.edu>
In-Reply-To: <20040226061846.GB15864@saboteur.dek.spc.org>
References:  <200402260234.i1Q2YDx1014240@repoman.freebsd.org> <20040226060126.GA70201@troutmask.apl.washington.edu> <20040226061846.GB15864@saboteur.dek.spc.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Feb 26, 2004 at 06:18:46AM +0000, Bruce M Simpson wrote:
> On Wed, Feb 25, 2004 at 10:01:26PM -0800, Steve Kargl wrote:
> > >   Log:
> > >   Bring diff from the security/pf port. This has code been tested as a port
> > >   for a long time and is run in production use. This is the code present in
> > >   portversion 2.03 with some additional tweaks.
> > 
> > Was this import discussed on arch@ or current@?  We now have ipfw, ipfilter,
> > and pf in the base system.  How many more firewall packages are we going
> > to import into the base system?  Are you going to remove ipfw or ipfilter?
> > Is there a NO_PF make.conf knob?
> 
> PF is not in the base system at this time. The import is the product of
> ongoing discussions between several of the network developers; core@
> have also been involved (Max was brought onto the team explicitly for
> this purpose).

Q: "Was this import discussed on arch@ or current@?"
A: No.  We held private discussions.

> 
> The benefits (many) outweigh the disadvantages (few); pf development and
> maintenance is extremely active compared to the other firewall
> implementations we have. The IPv6 support is also very mature and
> extensive. Maintenance of pf outside of the main kernel source tree is
> difficult because of the API differences between OpenBSD and FreeBSD.
> 
> We do not plan to remove ipfw or ipfilter at this time nor do we have
> plans to remove them, until pf receives further evaluation by the user
> base, there would be no mandate or grounding for such a decision.

If any of ipfw, ipfilter, or ip6fw are candidates for removal, then
it needs to be done before 5-STABLE is branched.  Otherwise, we need
to find individuals to actively maintain each of these throughout the
lifetime of 5.X (a 3 to 5 year time span).

> I also have Evil Plans(tm) for pf on FreeBSD.

Care to summarize your plans?

-- 
Steve



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040227182325.GA81744>