Date: Thu, 10 Jul 2014 12:45:25 +0200 From: Mark Martinec <Mark.Martinec+freebsd@ijs.si> To: =?UTF-8?B?RXJtYWwgTHXDp2k=?= <eri@freebsd.org> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: Future of pf in FreeBSD ? - does it have one ? Message-ID: <53BE6EC5.3060605@ijs.si> In-Reply-To: <CAPBZQG0VsTEciw2rz%2BvAKMgcG8n4nqp7kKQRfSdx%2BfQ%2B2h_xbQ@mail.gmail.com> References: <53BC717C.9080108@com.jkkn.dk> <53BD38C4.4050100@ijs.si> <CAPBZQG0VsTEciw2rz%2BvAKMgcG8n4nqp7kKQRfSdx%2BfQ%2B2h_xbQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2014-07-09 17:30, Ermal Luçi wrote: > On Wed, Jul 9, 2014 at 2:42 PM, Mark Martinec > <Mark.Martinec+freebsd@ijs.si> wrote: > > On 2014-07-09 0:32, Kristian K. Nielsen wrote: > f) IPv6 support?- it seem to be more and more challenged in the > current > version of pf in FreeBSD and I am (as well as others) > introducing more > and more IPv6 in networks. > E.x. Bugs #179392, #172648, #130381, #127920 and more seriously > #124933, > which is the bug on not handling IPv6 fragments which have been open > since 2008 and where the workaround is necessity to leave an > open hole > in your firewall ruleset to allow all fragments. Occoring to > comment in > the bug, this have been long gone in OpenBSD. > > The neglect of IPv6 in FreeBSD's pf is a real deal-breaker for us. > Besides the long-standing bugs (like: scrub reassemble tcp > breaks CRC on IPv6), the following stands out: > > Can you be a bit more verbose on this one? http://www.freebsd.org/cgi/query-pr.cgi?pr=172648 > - last time I looked, neither PF nor IPFW could be used on a > FreeBSD kernel built WITHOUT_INET. This means that features > like ssh-guard and per-application protection on a dedicated > IPv6-only host are not available > > I am not sure on the version in FreeBSD 10 but on FreeBSD 9 and before > it should be possible to compile without INET afair! > Which version of FreeBSD are you testing this on? It compiles just fine, but can't be loaded or run. If memory serves, pf kernel module loads fine but pfctl fails, and the ipfw kernel module can't be loaded at all. Will need to re-run this experiment to make sure, and will report back. Mark
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53BE6EC5.3060605>