From owner-freebsd-pf@FreeBSD.ORG Mon Dec 8 11:04:16 2014 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1FEF7927 for ; Mon, 8 Dec 2014 11:04:16 +0000 (UTC) Received: from mx1.sbone.de (bird.sbone.de [46.4.1.90]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id C9417AD for ; Mon, 8 Dec 2014 11:04:15 +0000 (UTC) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id 56D2825D385E; Mon, 8 Dec 2014 11:04:04 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id E0599C76FDF; Mon, 8 Dec 2014 11:04:03 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id oTPy7BS6Cem3; Mon, 8 Dec 2014 11:04:02 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6] (orange-tun0-ula.sbone.de [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id F32FDC76FCE; Mon, 8 Dec 2014 11:04:00 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Subject: Re: Why merging recent OpenBSD PF code is not easy (was Re: FOLLOW-UP) From: "Bjoern A. Zeeb" In-Reply-To: <75F1B874-8BF5-4500-A9EB-9A6E3F90C3F2@netgate.com> Date: Mon, 8 Dec 2014 11:04:00 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: <6BB4C12E-DB19-42C1-93C8-264BAA053CED@lists.zabbadoz.net> References: <115251417993747@web27m.yandex.ru> <75F1B874-8BF5-4500-A9EB-9A6E3F90C3F2@netgate.com> To: Jim Thompson X-Mailer: Apple Mail (2.1878.6) Cc: Martin Hanson , freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Dec 2014 11:04:16 -0000 On 08 Dec 2014, at 02:22 , Jim Thompson wrote: >> On Dec 7, 2014, at 5:09 PM, Martin Hanson = wrote: >>=20 >> Seems like you have missed the whole point, nobody can sort it out = now! >=20 > No, you=92re missing the point. >=20 > The codebase has forked, and it=92s unlikely that anyone who is = working on (or in a position to direct work on) pf believes that the = correct course of action is to reverse at this point, and follow your = prescriptive. I have not read all your references but there are more points one could = possibly consider: - backward compatibility; FreeBSD tries not to screw users over with = every new major release and constantly changing syntax and old firewall = rules no longer working are just not an option for us; you can =93fix=94 = this by writing a backward compat parser and adjusting the code to = support all the stuff still; just a lot more extra work on code you = don=92t maintain and thus making it hard to sync. - the #ifdefs were indeed just not sustainable and a major pain reading = the code; that could have been reduced but frankly prevented us for too = long to work on the code. V_irtualisation is just another code mangler. - the tight integration of pf in OpenBSD with the rest of their network = stack started to suit the more generic FreeBSD model less and less. We = can=92t just do that unless we drop other firewalls and screw a lot of = commercial user base. - There is another major pf player in the game who wasn=92t mentioned = yet, and that=92s Apple. Has anyone considered looking at their = implementation shipping on millions of devices, requiring similar =93API = stability=94 as FreeBSD would love to support? Just a few things from the top of my head. =97=20 Bjoern A. Zeeb Charles Haddon Spurgeon: "Friendship is one of the sweetest joys of life. Many might have failed beneath the bitterness of their trial had they not found a friend."