Date: Wed, 9 Jul 2014 17:30:21 +0200 From: =?UTF-8?Q?Ermal_Lu=C3=A7i?= <eri@freebsd.org> To: Mark Martinec <Mark.Martinec+freebsd@ijs.si> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: Future of pf in FreeBSD ? - does it have one ? Message-ID: <CAPBZQG0VsTEciw2rz%2BvAKMgcG8n4nqp7kKQRfSdx%2BfQ%2B2h_xbQ@mail.gmail.com> In-Reply-To: <53BD38C4.4050100@ijs.si> References: <53BC717C.9080108@com.jkkn.dk> <53BD38C4.4050100@ijs.si>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jul 9, 2014 at 2:42 PM, Mark Martinec <Mark.Martinec+freebsd@ijs.si> wrote: > On 2014-07-09 0:32, Kristian K. Nielsen wrote: > >> f) IPv6 support?- it seem to be more and more challenged in the current >> version of pf in FreeBSD and I am (as well as others) introducing more >> and more IPv6 in networks. >> E.x. Bugs #179392, #172648, #130381, #127920 and more seriously #124933, >> which is the bug on not handling IPv6 fragments which have been open >> since 2008 and where the workaround is necessity to leave an open hole >> in your firewall ruleset to allow all fragments. Occoring to comment in >> the bug, this have been long gone in OpenBSD. >> > > The neglect of IPv6 in FreeBSD's pf is a real deal-breaker for us. > Besides the long-standing bugs (like: scrub reassemble tcp > breaks CRC on IPv6), the following stands out: > > Can you be a bit more verbose on this one? > - last time I looked, neither PF nor IPFW could be used on a > FreeBSD kernel built WITHOUT_INET. This means that features > like ssh-guard and per-application protection on a dedicated > IPv6-only host are not available > > I am not sure on the version in FreeBSD 10 but on FreeBSD 9 and before it should be possible to compile without INET afair! Which version of FreeBSD are you testing this on? > - no support for IPv6 prefix translation, > and no stateful NAT64 support > > Part of this is on my queue to be integrated from Open, soon! > > Then, unrelated to IPv6: > > - no support for DSCP (the TOS byte includes ECN bits, hard to > filter out) > > - the new 'match' mechanism would be really nice to have > > All of this is on pfSense side implemented. I cannot state the clear timeline of integration into FreeBSD but patches are avilable for pf from pfSense. > > Mark > _______________________________________________ > freebsd-pf@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org" > -- Ermal
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPBZQG0VsTEciw2rz%2BvAKMgcG8n4nqp7kKQRfSdx%2BfQ%2B2h_xbQ>