From owner-freebsd-pf@FreeBSD.ORG Fri Dec 21 18:36:16 2012 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 182C896B for ; Fri, 21 Dec 2012 18:36:16 +0000 (UTC) (envelope-from max@mxcrypt.com) Received: from mail-wg0-f49.google.com (mail-wg0-f49.google.com [74.125.82.49]) by mx1.freebsd.org (Postfix) with ESMTP id 9493A8FC18 for ; Fri, 21 Dec 2012 18:36:15 +0000 (UTC) Received: by mail-wg0-f49.google.com with SMTP id 15so2194357wgd.4 for ; Fri, 21 Dec 2012 10:36:09 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=q50INIdvrxXpxlMq6aQuYmLbOCC275VxwNmTPC0o9vQ=; b=ULGTBGEEHrzg4zMKnatujBihDIF09reBgGcJBoKoxnxJVb3KJvMFCm9libgnHljZDN QZWnukbr3MFGiPpeb05RhT4CRVvmyK0W8rahpwcH3AxVlZEFv2kGwimmnN+Qwb30iFmo 6jbPOCZMt4sFLvpFmRXbe7NqTBFYEB50rvpYcmIVPoADbkrZzz2FH90uyljcVAfUCeYI sOyiDJ4zpWpjm80hxUFaTwnvvEJ3Nn8iOTMTjsDFVjpVKI7KQGV02DrwaUN9SGZTbmEI JgyN4KDIJikxqlMuPk708xETgTi2N+z18eHqW+wz2KQYcNpn6n9ZpQ4NFgz4n2lSw9QK 8Xpg== Received: by 10.180.73.202 with SMTP id n10mr24933180wiv.17.1356114969372; Fri, 21 Dec 2012 10:36:09 -0800 (PST) MIME-Version: 1.0 Received: by 10.180.92.105 with HTTP; Fri, 21 Dec 2012 10:35:39 -0800 (PST) In-Reply-To: <20121126150028.GK84121@FreeBSD.org> References: <201211201543.17903.Mark.Martinec+freebsd@ijs.si> <20121121075642.GR67660@FreeBSD.org> <20121121145240.GE67660@glebius.int.ru> <20121126150028.GK84121@FreeBSD.org> From: Maxim Khitrov Date: Fri, 21 Dec 2012 13:35:39 -0500 Message-ID: Subject: Re: Upgrading FreeBSD to use the NEW pf syntax. To: Gleb Smirnoff Content-Type: text/plain; charset=UTF-8 X-Gm-Message-State: ALoCoQk3n6k4fwPbdxPp7tELWIwqRNVGnInRamTK+IdjTNZa3oTzCQPJQyS0H/RH1N/7BriN+pvz Cc: freebsd-current@freebsd.org, freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2012 18:36:16 -0000 On Mon, Nov 26, 2012 at 10:00 AM, Gleb Smirnoff wrote: > Paul, > > On Sat, Nov 24, 2012 at 02:11:32PM -0000, Paul Webster wrote: > P> I only really need one question answered in honesty; > P> > P> I personally think that by forking our own version of PF we have > P> essentially made something totally different to what everyone wants to > P> use. Which is fine, but because of that development of new features have > P> dropped behind. > P> > P> If we had kept up with OpenBSD's version even if we trailed it by one > P> MAJOR release; at least part of the development would have been done. > P> > P> So now we end up in a situation where we have these firewalls, > P> IPFW2,ipf,pf(modded) and users wanting the newer features of OpenBSD's pf. > P> So timewise the fork of pf may have actually cost more in time rather than > P> less. > P> > P> I don't however think the 'solution' to the problem is just to say no to > P> the userbase by not even trying to port across the newer pf. I think we > P> should look at bringing it across, slowly and seeing what the uptake is > P> like; in a few MAJOR releases we can start to look at which of the > P> firewalls realistically are not used that much and should be deprecated. > > If you see a large userbase that eagers to see new pf, then you can port > it to FreeBSD, maintain it, catch up with new versions from OpenBSD, > and so on. No one forbids you doing that. Putting aside the issue of new syntax... What is the actual state of pf in the upcoming FreeBSD 9.1-RELEASE? Have there been any changes from 9.0? The most recent list of PRs doesn't look very encouraging. I'm setting up a new office firewall right now. I tried installing OpenBSD 5.2, but it doesn't recognize the Intel X25-E drive in AHCI mode or the Intel X540 10GbE adapter, which should be supported. Maybe I can fix these problems, but I'd much rather see an improvement in the state of FreeBSD firewalls. No one needs three choices, we need one that works and is actively maintained. - Max