Subject: Re: why no pfsync in NetBSD?
To: Tobias Nygren <tnn@NetBSD.org>
From: Daniel Carosone <firstname.lastname@example.org>
Date: 04/20/2007 10:05:18
Content-Type: text/plain; charset=us-ascii
On Fri, Apr 20, 2007 at 01:41:58AM +0200, Tobias Nygren wrote:
> pfsync(4) uses a rouge IP protocol number not formally assigned to it.
> This is a problem for an OS that wants to be standards-conformant.
> Also, there's no real reason why the pfsync(4) protocol can't be
> encapsulated in udp(4), is there? This shouldn't be impossible to
> implement, but we can't interoperate with the other BSDs if this
> route is taken.
political positioning aside, is it even meaninful to talk about
'interoperability' in this regard? In other words, can there be any
meaningful state synchronisation between pf instances on a firewall
cluster where one member is netbsd and the other member is freebsd (or
I could *maybe* see this for CARP for basic router service, but not
for pf state. So I'm not sure the 'interoperability' argument is
anything but a red herring.
On the other hand, if such heterogenous sync is possible and an
explicit goal (including protocol version stability, etc) then the pf
guys have achieved a rather more tasty herring than I expected.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (NetBSD)
-----END PGP SIGNATURE-----