On Monday, June 30, 2003, at 11:21  AM, Manuel Bouyer wrote:

> In this specific case, if the code doesn't exists to use altq or ipsec
> from ipf, it's not a big deal (just write the code) as long as the
> ipsec and altq API allows it. Getting the API right before is much 
> easier
> than tweaking it after.

Well...

The right way to do it, of course, is to make the classification engine 
just a library... and then various applications -- the PF firewall/NAT 
package, IPsec, ALTQ, etc. simply use the library.

         -- Jason R. Thorpe <thorpej@wasabisystems.com>