diff --git a/website/content/en/status/report-2023-04-2023-06/pf.adoc b/website/content/en/status/report-2023-04-2023-06/pf.adoc new file mode 100644 --- /dev/null +++ b/website/content/en/status/report-2023-04-2023-06/pf.adoc @@ -0,0 +1,45 @@ +=== pf Improvements + +Links: + +link:https://reviews.freebsd.org/D40911[D40911] URL: link:https://reviews.freebsd.org/D40911p[] + +link:https://reviews.freebsd.org/D40861[D40861] URL: link:https://reviews.freebsd.org/D40861p[] + +link:https://reviews.freebsd.org/D40862[D40862] URL: link:https://reviews.freebsd.org/D40862p[] + +link:https://reviews.freebsd.org/D40863[D40863] URL: link:https://reviews.freebsd.org/D40863p[] + +link:https://reviews.freebsd.org/D40864[D40864] URL: link:https://reviews.freebsd.org/D40864p[] + +link:https://reviews.freebsd.org/D40865[D40865] URL: link:https://reviews.freebsd.org/D40865p[] + +link:https://reviews.freebsd.org/D40866[D40866] URL: link:https://reviews.freebsd.org/D40866p[] + +link:https://reviews.freebsd.org/D40867[D40867] URL: link:https://reviews.freebsd.org/D40867p[] + +link:https://reviews.freebsd.org/D40868[D40868] URL: link:https://reviews.freebsd.org/D40868p[] + +link:https://reviews.freebsd.org/D40869[D40869] URL: link:https://reviews.freebsd.org/D40869p[] + +link:https://reviews.freebsd.org/D40870[D40870] URL: link:https://reviews.freebsd.org/D40870p[] + +Contact: Kajetan Staszkiewicz + +Contact: Naman Sood + +Contact: Kristof Provost + +pf is one of the firewalls included in FreeBSD, and is probably the most popular. +pf was created by the OpenBSD project and subsequently ported to FreeBSD. + +==== backport OpenBSD syntax + +Kajetan introduced the OpenBSD syntax of "scrub" operations in "match" and "pass" rules. +Existing rules remain supported, but now OpenBSD style "scrub" configration is also supported. + +==== pfsync protocol versioning + +The pfsync protocol version can now be configured, allowing for protocol changes while still supporting state synchronisation between disparate kernel versions. +The primary benefit is to allow protocol changes enabling new functionality. + +==== pfsync: transport over IPv6 + +pfsync traffic can now be carried over IPv6 as well. +Naman finished the work started by Luiz Amaral. + +==== SCTP + +There is work in progres to support SCTP in pf. +That support includes filtering on port numbers, state tracking, pfsync failover and returning ABORT chunks for rejected connections. + +Sponsor: InnoGames GmbH +Sponsor: Orange Business Services +Sponsor: The FreeBSD Foundation