Project

General

Profile

Todo #5508

remove layer7 pieces

Added by Chris Buechler about 4 years ago. Updated almost 4 years ago.

Status:
Resolved
Priority:
Normal
Category:
Layer 7
Target version:
Start date:
11/20/2015
Due date:
% Done:

0%

Estimated time:

Description

ipfw-classifyd and friends haven't worked correctly in any FreeBSD 10.x base version, the functionality as implemented had extremely high CPU overhead and other difficulties back when it did (sort of) work, and it was very rarely used.

Opening this todo in favor of #4276 / #4416 / #4993

Associated revisions

Revision d65c6113 (diff)
Added by Chris Buechler about 4 years ago

Remove layer7 components. Ticket #5508

Revision 133684ab (diff)
Added by Chris Buechler about 4 years ago

add layer7 files to obsoletedfiles list. Ticket #5508

Revision eeb2b056 (diff)
Added by Chris Buechler about 4 years ago

add ipfw-classifyd to obsoletedfiles list. Ticket #5508

Revision 1ac4e6ae (diff)
Added by Chris Buechler almost 4 years ago

Add config upgrade code to remove L7 config pieces, and file a notice where found. Ticket #5508

History

#1 Updated by Chris Buechler about 4 years ago

  • Status changed from Assigned to Feedback

#2 Updated by Chris Buechler about 4 years ago

  • Description updated (diff)

#3 Updated by Florent THOMAS about 4 years ago

Do you mean that Layer7 will disappear form the base distro?
Regards

#4 Updated by Kill Bill about 4 years ago

Florent THOMAS wrote:

Do you mean that Layer7 will disappear form the base distro?
Regards

Considering it's been completely broken ever since 2.2, what's the big surprise here?

#5 Updated by Phillip Davis about 4 years ago

PR https://github.com/pfsense/pfsense/pull/2104 to remove a little bit more dead code.
Does anything need to be done to upgrade configs? Rules that have layer7 stuff might suddenly become [more|differently] permissive when the matched packets are no longer diverted to layer7 processing?

#6 Updated by Florent THOMAS about 4 years ago

Kill Bill wrote:

Considering it's been completely broken ever since 2.2, what's the big surprise here?

Well, my question was more to know if there is an alternative planned? Applicative filter is a great solution and seeing it disappears from my favorite network distro is a sad news ;-)

#7 Updated by Jim Pingle about 4 years ago

Not that much of a loss. It never worked well anyhow. The pattern files from the upstream project were out of date and unmaintained, and they rarely matched things properly.

Keep an eye on snort with OpenAppID if you're wanting to block.

#8 Updated by Chris Buechler almost 4 years ago

  • Status changed from Feedback to Resolved

config upgrade code added to remove any layer7 configuration, and file a notice where found so users are clearly aware. Verified that's all fine with multiple diff configs.

That was the last piece of this.

Also available in: Atom PDF