Project

General

Profile

Actions
Copy link

Todo #5508

closed

remove layer7 pieces

Added by Chris Buechler about 9 years ago. Updated almost 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Chris Buechler
Category:
Layer 7
Target version:
2.3
Start date:
11/20/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:

Description

ipfw-classifyd and friends haven't worked correctly in any FreeBSD 10.x base version, the functionality as implemented had extremely high CPU overhead and other difficulties back when it did (sort of) work, and it was very rarely used.

Opening this todo in favor of #4276 / #4416 / #4993

Actions
Copy link
 #1

Updated by Chris Buechler about 9 years ago

  • Status changed from Assigned to Feedback
Actions
Copy link
 #2

Updated by Chris Buechler about 9 years ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by Florent THOMAS about 9 years ago

Do you mean that Layer7 will disappear form the base distro?
Regards

Actions
Copy link
 #4

Updated by Kill Bill about 9 years ago

Florent THOMAS wrote:

Do you mean that Layer7 will disappear form the base distro?
Regards

Considering it's been completely broken ever since 2.2, what's the big surprise here?

Actions
Copy link
 #5

Updated by Phillip Davis almost 9 years ago

PR https://github.com/pfsense/pfsense/pull/2104 to remove a little bit more dead code.
Does anything need to be done to upgrade configs? Rules that have layer7 stuff might suddenly become [more|differently] permissive when the matched packets are no longer diverted to layer7 processing?

Actions
Copy link
 #6

Updated by Florent THOMAS almost 9 years ago

Kill Bill wrote:

Considering it's been completely broken ever since 2.2, what's the big surprise here?

Well, my question was more to know if there is an alternative planned? Applicative filter is a great solution and seeing it disappears from my favorite network distro is a sad news ;-)

Actions
Copy link
 #7

Updated by Jim Pingle almost 9 years ago

Not that much of a loss. It never worked well anyhow. The pattern files from the upstream project were out of date and unmaintained, and they rarely matched things properly.

Keep an eye on snort with OpenAppID if you're wanting to block.

Actions
Copy link
 #8

Updated by Chris Buechler almost 9 years ago

  • Status changed from Feedback to Resolved

config upgrade code added to remove any layer7 configuration, and file a notice where found so users are clearly aware. Verified that's all fine with multiple diff configs.

That was the last piece of this.

Actions
Copy link

Also available in: Atom PDF