3 ms·
I'm sure i read on a comment here recently that the latest macos is using a recent openbsd pf? As quite a heavy user of freebsd pf, I wonder if anyone knows mor
by cyberpunk 3y ago
I'm sure i read on a comment here recently that the latest macos is using a recent openbsd pf? As quite a heavy user of freebsd pf, I wonder if anyone knows more details on that?
- nvy 3y agoOn my mbp, the man page for `pfctl` contains the following: >HISTORY > The pfctl program and the packet filter mechanism first appeared in OpenBSD 3.0.
- yakubin 3y agoThe same is in the current manpage on OpenBSD: <https://man.openbsd.org/pfctl https://man.openbsd.org/pfctl>. The next line is more telling though: > July 1, 2007 Although I'm running Monterey, so maybe it's updated in more recent versions of MacOS.
- nvy 3y agoMine doesn't have a date at the bottom, just a macOS version number.
- nvy 3y agoedit: never mind, it does
- wkat4242 3y agoStill 2007 here in macOS Sonoma 14.0 I'm just super surprised it's there at all considering no rules are defined by the OS, and nobody uses it anymore because all the firewall vendors moved over to system extensions.
- arghnoname 3y agowhen I use pfctl on macOS I see apple defined anchors.
- toast0 3y agoI haven't looked in a while, but an update would be nice. When I was looking at it in the last couple years, many things in the networking stack were unchanged since the late 90s/early 2000s, so macos didn't have syn flood protection built in, and while the macos pf had synflood stuff, it only works if the macos host is strictly a firewall, using the syn protection for traffic where macos is an endpoint results in no connectivity. If they pulled in a more recent pf from either OpenBSD or more current FreeBSD would be welcome. (And you know, a recent tcp stack would be nice too; although they've added in things like MPTCP that they'd need to port forward by 20+ years)