Re-introduce ipfw support for sshuttle on FreeBSD

[ermal]

Re-introduce ipfw support for sshuttle on FreeBSD with support for DNS option as well

Sponsored-by: rsync.net

[brianmay]

Thanks for the contribution. I am willing to merge this. However, just curious why? What is the justification for this change?

(also tests would be really good...)

[ermal]

three reason(s) of the top of my head:

• pf implementation is really a hack and involves nat. Also not efficient and not easily used when you have other rulesets
• there is no other way to really perform transparent proxies i.e. --dns support today as is
• people actually using ipfw and this provides an elegant solution for them

Soon[1] an extra patch will come that will allow full UDP to be forwarded as well on FreeBSD.
[1] https://reviews.freebsd.org/D9235

I will try to put some tests in with the next improvement above.

[vieira]

I'm also having a hard time understanding the advantages of readding ipfw after the decision was made to remove it and work was done to add support for FreeBSD via pf.

With pf it takes about 70 lines to support FreeBSD and with the same method we also support macOS, OpenBSD and now pfSense. With ipfw it will take about 270 lines of new code to maintain, a new method just for FreeBSD and, as it stands, it supports less features than the pf implementation (no IPv6).

Full UDP would be nice but couldn't it be added to the pf method? That way it would also benefit users on macOS which I suspect are in far greater number than the other BSDs combined.

[ermal]

Oh the code will get much shorter with the update and i do not buy the platform support code.
I can understand an argument of saying when you bring in the other improvement make even the pf code work but that is about it.

IPv6 support is there its just not tested hence not activated, i do not want to bring in a broken feature.

Maintenance wise ipfw in FreeBSD has kept backward compatibility since early 4.x days and has compat code built in.

I do not understand how you guys support pfSense which does not give any guarantee to you but resist to a vital component of FreeBSD!

[brianmay]

One of my prime reasons for removing this before is because it didn't appear that anybody was interested in maintaining the code. As it would appear @ermal is now interested in maintaining this code I have no objections to putting it back in again. I will wait several days, if there aren't any new objections then I will merge this.