# Build PF into a 10.2 kernel



## hanzer (Sep 5, 2015)

Is there a way to compile PF into the kernel rather than loading it as a module? Adding these lines (below) to the kernel configuration file doesn't seem to work:

```
device  PF
device  PFLOG
```


----------



## tobik@ (Sep 5, 2015)

Try lowercasing the names. Looking at /usr/src/sys/conf/NOTES it should be: 
	
	



```
# The pf packet filter consists of three devices:
#  The `pf' device provides /dev/pf and the firewall code itself.
#  The `pflog' device provides the pflog0 interface which logs packets.
#  The `pfsync' device provides the pfsync0 interface used for
#   synchronization of firewall state tables (over the net).
device          pf
device          pflog
device          pfsync
```


----------



## kpa (Sep 5, 2015)

You won't gain anything by compiling PF directly into the kernel. Loading the PF modules on boot using loader.conf(5) or rc.conf(5) settings is functionally equivalent with no performance penalty.


----------



## hanzer (Sep 5, 2015)

tobik said:


> Try lowercasing the names.


Aha, that seems to have worked (compiling now), thanks!
Somehow, I didn't notice (or register) the convention - it looks like [FONT=Courier New]device [/FONT]entries are lower case and [FONT=Courier New]options[/FONT] entries are upper case.


> Looking at /usr/src/sys/conf/NOTES


Wow, that's a useful looking file! Studying it now.


----------



## hanzer (Sep 5, 2015)

kpa said:


> You won't gain anything by compiling PF directly into the kernel. Loading the PF modules on boot using loader.conf(5) or rc.conf(5) settings is functionally equivalent with no performance penalty.


Since "ALTQ is not available as a loadable kernel module" (*29.3.2. Enabling ALTQ*) and needs to be built into the kernel, it seems prudent [to me] to build-in PF along with it - as a matter of personal preference, a style of organization, a method of managing complexity, an intellectual aesthetic, etc. 

Mostly, I'm just experimenting with and exploring possible system configurations. The most recent looks like this:

`hanzer@insomnia:/usr/src/sys/i386/conf % sed -e '/^#/d' -e '/^$/d' INSOMNIA`

```
cpu  I686_CPU
ident  INSOMNIA
options  SCHED_4BSD
options  PREEMPTION  # Enable kernel thread preemption
options  INET  # InterNETworking
options  TCP_OFFLOAD  # TCP offload
options  SCTP  # Stream Control Transmission Protocol
options  FFS  # Berkeley Fast Filesystem
options  SOFTUPDATES  # Enable FFS soft updates support
options  UFS_ACL  # Support for access control lists
options  UFS_DIRHASH  # Improve performance on big directories
options  UFS_GJOURNAL  # Enable gjournal-based UFS journaling
options  QUOTA  # Enable disk quotas for UFS
options  PROCFS  # Process filesystem (requires PSEUDOFS)
options  PSEUDOFS  # Pseudo-filesystem framework
options  GEOM_PART_GPT  # GUID Partition Tables.
options  GEOM_LABEL  # Provides labelization
options  SCSI_DELAY=5000  # Delay (in ms) before probing SCSI
options  SYSVSHM  # SYSV-style shared memory
options  SYSVMSG  # SYSV-style message queues
options  SYSVSEM  # SYSV-style semaphores
options  _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options  PRINTF_BUFR_SIZE=128  # Prevent printf output being interspersed.
options  KBD_INSTALL_CDEV  # install a CDEV entry in /dev
options  HWPMC_HOOKS  # Necessary kernel hooks for hwpmc(4)
options  AUDIT  # Security event auditing
options  CAPABILITY_MODE  # Capsicum capability mode
options  CAPABILITIES  # Capsicum capabilities
options  PROCDESC  # Support for process descriptors
options  INCLUDE_CONFIG_FILE  # Include this file in kernel
options  RACCT  # Resource accounting framework
options  RACCT_DEFAULT_TO_DISABLED # Set kern.racct.enable=0 by default
options  RCTL  # Resource limits
device  pf
device  pflog
options  ALTQ
options  ALTQ_HFSC
device  apic  # I/O APIC
device  cpufreq
device  acpi
device  pci
device  ahci  # AHCI-compatible SATA controllers
device  ata  # Legacy ATA/SATA controllers
options  ATA_STATIC_ID  # Static device numbering
  # output.  Adds ~128k to driver.
  # output.  Adds ~215k to driver.
device  scbus  # SCSI bus (required for ATA/SCSI)
device  da  # Direct Access (disks)
device  cd  # CD
device  pass  # Passthrough device (direct ATA/SCSI access)
device  ses  # Enclosure Services (SES and SAF-TE)
device  atkbdc  # AT keyboard controller
device  atkbd  # AT keyboard
device  psm  # PS/2 mouse
device  kbdmux  # keyboard multiplexer
device  vga  # VGA video card driver
options  VESA  # Add support for VESA BIOS Extensions (VBE)
device  splash  # Splash screen and screen saver support
device  sc
options  SC_PIXEL_MODE  # add support for the raster text mode
device  vt
device  vt_vga
device  agp  # support several AGP chipsets
device  pmtimer
device  uart  # Generic UART driver
device  ppc
device  ppbus  # Parallel port bus (required)
device  lpt  # Printer
device  ppi  # Parallel port interface device
device  puc  # Multi I/O cards and multi-channel UARTs
device  miibus  # MII bus support
device  re  # RealTek 8139C+/8169/8169S/8110S
device  wlan  # 802.11 support
options  IEEE80211_DEBUG  # enable debug msgs
options  IEEE80211_AMPDU_AGE  # age frames in AMPDU reorder q's
options  IEEE80211_SUPPORT_MESH  # enable 802.11s draft support
device  wlan_wep  # 802.11 WEP support
device  wlan_ccmp  # 802.11 CCMP support
device  wlan_tkip  # 802.11 TKIP support
device  wlan_amrr  # AMRR transmit rate control algorithm
device  ath  # Atheros NICs
device  ath_pci  # Atheros pci/cardbus glue
device  ath_hal  # pci/cardbus chip support
options  AH_SUPPORT_AR5416  # enable AR5416 tx/rx descriptors
options  AH_AR5416_INTERRUPT_MITIGATION # AR5416 interrupt mitigation
options  ATH_ENABLE_11N  # Enable 802.11n support for AR5416 and later
device  ath_rate_sample  # SampleRate tx rate control for ath
device  loop  # Network loopback
device  random  # Entropy device
device  ether  # Ethernet support
device  vlan  # 802.1Q VLAN support
device  tun  # Packet tunnel.
device  md  # Memory "disks"
device  gif  # IPv6 and IPv4 tunneling
device  firmware  # firmware assist module
device  bpf  # Berkeley packet filter
options  USB_DEBUG  # enable debug msgs
device  uhci  # UHCI PCI->USB interface
device  ohci  # OHCI PCI->USB interface
device  ehci  # EHCI PCI->USB interface (USB 2.0)
device  usb  # USB Bus (required)
device  ukbd  # Keyboard
device  umass  # Disks/Mass storage - Requires scbus and da
```
/etc/make.conf

```
CPUTYPE?=k8-sse3
CFLAGS+=-O2 -pipe
CXXFLAGS+=-O2 -pipe
COPTFLAGS= -O -pipe
MAKE_SHELL?=sh
INSTALL+= -C
#MODULES_OVERRIDE=ath ath_ahb ath_pci re wlan wlan_amrr wlan_ccmp wlan_tkip wlan_wep pf pflog
NO_PROFILE=true
PRINTERDEVICE=ascii
TOP_TABLE_SIZE=101
DOC_LANG=en_US.ISO8859-1
```
/etc/src.conf

```
#WITHOUT_ACCT=true
WITHOUT_ARM_EABI=true
WITHOUT_ATM=true
#WITHOUT_AUDIT=true
WITHOUT_BHYVE=true
WITHOUT_BLUETOOTH=true
#WITHOUT_CAPSICUM=true
WITHOUT_CCD=true
WITHOUT_CDDL=true
WITHOUT_CTF=true
WITHOUT_ZFS=true
WITHOUT_FLOPPY=true
WITHOUT_HAST=true
WITHOUT_HTML=true
WITHOUT_HYPERV=true
WITHOUT_INET6=true
WITHOUT_INET6_SUPPORT=true
WITHOUT_IPX=true
WITHOUT_IPX_SUPPORT=true
WITHOUT_ISCSI=true
#WITHOUT_JAIL=true
WITHOUT_KDUMP=true
WITHOUT_KERBEROS=true
WITHOUT_KERBEROS_SUPPORT=true
WITHOUT_KERNEL_SYMBOLS=true
WITHOUT_KVM=true
WITHOUT_KVM_SUPPORT=true
WITHOUT_PPP=true
WITHOUT_PROFILE=true
#WITHOUT_QUOTAS=true
WITHOUT_UNBOUND=true
WITHOUT_ZFS=true
```


----------



## kpa (Sep 5, 2015)

hanzer said:


> Since "ALTQ is not available as a loadable kernel module" (*29.3.2. Enabling ALTQ*) and needs to be built into the kernel, it seems prudent [to me] to build-in PF along with it - as a matter of personal preference, a style of organization, a method of managing complexity, an intellectual aesthetic, etc.



No, you can compile PF with ALTQ and still keep it as  loadable modules by leaving out the device pf line from your configuration file. The options lines are still in effect when the modules are built.


----------



## hanzer (Sep 5, 2015)

kpa said:


> No, you can compile PF with ALTQ and still keep it as  loadable modules by leaving out the device pf line from your configuration file. The options lines are still in effect when the modules are built.


Yes, but I don't think we are really intersecting on the point (which is probably moot by now).


----------

