Page MenuHomeFreeBSD

pf: syncookie support
ClosedPublic

Authored by kp on Jul 11 2021, 8:18 AM.

Details

Summary

Import OpenBSD's syncookie support for pf. This feature help pf resist
TCP SYN floods by only creating states once the remote host completes
the TCP handshake rather than when the initial SYN packet is received.

This is accomplished by using the initial sequence numbers to encode a
cookie (hence the name) in the SYN+ACK response and verifying this on
receipt of the client ACK.

Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Modirum MDPay

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint OK
Unit
No Unit Test Coverage
Build Status
Buildable 40434
Build 37323: arc lint + arc unit