Differential D31138

pf: syncookie support
ClosedPublic
Actions

Authored by kp on Jul 11 2021, 8:18 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Fri, Jul 11, 4:00 AM

	Unknown Object (File)
	Wed, Jun 25, 3:35 AM

	Unknown Object (File)
	Fri, Jun 20, 10:53 AM

	Unknown Object (File)
	Sun, Jun 15, 8:50 AM

	Unknown Object (File)
	Jun 6 2025, 5:46 AM

	Unknown Object (File)
	Jun 1 2025, 12:56 AM

	Unknown Object (File)
	May 26 2025, 10:08 AM

	Unknown Object (File)
	May 15 2025, 4:34 PM

Subscribers

Details

Reviewers

Group Reviewers

network
transport

Commits

rGc3d03672e119: pf: syncookie support
rGba7edb52211a: pf: syncookie support
rG8e1864ed0712: pf: syncookie support

Summary

Import OpenBSD's syncookie support for pf. This feature help pf resist
TCP SYN floods by only creating states once the remote host completes
the TCP handshake rather than when the initial SYN packet is received.

This is accomplished by using the initial sequence numbers to encode a
cookie (hence the name) in the SYN+ACK response and verifying this on
receipt of the client ACK.

Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Modirum MDPay

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Jul 11 2021, 8:18 AM

Herald added a reviewer: transport. · View Herald TranscriptJul 11 2021, 8:18 AM

Herald added subscribers: melifaro, farrokhi, ae, imp. · View Herald Transcript

kp requested review of this revision.Jul 11 2021, 8:18 AM

Harbormaster completed remote builds in B40434: Diff 92067.Jul 11 2021, 8:18 AM

kp added a child revision: D31139: pf: syncookie ioctl interface.Jul 11 2021, 8:18 AM

kp added a parent revision: D31137: pf: factor out pf_synproxy().Jul 11 2021, 8:18 AM

kbowling accepted this revision.Jul 18 2021, 6:39 AM

This revision is now accepted and ready to land.Jul 18 2021, 6:39 AM

Closed by commit rG8e1864ed0712: pf: syncookie support (authored by kp). · Explain WhyJul 20 2021, 8:37 AM

This revision was automatically updated to reflect the committed changes.

kp added a commit: rG8e1864ed0712: pf: syncookie support.

kp added a commit: rGba7edb52211a: pf: syncookie support.Jul 27 2021, 11:47 AM

kp added a commit: rGc3d03672e119: pf: syncookie support.

Revision Contents
Changeset List

Path

Size

sys/

modules/

pf/

2 lines

net/

34 lines

netinet/

2 lines

netpfil/

pf/

3 lines

129 lines

3 lines

1 line

pf_syncookies.c

350 lines

Diff 92475

sys/modules/pf/Makefile

Loading...

sys/net/pfvar.h

Loading...

sys/netinet/tcp.h

Loading...

sys/netpfil/pf/pf.h

Loading...

sys/netpfil/pf/pf.c

Loading...

sys/netpfil/pf/pf_ioctl.c

Loading...

sys/netpfil/pf/pf_mtag.h

Loading...

sys/netpfil/pf/pf_syncookies.c

Loading...