Date: Wed, 2 Apr 2008 03:07:40 -0500 From: David DeSimone <fox@verio.net> To: freebsd-pf@freebsd.org Subject: Re: PF and State Table Message-ID: <20080402080740.GA2396@verio.net> In-Reply-To: <20080402063910.GA36819@eos.sc1.parodius.com> References: <88224.68960.qm@web57401.mail.re1.yahoo.com> <20080402063910.GA36819@eos.sc1.parodius.com>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeremy Chadwick <koitsu@freebsd.org> wrote: > > This is somewhat risky, because you really don't want to waste a state > entry on something that's half-way in the middle of a TCP session > (well, I suppose you could, but it seems insecure. It's more than just insecure; it can cause breakage of TCP connections, especially in a world where RFC 1323 is commonplace (i.e. today's world). If PF starts tracking state from the middle of a connection, it has missed out on discovering what TCP window scaling factors are in use. If there happens to be no scaling in use, it works fine, but if a scale factor is being applied, PF will not track the state correctly, and the connection will stall out. > > What file in PF on FreeBSD kernel does state table structure is > > located? > > I don't understand this question. I think the question is asking for details on how PF state is stored in memory. I found a very nice struct pf_state in /usr/include/net/pfvar.h. - -- David DeSimone == Network Admin == fox@verio.net "This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, dis- tribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you." --Lawyer Bot 6000 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFH8z7MFSrKRjX5eCoRAk0CAJ9nF+Khgn0JAmAFA9oOaR5iA+hpkgCfTwAO moQSQmUAZCVMhR6tmlaspJc= =uDM8 -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080402080740.GA2396>