Date: Wed, 29 Sep 2021 13:42:32 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 20f015f08d66 - main - pf.conf: document syncookies Message-ID: <202109291342.18TDgWke001182@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=20f015f08d66d0d953e49245cb95c81c118b9ee9 commit 20f015f08d66d0d953e49245cb95c81c118b9ee9 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-08-14 08:42:03 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-09-29 13:41:49 +0000 pf.conf: document syncookies Reviewed by: bcr Obtained from: OpenBSD MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D32137 --- share/man/man5/pf.conf.5 | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index 1bc7f147e830..9f69db70d90b 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -28,7 +28,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd September 10, 2021 +.Dd September 25, 2021 .Dt PF.CONF 5 .Os .Sh NAME @@ -539,6 +539,34 @@ For example: .Bd -literal -offset indent set state-policy if-bound .Ed +.It Ar set syncookies never | always | adaptive +When +.Cm syncookies +are active, pf will answer each incoming TCP SYN with a syncookie SYNACK, +without allocating any resources. +Upon reception of the client's ACK in response to the syncookie +SYNACK, pf will evaluate the ruleset and create state if the ruleset +permits it, complete the three way handshake with the target host and +continue the connection with synproxy in place. +This allows pf to be resilient against large synflood attacks which would +run the state table against its limits otherwise. +Due to the blind answers to every incoming SYN syncookies share the caveats of +synproxy, namely seemingly accepting connections that will be dropped later on. +.Pp +.Bl -tag -width adaptive -compact +.It Cm never +pf will never send syncookie SYNACKs (the default). +.It Cm always +pf will always send syncookie SYNACKs. +.It Cm adaptive +pf will enable syncookie mode when a given percentage of the state table +is used up by half-open TCP connections, as in, those that saw the initial +SYN but didn't finish the three way handshake. +The thresholds for entering and leaving syncookie mode can be specified using +.Bd -literal -offset indent +set syncookies adaptive (start 25%, end 12%) +.Ed +.El .It Ar set state-defaults The .Ar state-defaults
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202109291342.18TDgWke001182>