Re: git: bf05236727cf - main - pf: Send syncookies from the receiving thread
- In reply to: Bojan Novković : "git: bf05236727cf - main - pf: Send syncookies from the receiving thread"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 31 Aug 2026 22:28:18 UTC
Bojan, On Fri, Aug 28, 2026 at 01:58:08PM +0000, Bojan Novković wrote: B> The branch main has been updated by bnovkov: B> B> URL: https://cgit.FreeBSD.org/src/commit/?id=bf05236727cf367ee8e22ef47febebb319db9ddb B> B> commit bf05236727cf367ee8e22ef47febebb319db9ddb B> Author: Bojan Novković <bnovkov@FreeBSD.org> B> AuthorDate: 2026-08-17 14:10:36 +0000 B> Commit: Bojan Novković <bnovkov@FreeBSD.org> B> CommitDate: 2026-08-28 13:56:26 +0000 B> B> pf: Send syncookies from the receiving thread B> B> pf sends outbound packets by offloading them to a single per-vnet SWI handler B> through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm B> that per-vnet queue with syncookie packets and cause contention in the SWI B> handler that negatively affects other pf operations. B> B> Fix this by sending the initial syncookie challenge from the context B> of the receiving thread. This avoids the syncookie-induced contention on B> the `pf_intr` mbuf queue. B> B> Sponsored by: Klara, Inc. B> Sponsored by: Entersekt B> MFC after: 3 weeks B> Reviewed by: kp B> Differential Revision: https://reviews.freebsd.org/D59068 Do we hold any locks now upon call to ip_output() compared to before the change? -- Gleb Smirnoff