From nobody Mon Aug 31 22:28:18 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hYkCp4SvHz6qKHj; Mon, 31 Aug 2026 22:28:22 +0000 (UTC) (envelope-from glebius@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hYkCp3nKHz475B; Mon, 31 Aug 2026 22:28:22 +0000 (UTC) (envelope-from glebius@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788215302; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hHAxOSav/Pthz0r5FvfJ1CP3TwgBHinDOq2CputC2jk=; b=Pe/Ys/xsaHGhrj+5WKg7q0ZAwQdDpBMI8Rp2red2JGIr7H0u8r9DlrQyzzDsh2dNvrnCJa uKVvQ+CFCMxXDbIBWcMzX8AwdTW3xIHnKBLi7pWWbvSN6qj6nZ0yd4aCN40M/RrLTZB0Al ebqvNCehpXNq1MolgwUmzX5JmAldVHBbrsPGF1tkjfYSiegLWZUVyheZOaLHencDLcgyEQ eE9pnwpaiDgBeai2jS17tynni9B8w+NZTuV2LJspPLxAV/FAIaBcJAyKEt3DjCz9lRDUqV pq9IBPZ5cTEb6U5EaBhcqoPaLBE6yYRvDlyqcnqSrjdedqKxcaA4ZcqoO42SAg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788215302; a=rsa-sha256; cv=none; b=qe7HKg2LBCcjFQxYc3J/nQr8gBie5dsQaTZGIhKWGI19cTPbLhHSUMCgSi7MMoBtuCdNyJ ndaEL68XSnlP/s70jNyYy9/1DEXps2XUPX3CK98DTB6WYt1kJq3aGyBf3BpGfqlRFnjTrl MKsai4hYMbF7YQ8SQ5EfqwRzUj0qFB1fQZR27Ew5SabtlZbdKps1UBeoLAnlkZPP4eAZgx 0H+jrlAy8mzbgowiwQM+qbgl73LbAo8zEGUnzTwgjsPrkZBdquuZLrL2+2rHPBhf/zT5/m wBcjVqlY3PKrQx8Mt2pb47Qs9seminbxz2qMtGMMIZDu/ya4W2KvC+TmzaStHw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788215302; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hHAxOSav/Pthz0r5FvfJ1CP3TwgBHinDOq2CputC2jk=; b=W6H6RxGMDjsK6/cY1RsOAU7icoGT/UHIOWmqna11aV1cK40tHtJjpBz0cS5UfWZ+L5D6y2 dOCMwlFD+/5DzZwpnSfqgKZtZ29koSSdjbugVAn+ar2eHQ7/5QgfjDhmik7SSGdaX7acQS mW/GTLAq88DNkddPW8W3rqjhpIA0wIbmmyl9z/6H5L82eWV7ypm8ucUmffszdfK1OFXX5j FVstmGIDsyLIRpD2UPq/TNko4cKavJyeQrA7rkFj3a2mZvIa1epuz45CU2xs0fsW0NqqVW EqfI7ihF9K1j2QreVkC9Xl5d/4ITKYZ0dZ2dK+EXlckHoJ1WTfieHWi5Qm5IcQ== Received: from cell.glebi.us (glebi.us [162.251.186.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: glebius) by smtp.freebsd.org (Postfix) with ESMTPSA id 4hYkCn5psKz3Qv; Mon, 31 Aug 2026 22:28:21 +0000 (UTC) (envelope-from glebius@freebsd.org) Date: Mon, 31 Aug 2026 15:28:18 -0700 From: Gleb Smirnoff To: Bojan =?utf-8?B?Tm92a292acSH?= Cc: src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org Subject: Re: git: bf05236727cf - main - pf: Send syncookies from the receiving thread Message-ID: References: <6a9193f0.37865.1e1b1fd6@gitrepo.freebsd.org> List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <6a9193f0.37865.1e1b1fd6@gitrepo.freebsd.org> Bojan, On Fri, Aug 28, 2026 at 01:58:08PM +0000, Bojan Novković wrote: B> The branch main has been updated by bnovkov: B> B> URL: https://cgit.FreeBSD.org/src/commit/?id=bf05236727cf367ee8e22ef47febebb319db9ddb B> B> commit bf05236727cf367ee8e22ef47febebb319db9ddb B> Author: Bojan Novković B> AuthorDate: 2026-08-17 14:10:36 +0000 B> Commit: Bojan Novković B> CommitDate: 2026-08-28 13:56:26 +0000 B> B> pf: Send syncookies from the receiving thread B> B> pf sends outbound packets by offloading them to a single per-vnet SWI handler B> through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm B> that per-vnet queue with syncookie packets and cause contention in the SWI B> handler that negatively affects other pf operations. B> B> Fix this by sending the initial syncookie challenge from the context B> of the receiving thread. This avoids the syncookie-induced contention on B> the `pf_intr` mbuf queue. B> B> Sponsored by: Klara, Inc. B> Sponsored by: Entersekt B> MFC after: 3 weeks B> Reviewed by: kp B> Differential Revision: https://reviews.freebsd.org/D59068 Do we hold any locks now upon call to ip_output() compared to before the change? -- Gleb Smirnoff