From nobody Mon Oct 12 10:42:45 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j3DZF24nVz6Smy1 for ; Mon, 12 Oct 2026 10:42:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j3DZF1Jf0z4Vps for ; Mon, 12 Oct 2026 10:42:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791801765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bieGnGu4KW5OE+SosWDR5C70bXSfDI+s3Tqbkbhiphs=; b=ZSAeBzc4gxh4CFV4IQnV/mx+661wsp/LVGIx8oNqKHts1qYyQ/gQDNdPtu5+izsb0/JBlT 0xMXezIHPNzS2B7fIj+KdBACezFeHYAWRSw7J7iJdPWe2Ue0Ycp9bKbQIkXSMey44w+uP9 8YxWuK0FsIpQbjqZ2LbND3uhFMzik/zmzXIQI05YAuwtH2uJ5ZIjbzaPA1lQhbiPZ+sbCd +kM0ppofXnSpouCYIIC2Yz7sIcSJiXcXWTRXBURGheQD4IjFyzQQE+SHUYzf7rZvvNMOVG 0uOfoGZ7et0VnzghRoMlXZ0CKeZ+gWs3eAooeDzbvDEoHsGcxlAcR9jQWmooVg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791801765; b=Vp1dFt9n8bbngZ9oxQkDlngDqQ/n6U8Fv13A/ZVwKOCure9cbCWwF/h1WRkW8Oh2w2dW9o iZGD6oPn0DtKdKwR1CFJyhnwh74Fa6jMfrHsLH7jxxCg4Moe72/QUelKINtsowFzrK8ENm MnLK1JhW7Is1/JExDtnVotSS9AYZ/zmLmN3HuhHrDKhAH4CwS4ysAr5DGuw67iYWkBGBLS x/KT9KOFxDf1byRxQg52ddqPo30t0p9/f2GI2aiVi7e+LloAyWjU1KSotj/zuIQNKuhpRB HyejsXF8uro6MI7i3lDL/iNHkjl/eXY6HypagcaH4tq83dXA3iDZj8TUdkJfVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791801765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bieGnGu4KW5OE+SosWDR5C70bXSfDI+s3Tqbkbhiphs=; b=TKVjhyggRKqhFSyx0SzY8SPqpdqd76BgGLFsDe4YC3WanyQljcMZai/0+Vs2ZErxzuIHUz 5fHQrACgwvh06GOSVtBb/qup3lba9Q4rg5seLj53nKL8QONGVty/WzKd90yfW763Rh/xti OQZBZM4zxf1UIMFEGkx9Zfn38SgtFdr2gf4o8XlVn3zqGxY63xiIlVVIM3hUuFIPaeOlpj kVG1ObSnODpMdSsqkSyxgw0gH5S10usvRgOdrwTaCTMU5Xx6qx9rpU/3RmCOpRCtOc/7ti UXPM6lkrFk0U5K4lF8++aDTcWZwlTz2bNST8VFdj3rJLHZmztVuZ5Gztp2/+3g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j3DZF0L38zPP6 for ; Mon, 12 Oct 2026 10:42:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22c74 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 12 Oct 2026 10:42:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bojan Novk=?utf-8?Q?ovi=C4=87?= Subject: git: 9c142388e4de - stable/15 - pf: Send syncookies from the receiving thread List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bnovkov X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9c142388e4dec145109dbf02e7728967c2cbf3b9 Auto-Submitted: auto-generated Date: Mon, 12 Oct 2026 10:42:45 +0000 Message-Id: <6accb9a5.22c74.74a7cce3@gitrepo.freebsd.org> The branch stable/15 has been updated by bnovkov: URL: https://cgit.FreeBSD.org/src/commit/?id=9c142388e4dec145109dbf02e7728967c2cbf3b9 commit 9c142388e4dec145109dbf02e7728967c2cbf3b9 Author: Bojan Novković AuthorDate: 2026-08-17 14:10:36 +0000 Commit: Bojan Novković CommitDate: 2026-10-12 09:37:05 +0000 pf: Send syncookies from the receiving thread pf sends outbound packets by offloading them to a single per-vnet SWI handler through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm that per-vnet queue with syncookie packets and cause contention in the SWI handler that negatively affects other pf operations. Fix this by sending the initial syncookie challenge from the context of the receiving thread. This avoids the syncookie-induced contention on the `pf_intr` mbuf queue. Sponsored by: Klara, Inc. Sponsored by: Entersekt MFC after: 3 weeks Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D59068 (cherry picked from commit bf05236727cf367ee8e22ef47febebb319db9ddb) --- sys/netpfil/pf/pf.c | 67 ++++++++++++++++++++++++------------------ sys/netpfil/pf/pf.h | 9 +++++- sys/netpfil/pf/pf_syncookies.c | 31 +++++++++++++++++-- 3 files changed, 75 insertions(+), 32 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 6092d0b5566e..1e65bb4dfd96 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -2444,6 +2444,43 @@ pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type, return (0); /* These types match to their own state */ } +#ifdef INET +void +pf_send_ip_direct(struct mbuf *m) +{ + if (pf_isforlocal(m, AF_INET)) { + KASSERT(m->m_pkthdr.rcvif == V_loif, + ("%s: rcvif != loif", __func__)); + + m->m_flags |= M_SKIP_FIREWALL; + m->m_pkthdr.csum_flags |= CSUM_IP_VALID | CSUM_IP_CHECKED | + CSUM_DATA_VALID | CSUM_PSEUDO_HDR; + m->m_pkthdr.csum_data = 0xffff; + ip_input(m); + } else { + ip_output(m, NULL, NULL, 0, NULL, NULL); + } +} +#endif + +#ifdef INET6 +void +pf_send_ip6_direct(struct mbuf *m) +{ + if (pf_isforlocal(m, AF_INET6)) { + KASSERT(m->m_pkthdr.rcvif == V_loif, + ("%s: rcvif != loif", __func__)); + + m->m_flags |= M_SKIP_FIREWALL | M_LOOP; + m->m_pkthdr.csum_flags |= CSUM_DATA_VALID | CSUM_PSEUDO_HDR; + m->m_pkthdr.csum_data = 0xffff; + ip6_input(m); + } else { + ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); + } +} +#endif + void pf_intr(void *v) { @@ -2464,20 +2501,7 @@ pf_intr(void *v) switch (pfse->pfse_type) { #ifdef INET case PFSE_IP: { - if (pf_isforlocal(pfse->pfse_m, AF_INET)) { - KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif, - ("%s: rcvif != loif", __func__)); - - pfse->pfse_m->m_flags |= M_SKIP_FIREWALL; - pfse->pfse_m->m_pkthdr.csum_flags |= - CSUM_IP_VALID | CSUM_IP_CHECKED | - CSUM_DATA_VALID | CSUM_PSEUDO_HDR; - pfse->pfse_m->m_pkthdr.csum_data = 0xffff; - ip_input(pfse->pfse_m); - } else { - ip_output(pfse->pfse_m, NULL, NULL, 0, NULL, - NULL); - } + pf_send_ip_direct(pfse->pfse_m); break; } case PFSE_ICMP: @@ -2487,20 +2511,7 @@ pf_intr(void *v) #endif /* INET */ #ifdef INET6 case PFSE_IP6: - if (pf_isforlocal(pfse->pfse_m, AF_INET6)) { - KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif, - ("%s: rcvif != loif", __func__)); - - pfse->pfse_m->m_flags |= M_SKIP_FIREWALL | - M_LOOP; - pfse->pfse_m->m_pkthdr.csum_flags |= - CSUM_DATA_VALID | CSUM_PSEUDO_HDR; - pfse->pfse_m->m_pkthdr.csum_data = 0xffff; - ip6_input(pfse->pfse_m); - } else { - ip6_output(pfse->pfse_m, NULL, NULL, 0, NULL, - NULL, NULL); - } + pf_send_ip6_direct(pfse->pfse_m); break; case PFSE_ICMP6: icmp6_error(pfse->pfse_m, pfse->icmpopts.type, diff --git a/sys/netpfil/pf/pf.h b/sys/netpfil/pf/pf.h index f8646b782fce..edb3bf265afd 100644 --- a/sys/netpfil/pf/pf.h +++ b/sys/netpfil/pf/pf.h @@ -737,5 +737,12 @@ RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); int pf_get_ruleset_number(u_int8_t); - +#ifdef _KERNEL +#ifdef INET +void pf_send_ip_direct(struct mbuf *m); +#endif +#ifdef INET6 +void pf_send_ip6_direct(struct mbuf *m); +#endif +#endif /* _KERNEL */ #endif /* _NET_PF_H_ */ diff --git a/sys/netpfil/pf/pf_syncookies.c b/sys/netpfil/pf/pf_syncookies.c index 4a935bc65767..debf3fc29a8a 100644 --- a/sys/netpfil/pf/pf_syncookies.c +++ b/sys/netpfil/pf/pf_syncookies.c @@ -60,6 +60,9 @@ //#include "pflog.h" +#include "opt_inet.h" +#include "opt_inet6.h" + #include #include #include @@ -80,11 +83,16 @@ #include #include +#include #include #include +#include #include #include +#include +#include + #include #include @@ -291,13 +299,30 @@ pf_syncookie_send(struct pf_pdesc *pd) { uint16_t mss; uint32_t iss; + struct mbuf *m; mss = max(V_tcp_mssdflt, pf_get_mss(pd)); iss = pf_syncookie_generate(pd, mss); - pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport, - iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN|TH_ACK, 0, mss, - 0, M_SKIP_FIREWALL | (pd->m->m_flags & M_LOOP), 0, 0, + m = pf_build_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport, + iss, ntohl(pd->hdr.tcp.th_seq) + 1, TH_SYN | TH_ACK, 0, mss, 0, + M_SKIP_FIREWALL | (pd->m->m_flags & M_LOOP), 0, 0, 0, pd->act.rtableid); + if (m == NULL) + return; + switch (pd->af) { +#ifdef INET + case AF_INET: + pf_send_ip_direct(m); + break; +#endif /* INET */ +#ifdef INET6 + case AF_INET6: + pf_send_ip6_direct(m); + break; +#endif /* INET6 */ + default: + unhandled_af(pd->af); + } counter_u64_add(V_pf_status.lcounters[KLCNT_SYNCOOKIES_SENT], 1); /* XXX Maybe only in adaptive mode? */ atomic_add_64(&V_pf_status.syncookies_inflight[V_pf_syncookie_status.oddeven],