git: 20f015f08d66 - main - pf.conf: document syncookies
Kristof Provost
kp at FreeBSD.org
Wed Sep 29 13:42:33 UTC 2021
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=20f015f08d66d0d953e49245cb95c81c118b9ee9
commit 20f015f08d66d0d953e49245cb95c81c118b9ee9
Author: Kristof Provost <kp at FreeBSD.org>
AuthorDate: 2021-08-14 08:42:03 +0000
Commit: Kristof Provost <kp at FreeBSD.org>
CommitDate: 2021-09-29 13:41:49 +0000
pf.conf: document syncookies
Reviewed by: bcr
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D32137
---
share/man/man5/pf.conf.5 | 30 +++++++++++++++++++++++++++++-
1 file changed, 29 insertions(+), 1 deletion(-)
diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index 1bc7f147e830..9f69db70d90b 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -28,7 +28,7 @@
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd September 10, 2021
+.Dd September 25, 2021
.Dt PF.CONF 5
.Os
.Sh NAME
@@ -539,6 +539,34 @@ For example:
.Bd -literal -offset indent
set state-policy if-bound
.Ed
+.It Ar set syncookies never | always | adaptive
+When
+.Cm syncookies
+are active, pf will answer each incoming TCP SYN with a syncookie SYNACK,
+without allocating any resources.
+Upon reception of the client's ACK in response to the syncookie
+SYNACK, pf will evaluate the ruleset and create state if the ruleset
+permits it, complete the three way handshake with the target host and
+continue the connection with synproxy in place.
+This allows pf to be resilient against large synflood attacks which would
+run the state table against its limits otherwise.
+Due to the blind answers to every incoming SYN syncookies share the caveats of
+synproxy, namely seemingly accepting connections that will be dropped later on.
+.Pp
+.Bl -tag -width adaptive -compact
+.It Cm never
+pf will never send syncookie SYNACKs (the default).
+.It Cm always
+pf will always send syncookie SYNACKs.
+.It Cm adaptive
+pf will enable syncookie mode when a given percentage of the state table
+is used up by half-open TCP connections, as in, those that saw the initial
+SYN but didn't finish the three way handshake.
+The thresholds for entering and leaving syncookie mode can be specified using
+.Bd -literal -offset indent
+set syncookies adaptive (start 25%, end 12%)
+.Ed
+.El
.It Ar set state-defaults
The
.Ar state-defaults
More information about the dev-commits-src-all
mailing list