git: 8e1864ed0712 - main - pf: syncookie support

[Dmitry Chagin]

On Tue, Jul 20, 2021 at 08:36:54AM +0000, Kristof Provost wrote:
> The branch main has been updated by kp:
> 
> URL: https://cgit.FreeBSD.org/src/commit/?id=8e1864ed07121b479b95d7e3a5931a9e0ffd4713
> 
> commit 8e1864ed07121b479b95d7e3a5931a9e0ffd4713
> Author:     Kristof Provost <kp at FreeBSD.org>
> AuthorDate: 2021-05-20 09:54:41 +0000
> Commit:     Kristof Provost <kp at FreeBSD.org>
> CommitDate: 2021-07-20 08:36:13 +0000
> 
>     pf: syncookie support
>     
>     Import OpenBSD's syncookie support for pf. This feature help pf resist
>     TCP SYN floods by only creating states once the remote host completes
>     the TCP handshake rather than when the initial SYN packet is received.
>     
>     This is accomplished by using the initial sequence numbers to encode a
>     cookie (hence the name) in the SYN+ACK response and verifying this on
>     receipt of the client ACK.
>     
>     Reviewed by:    kbowling
>     Obtained from:  OpenBSD
>     MFC after:      1 week
>     Sponsored by:   Modirum MDPay
>     Differential Revision:  https://reviews.freebsd.org/D31138

NOINET6 build fails

--- vers.c ---
MAKE="make" sh /home/dchagin/freebsd/sys/conf/newvers.sh  LINT-NOINET6
--- vers.o ---
cc -target i386-unknown-freebsd14.0 --sysroot=/home/dchagin/tmp/obj/home/dchagin/freebsd/i386.i386/tmp -B/home/dchagin/tmp/obj/home/dchagin/freebsd/i386.i386/tmp/usr/bin -c -O2 -pipe  -fno-strict-aliasing   -nostdinc  -I. -I/home/dchagin/freebsd/sys -I/home/dchagin/freebsd/sys/contrib/ck/include -I/home/dchagin/freebsd/sys/contrib/libfdt -D_KERNEL -DHAVE_KERNEL_OPTION_HEADERS -include opt_global.h -fno-common   -fno-builtin  -fdebug-prefix-map=./machine=/home/dchagin/freebsd/sys/i386/include -fdebug-prefix-map=./x86=/home/dchagin/freebsd/sys/x86/include -mno-mmx -mno-sse -msoft-float -ffreestanding -fwrapv -fstack-protector -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wundef -Wno-pointer-sign -D__printf__=__freebsd_kprintf__ -Wmissing-include-dirs -fdiagnostics-show-option -Wno-unknown-pragmas -Wno-error=tautological-compare -Wno-error=empty-body -Wno-error=parentheses-equality -Wno-error=unused-function -Wno-error=pointer-sign -Wno-error=shift-negative-value -Wno-address-of-packed-member -Wno-format-zero-length   -mno-aes -mno-avx  -std=iso9899:1999 -Werror vers.c
--- kernel ---
linking kernel
ld: warning: common OPENSSL_ia32cap_P is overridden
ld: warning: common OPENSSL_ia32cap_P is overridden
ld: warning: common OPENSSL_ia32cap_P is overridden
ld: warning: common OPENSSL_ia32cap_P is overridden
ld: warning: common OPENSSL_ia32cap_P is overridden
ld: error: undefined symbol: pf_synflood_check
>>> referenced by pf.c
>>>               pf.o:(pf_test)
ld: error: undefined symbol: pf_syncookie_send
>>> referenced by pf.c
>>>               pf.o:(pf_test)
ld: error: undefined symbol: pf_syncookie_validate
>>> referenced by pf.c
>>>               pf.o:(pf_test)

ld: error: undefined symbol: pf_syncookie_recreate_syn
>>> referenced by pf.c
>>>               pf.o:(pf_test)

ld: error: undefined symbol: pf_syncookies_init
>>> referenced by pf_ioctl.c
>>>               pf_ioctl.o:(vnet_pf_init)

ld: error: undefined symbol: pf_set_syncookies
>>> referenced by pf_ioctl.c
>>>               pf_ioctl.o:(pfioctl)

ld: error: undefined symbol: pf_get_syncookies
>>> referenced by pf_ioctl.c
>>>               pf_ioctl.o:(pfioctl)
*** [kernel] Error code 1

make[5]: stopped in /home/dchagin/tmp/obj/home/dchagin/freebsd/i386.i386/sys/LINT-NOINET6
1 error

make[5]: stopped in /home/dchagin/tmp/obj/home/dchagin/freebsd/i386.i386/sys/LINT-NOINET6

make[4]: stopped in /home/dchagin/freebsd

make[3]: stopped in /home/dchagin/freebsd