PF synproxy state doesn’t negotiate TCP options in 10.2

[Kristof Provost]

On 2015-11-25 05:36:07 (-0500), J David <j.david.lists at gmail.com> wrote:
> It appears that “synproxy state” rules cause TCPs connection to be
> negotiated without any options except MSS.
> 
...
> Is this behavior intentional?  If so, perhaps it should be mentioned
> on the man page?  If not, should we open a bug report on this?
> 
It's 'intentional' in the sense that it's simply not implemented in pf.
In the synproxy case pf generates the TCP packet from scratch. All
that's implemented there is the MSS option.

I suspect nothing more is implemented because of the complexity. Using
synproxy means there's no communication with the 'real' server until the
connection is (from the outside perspective) established, so pf can't
really know what values to negotiate.

You're right that it'd be good to document this in the man page though.

Regards,
Kristof