From owner-dev-commits-src-main@freebsd.org Wed Sep 29 13:42:33 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 82066673CB1; Wed, 29 Sep 2021 13:42:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HKHcT1rhJz3ls5; Wed, 29 Sep 2021 13:42:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id CF37F19404; Wed, 29 Sep 2021 13:42:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 18TDgWCr001183; Wed, 29 Sep 2021 13:42:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 18TDgWke001182; Wed, 29 Sep 2021 13:42:32 GMT (envelope-from git) Date: Wed, 29 Sep 2021 13:42:32 GMT Message-Id: <202109291342.18TDgWke001182@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 20f015f08d66 - main - pf.conf: document syncookies MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 20f015f08d66d0d953e49245cb95c81c118b9ee9 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Sep 2021 13:42:33 -0000 The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=20f015f08d66d0d953e49245cb95c81c118b9ee9 commit 20f015f08d66d0d953e49245cb95c81c118b9ee9 Author: Kristof Provost AuthorDate: 2021-08-14 08:42:03 +0000 Commit: Kristof Provost CommitDate: 2021-09-29 13:41:49 +0000 pf.conf: document syncookies Reviewed by: bcr Obtained from: OpenBSD MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D32137 --- share/man/man5/pf.conf.5 | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index 1bc7f147e830..9f69db70d90b 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -28,7 +28,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd September 10, 2021 +.Dd September 25, 2021 .Dt PF.CONF 5 .Os .Sh NAME @@ -539,6 +539,34 @@ For example: .Bd -literal -offset indent set state-policy if-bound .Ed +.It Ar set syncookies never | always | adaptive +When +.Cm syncookies +are active, pf will answer each incoming TCP SYN with a syncookie SYNACK, +without allocating any resources. +Upon reception of the client's ACK in response to the syncookie +SYNACK, pf will evaluate the ruleset and create state if the ruleset +permits it, complete the three way handshake with the target host and +continue the connection with synproxy in place. +This allows pf to be resilient against large synflood attacks which would +run the state table against its limits otherwise. +Due to the blind answers to every incoming SYN syncookies share the caveats of +synproxy, namely seemingly accepting connections that will be dropped later on. +.Pp +.Bl -tag -width adaptive -compact +.It Cm never +pf will never send syncookie SYNACKs (the default). +.It Cm always +pf will always send syncookie SYNACKs. +.It Cm adaptive +pf will enable syncookie mode when a given percentage of the state table +is used up by half-open TCP connections, as in, those that saw the initial +SYN but didn't finish the three way handshake. +The thresholds for entering and leaving syncookie mode can be specified using +.Bd -literal -offset indent +set syncookies adaptive (start 25%, end 12%) +.Ed +.El .It Ar set state-defaults The .Ar state-defaults