From owner-freebsd-pf@FreeBSD.ORG Wed Apr 2 08:07:52 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E2049106564A for ; Wed, 2 Apr 2008 08:07:52 +0000 (UTC) (envelope-from fox@verio.net) Received: from dfw-smtpout1.email.verio.net (dfw-smtpout1.email.verio.net [129.250.36.41]) by mx1.freebsd.org (Postfix) with ESMTP id C06378FC15 for ; Wed, 2 Apr 2008 08:07:52 +0000 (UTC) (envelope-from fox@verio.net) Received: from [129.250.36.63] (helo=dfw-mmp3.email.verio.net) by dfw-smtpout1.email.verio.net with esmtp id 1Jgy0e-0000Tl-BD for freebsd-pf@freebsd.org; Wed, 02 Apr 2008 08:07:52 +0000 Received: from [129.250.40.241] (helo=limbo.int.dllstx01.us.it.verio.net) by dfw-mmp3.email.verio.net with esmtp id 1Jgy0e-0003Kx-6f for freebsd-pf@freebsd.org; Wed, 02 Apr 2008 08:07:52 +0000 Received: by limbo.int.dllstx01.us.it.verio.net (Postfix, from userid 1000) id 01B418E296; Wed, 2 Apr 2008 03:07:40 -0500 (CDT) Date: Wed, 2 Apr 2008 03:07:40 -0500 From: David DeSimone To: freebsd-pf@freebsd.org Message-ID: <20080402080740.GA2396@verio.net> Mail-Followup-To: freebsd-pf@freebsd.org References: <88224.68960.qm@web57401.mail.re1.yahoo.com> <20080402063910.GA36819@eos.sc1.parodius.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed Content-Disposition: inline In-Reply-To: <20080402063910.GA36819@eos.sc1.parodius.com> Precedence: bulk User-Agent: Mutt/1.5.9i Subject: Re: PF and State Table X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Apr 2008 08:07:53 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeremy Chadwick wrote: > > This is somewhat risky, because you really don't want to waste a state > entry on something that's half-way in the middle of a TCP session > (well, I suppose you could, but it seems insecure. It's more than just insecure; it can cause breakage of TCP connections, especially in a world where RFC 1323 is commonplace (i.e. today's world). If PF starts tracking state from the middle of a connection, it has missed out on discovering what TCP window scaling factors are in use. If there happens to be no scaling in use, it works fine, but if a scale factor is being applied, PF will not track the state correctly, and the connection will stall out. > > What file in PF on FreeBSD kernel does state table structure is > > located? > > I don't understand this question. I think the question is asking for details on how PF state is stored in memory. I found a very nice struct pf_state in /usr/include/net/pfvar.h. - -- David DeSimone == Network Admin == fox@verio.net "This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, dis- tribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you." --Lawyer Bot 6000 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFH8z7MFSrKRjX5eCoRAk0CAJ9nF+Khgn0JAmAFA9oOaR5iA+hpkgCfTwAO moQSQmUAZCVMhR6tmlaspJc= =uDM8 -----END PGP SIGNATURE-----