mirror of
https://github.com/opnsense/src.git
synced 2026-03-02 05:13:58 -05:00
8e1864ed07
Import OpenBSD's syncookie support for pf. This feature help pf resist TCP SYN floods by only creating states once the remote host completes the TCP handshake rather than when the initial SYN packet is received. This is accomplished by using the initial sequence numbers to encode a cookie (hence the name) in the SYN+ACK response and verifying this on receipt of the client ACK. Reviewed by: kbowling Obtained from: OpenBSD MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31138
25 lines
687 B
Makefile
25 lines
687 B
Makefile
# $FreeBSD$
|
|
|
|
.PATH: ${SRCTOP}/sys/netpfil/pf
|
|
|
|
KMOD= pf
|
|
SRCS= pf.c pf_if.c pf_lb.c pf_osfp.c pf_ioctl.c pf_norm.c pf_table.c \
|
|
pf_ruleset.c pf_nv.c pf_syncookies.c in4_cksum.c \
|
|
bus_if.h device_if.h \
|
|
opt_pf.h opt_inet.h opt_inet6.h opt_bpf.h opt_sctp.h opt_global.h
|
|
|
|
.if !defined(KERNBUILDDIR)
|
|
# pflog can be loaded as a module, have the additional checks turned on
|
|
# pfsync can be loaded as a module, have the additional checks turned on
|
|
opt_pf.h:
|
|
echo "#define DEV_PF 1" > ${.TARGET}
|
|
echo "#define DEV_PFLOG 1" >> ${.TARGET}
|
|
echo "#define DEV_PFSYNC 1" >> ${.TARGET}
|
|
|
|
.if defined(VIMAGE)
|
|
opt_global.h:
|
|
echo "#define VIMAGE 1" >> ${.TARGET}
|
|
.endif
|
|
.endif
|
|
|
|
.include <bsd.kmod.mk>
|