mirror of
https://github.com/opnsense/src.git
synced 2026-05-16 02:59:48 -04:00
c3d03672e1
Import OpenBSD's syncookie support for pf. This feature help pf resist
TCP SYN floods by only creating states once the remote host completes
the TCP handshake rather than when the initial SYN packet is received.
This is accomplished by using the initial sequence numbers to encode a
cookie (hence the name) in the SYN+ACK response and verifying this on
receipt of the client ACK.
Reviewed by: kbowling
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Modirum MDPay
Differential Revision: https://reviews.freebsd.org/D31138
(cherry picked from commit 8e1864ed07)
25 lines
687 B
Makefile
25 lines
687 B
Makefile
# $FreeBSD$
|
|
|
|
.PATH: ${SRCTOP}/sys/netpfil/pf
|
|
|
|
KMOD= pf
|
|
SRCS= pf.c pf_if.c pf_lb.c pf_osfp.c pf_ioctl.c pf_norm.c pf_table.c \
|
|
pf_ruleset.c pf_nv.c pf_syncookies.c in4_cksum.c \
|
|
bus_if.h device_if.h \
|
|
opt_pf.h opt_inet.h opt_inet6.h opt_bpf.h opt_sctp.h opt_global.h
|
|
|
|
.if !defined(KERNBUILDDIR)
|
|
# pflog can be loaded as a module, have the additional checks turned on
|
|
# pfsync can be loaded as a module, have the additional checks turned on
|
|
opt_pf.h:
|
|
echo "#define DEV_PF 1" > ${.TARGET}
|
|
echo "#define DEV_PFLOG 1" >> ${.TARGET}
|
|
echo "#define DEV_PFSYNC 1" >> ${.TARGET}
|
|
|
|
.if defined(VIMAGE)
|
|
opt_global.h:
|
|
echo "#define VIMAGE 1" >> ${.TARGET}
|
|
.endif
|
|
.endif
|
|
|
|
.include <bsd.kmod.mk>
|