diff options
| author | Daniel Hartmeier <dhartmei@cvs.openbsd.org> | 2003-05-16 17:15:18 +0000 |
|---|---|---|
| committer | Daniel Hartmeier <dhartmei@cvs.openbsd.org> | 2003-05-16 17:15:18 +0000 |
| commit | 85e053e7501287b4034b58a3a8435bf906ed929e (patch) | |
| tree | 09f5e7909516434e61974fc7b1e719ed8d2d993e /sbin/pfctl/pfctl_parser.c | |
| parent | d9525b078e57b78143c603ae3eb262ad75798b49 (diff) | |
TCP SYN proxy. Instead of 'keep state' or 'modulate state', one can use
'synproxy state' for TCP connections. pf will complete the TCP handshake
with the active endpoint before passing any packets to the passive end-
point, preventing spoofed SYN floods from reaching the passive endpoint.
No additional memory requirements, no cookies needed, random initial
sequence numbers, uses the existing sequence number modulators to translate
packets after the handshakes.
ok frantzen@
Diffstat (limited to 'sbin/pfctl/pfctl_parser.c')
| -rw-r--r-- | sbin/pfctl/pfctl_parser.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c index af95a4bdcf3..96cb1e496e5 100644 --- a/sbin/pfctl/pfctl_parser.c +++ b/sbin/pfctl/pfctl_parser.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfctl_parser.c,v 1.156 2003/05/14 23:51:29 frantzen Exp $ */ +/* $OpenBSD: pfctl_parser.c,v 1.157 2003/05/16 17:15:17 dhartmei Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -692,6 +692,8 @@ print_rule(struct pf_rule *r, int verbose) printf("keep state "); else if (r->keep_state == PF_STATE_MODULATE) printf("modulate state "); + else if (r->keep_state == PF_STATE_SYNPROXY) + printf("synproxy state "); opts = 0; if (r->max_states) opts = 1; |