[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-pf
Subject:    Re: PF synproxy state =?utf-8?Q?doesn?= =?utf-8?B?4oCZdA==?= negotiate TCP options in 10.2
From:       Kristof Provost <kp () FreeBSD ! org>
Date:       2015-11-25 10:52:18
Message-ID: 20151125105218.GA2469 () vega ! codepro ! be
[Download RAW message or body]

On 2015-11-25 05:36:07 (-0500), J David <j.david.lists@gmail.com> wrote:
> It appears that "synproxy state" rules cause TCPs connection to be
> negotiated without any options except MSS.
> 
...
> Is this behavior intentional?  If so, perhaps it should be mentioned
> on the man page?  If not, should we open a bug report on this?
> 
It's 'intentional' in the sense that it's simply not implemented in pf.
In the synproxy case pf generates the TCP packet from scratch. All
that's implemented there is the MSS option.

I suspect nothing more is implemented because of the complexity. Using
synproxy means there's no communication with the 'real' server until the
connection is (from the outside perspective) established, so pf can't
really know what values to negotiate.

You're right that it'd be good to document this in the man page though.

Regards,
Kristof
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"
[prev in list] [next in list] [prev in thread] [next in thread]