PF and State Table

[David DeSimone]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jeremy Chadwick <koitsu at freebsd.org> wrote:
>
> This is somewhat risky, because you really don't want to waste a state
> entry on something that's half-way in the middle of a TCP session
> (well, I suppose you could, but it seems insecure.

It's more than just insecure; it can cause breakage of TCP connections,
especially in a world where RFC 1323 is commonplace (i.e. today's world).

If PF starts tracking state from the middle of a connection, it has
missed out on discovering what TCP window scaling factors are in use. 
If there happens to be no scaling in use, it works fine, but if a scale
factor is being applied, PF will not track the state correctly, and the
connection will stall out.

> > What file in PF on FreeBSD kernel does state table structure is
> > located?
> 
> I don't understand this question.

I think the question is asking for details on how PF state is stored in
memory.  I found a very nice struct pf_state in /usr/include/net/pfvar.h.

- -- 
David DeSimone == Network Admin == fox at verio.net
"This email message is intended for the use of the person to whom
 it has been sent, and may contain information that is confidential
 or legally protected.  If you are not the intended recipient or have
 received this message in error, you are not authorized to copy, dis-
 tribute, or otherwise use this message or its attachments.  Please
 notify the sender immediately by return e-mail and permanently delete
 this message and any attachments.  Verio, Inc. makes no warranty that
 this email is error or virus free.  Thank you."  --Lawyer Bot 6000
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFH8z7MFSrKRjX5eCoRAk0CAJ9nF+Khgn0JAmAFA9oOaR5iA+hpkgCfTwAO
moQSQmUAZCVMhR6tmlaspJc=
=uDM8
-----END PGP SIGNATURE-----