On 2015-11-25 05:36:07 (-0500), J David <[email protected]> wrote: > It appears that “synproxy state” rules cause TCPs connection to be > negotiated without any options except MSS. > ... > Is this behavior intentional? If so, perhaps it should be mentioned > on the man page? If not, should we open a bug report on this? > It's 'intentional' in the sense that it's simply not implemented in pf. In the synproxy case pf generates the TCP packet from scratch. All that's implemented there is the MSS option.
I suspect nothing more is implemented because of the complexity. Using synproxy means there's no communication with the 'real' server until the connection is (from the outside perspective) established, so pf can't really know what values to negotiate. You're right that it'd be good to document this in the man page though. Regards, Kristof _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[email protected]"
