I haven't verified PF, but it seems that it wasn't even tested. My guess is that PF is not vulnerable because PF has a pretty good understanding of how TCP works. For example, it can do SYN proxying, where PF talks to each side itself rather than just blindly forwarding things through the firewall:
"Normally when a client initiates a TCP connection to a server, PF will pass the handshake packets between the two endpoints as they arrive. PF has the ability, however, to proxy the handshake. With the handshake proxied, PF itself will complete the handshake with the client, initiate a handshake with the server, and then pass packets between the two. The benefit of this process is that no packets are sent to the server before the client completes the handshake. This eliminates the threat of spoofed TCP SYN floods affecting the server because a spoofed client connection will be unable to complete the handshake. "
Comments
Does this affect the OpenBSD packet filter (PF) at all? Should I be concerned if I am using PF as my firewall of choice?
I haven't verified PF, but it seems that it wasn't even tested. My guess is that PF is not vulnerable because PF has a pretty good understanding of how TCP works. For example, it can do SYN proxying, where PF talks to each side itself rather than just blindly forwarding things through the firewall:
"Normally when a client initiates a TCP connection to a server, PF will pass the handshake packets between the two endpoints as they arrive. PF has the ability, however, to proxy the handshake. With the handshake proxied, PF itself will complete the handshake with the client, initiate a handshake with the server, and then pass packets between the two. The benefit of this process is that no packets are sent to the server before the client completes the handshake. This eliminates the threat of spoofed TCP SYN floods affecting the server because a spoofed client connection will be unable to complete the handshake. "