Firewall : Advanced - Add support for syncookies

[AdSchellevis]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

Our friends from Modirum sponsored the inclusion of TCP syncookies for pf [1] which originates from OpenBSD [2] and has proven to be a highly effective tool against DDos attacks.

The option is quite similar to the syncookies [3] kernel setting, preventing memory allocation for local services before a proper handshake is made. In this case pf will be protected agains state table exhaustion.

Describe the solution you like

Add the option to enable syncookies in Firewall: Settings: Advanced, which offers 3 options:

1. never (default)
2. always
3. adaptive - in which case a lower and upper percentage should be specified referring to the usage of the state table.

Additional context

1. https://reviews.freebsd.org/D31138
2. https://undeadly.org/cgi?action=article;sid=20180207090000
3. https://www.freebsd.org/cgi/man.cgi?syncookies