Date: Sun, 18 Nov 2018 10:47:37 +0000 (UTC) From: Kristof Provost <kp@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r340558 - stable/12/sys/netpfil/pf Message-ID: <201811181047.wAIAlbx9006659@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kp Date: Sun Nov 18 10:47:36 2018 New Revision: 340558 URL: https://svnweb.freebsd.org/changeset/base/340558 Log: MFC r339470: pf synproxy will do the 3WHS on behalf of the target machine, and once the 3WHS is completed, establish the backend connection. The trigger for "3WHS completed" is the reception of the first ACK. However, we should not proceed if that ACK also has RST or FIN set. PR: 197484 Obtained from: OpenBSD Modified: stable/12/sys/netpfil/pf/pf.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/netpfil/pf/pf.c ============================================================================== --- stable/12/sys/netpfil/pf/pf.c Sun Nov 18 10:22:42 2018 (r340557) +++ stable/12/sys/netpfil/pf/pf.c Sun Nov 18 10:47:36 2018 (r340558) @@ -4401,7 +4401,7 @@ pf_test_state_tcp(struct pf_state **state, int directi TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 0, NULL); REASON_SET(reason, PFRES_SYNPROXY); return (PF_SYNPROXY_DROP); - } else if (!(th->th_flags & TH_ACK) || + } else if ((th->th_flags & (TH_ACK|TH_RST|TH_FIN)) != TH_ACK || (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { REASON_SET(reason, PFRES_SYNPROXY);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201811181047.wAIAlbx9006659>