mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
pf: remove incorrect fragmentation check
We do not need to check PFDESC_IP_REAS while tracking TCP state. Moreover, this check incorrectly considers no-data packets (e.g. RST) to be in-window when this flag is not set. Sponsored by: Rubicon Communications, LLC ("Netgate") Approved by: so Security: FreeBSD-SA-23:17.pf
This commit is contained in:
parent
62d47a4db4
commit
6284d5f76d
|
@ -5367,8 +5367,7 @@ pf_tcp_track_full(struct pf_kstate **state, struct pfi_kkif *kif,
|
|||
(ackskew <= (MAXACKWINDOW << sws)) &&
|
||||
/* Acking not more than one window forward */
|
||||
((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
|
||||
(orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
|
||||
(pd->flags & PFDESC_IP_REAS) == 0)) {
|
||||
(orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) {
|
||||
/* Require an exact/+1 sequence match on resets when possible */
|
||||
|
||||
if (dst->scrub || src->scrub) {
|
||||
|
|
Loading…
Reference in a new issue