git: 9ea8d692f4cb - main - ipfw: use only needed TCP flags for state tracking

The branch main has been updated by ae:

URL: https://cgit.FreeBSD.org/src/commit/?id=9ea8d692f4cb552902b9e8394260d7f3cf4aefb0

commit 9ea8d692f4cb552902b9e8394260d7f3cf4aefb0
Author:     Andrey V. Elsukov <ae@FreeBSD.org>
AuthorDate: 2024-12-12 12:57:45 +0000
Commit:     Andrey V. Elsukov <ae@FreeBSD.org>
CommitDate: 2024-12-12 12:57:45 +0000

    ipfw: use only needed TCP flags for state tracking
    
    This fixes stateful firewall failures  after adding TH_AE flag
    into TH_FLAGS.
    
    Reported by:    ronald
    Fixes:          347dd05
    MFC after:      2 weeks
---
 sys/netpfil/ipfw/ip_fw_dynamic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfw/ip_fw_dynamic.c b/sys/netpfil/ipfw/ip_fw_dynamic.c
index 34aae71c174b..ff55e3360c13 100644
--- a/sys/netpfil/ipfw/ip_fw_dynamic.c
+++ b/sys/netpfil/ipfw/ip_fw_dynamic.c
@@ -920,7 +920,8 @@ print_dyn_rule_flags(const struct ipfw_flow_id *id, int dyn_type,
 #define	_SEQ_GE(a,b)	((int)((a)-(b)) >= 0)
 #define	BOTH_SYN	(TH_SYN | (TH_SYN << 8))
 #define	BOTH_FIN	(TH_FIN | (TH_FIN << 8))
-#define	TCP_FLAGS	(TH_FLAGS | (TH_FLAGS << 8))
+#define	BOTH_RST	(TH_RST | (TH_RST << 8))
+#define	TCP_FLAGS	(BOTH_SYN | BOTH_FIN | BOTH_RST)
 #define	ACK_FWD		0x00010000	/* fwd ack seen */
 #define	ACK_REV		0x00020000	/* rev ack seen */
 #define	ACK_BOTH	(ACK_FWD | ACK_REV)