From nobody Mon Nov 02 16:08:18 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jJGpJ3prZz6xvjd for ; Mon, 02 Nov 2026 16:08:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jJGpJ1BGWz4gWV for ; Mon, 02 Nov 2026 16:08:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793635704; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deVAtdfIuZQ9eZSBke7pNfB3SEO9hsQa5c57B5dH7w0=; b=W8pZlIh6NFiVFdOossagaKu1TAQqdQaRsNPYnZHxvumADixIZtSMUDMhhDwSYScO7pz3bE ADwJJnE1pnNV3S6ZHPnm/GCH6j+IS5OJQJIEron7LLe2+wiBWb3J20SdCC3XoSA7c6ztUp 9t9uz4OL617RPlEteS4Fxy943eQyT6ctJgcbr88pVw8UlrqTGjW1sx7gehYq4rgZ/C/E3z ExQZ9825Gy7G3Fa9j14yLuAQhkRzR9Vl5wIQUAFwK98n9TbTE8aCzSYu/lDYjCbPCIRadC vxE5AqTkjb1ExC4xvhhIq6Hr6IypCma2dgf/+5ESAyY5qxaeA7dcALF2l6NqRg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793635704; b=C+JSGHowRQ8fp96CchkmJ5LGZy1V+p0c8TEx+g6gyYv0OKWaW8DbyV5C4Zkvb790L9Guev Kj77pU/DwFR8i74hD1IK/f3J3LzHhavhf6hhthC2BmPfWsRNNjQeQXWhJytT+m4stozpZW NjoOHWSNAdjLsEn7W52izzvFNi6ZEXM/EtBxziVklLUE+GD1TVEcVAaOpZAlsbC8r4nA0R KWBIuNkyMgM0YKDjusbbEKfQlPC88hySjOi/SeVIpw2AeD2Ey4SaUJFG+pilCuQXca+cRs gBBgKxgye2gsoZMgzrAxBSU3uMUz6iaOzWGS9+rjiRsz1yMK3sXhHIGg3AvJBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793635704; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deVAtdfIuZQ9eZSBke7pNfB3SEO9hsQa5c57B5dH7w0=; b=Cyb8rn+pFYI/97CQm7UCf9ERdf59FqhZummN9dgBF7OiwqWAeJWNYw7BASAy6j29sIdv1b y/SpyRWIF/mGa6PBlkNs7lwpi5iN5wA83kH0cfKPl4pNvfzEYZTbb3fGiLeRhJWtgIEDUI aQRETw4kVbTta3n1b4FwCyCulj1BOAnJUeWu/imqQmvxpKIrtRxkg/JyF5iTSQN0pjbQP8 td4HILVTk/heXsF5/AJFUrhLtYoREu/kpKwQhkKt2qQz8d206Z9mvmepBPObGQ9VfbHZj5 V2nvsnPjnqFJ1gh3HgU9TVmqqelKi91zHk+FnnOO4wN4iltNplTOxQPlmLo+zg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jJGpJ0rtpzsF0 for ; Mon, 02 Nov 2026 16:08:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46d7c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 02 Nov 2026 16:08:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: a94d4deae39b - stable/15 - pf: allows TCP RST packets in the backwards window if ACK matches List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a94d4deae39b56390ad910d4f4adc311ec330b51 Auto-Submitted: auto-generated Date: Mon, 02 Nov 2026 16:08:18 +0000 Message-Id: <6ae8b572.46d7c.6d373d26@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a94d4deae39b56390ad910d4f4adc311ec330b51 commit a94d4deae39b56390ad910d4f4adc311ec330b51 Author: Kristof Provost AuthorDate: 2025-08-25 13:49:22 +0000 Commit: Kristof Provost CommitDate: 2026-11-02 16:05:29 +0000 pf: allows TCP RST packets in the backwards window if ACK matches TCP reset packets are generated for the sequence numbers that have been acknowledged. Our pf(4) is quite strict regarding sequence numbers of reset packets to avoid evil connection drops. It expected exact match and did not allow a sequence window for resets. As pf tracks neither gaps in the sequence space nor the acknowledged data, it does not know where exactly the reset is expected by the TCP stack. Problem was that legit reset packets before a gap but not at the highest sequence numbers were blocked by pf. Solution is to fix pf_tcp_track_full(). Now it allows sequence number windows if the packet has ACK+RST flags set and the acknowlege number matches perfectly. This still prevents reset number guessing by an attacker. Curiously the TCP stack behaves correctly and accepts only resets before the gap. pf only allowed resets after the final data. So any reset was ignored by the system. When the other side processed the challenge ACK, the situation could be fixed. bug reported and fix tested by Lucas Aubard with Johan Mazel, Gilles Guette and Pierre Chifflier; OK sashan@ Obtained from: OpenBSD, bluhm , 12e4c257ea Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit fc63421de9f69ed67aad7bae29712fca2f570693) --- sys/netpfil/pf/pf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 021132e900a5..0f6636381ac9 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -6816,8 +6816,12 @@ pf_tcp_track_full(struct pf_kstate *state, struct pf_pdesc *pd, (ackskew <= (MAXACKWINDOW << sws)) && /* Acking not more than one window forward */ ((tcp_get_flags(th) & TH_RST) == 0 || orig_seq == src->seqlo || - (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) { + (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) || /* Require an exact/+1 sequence match on resets when possible */ + (SEQ_GEQ(orig_seq, src->seqlo - (dst->max_win << dws)) && + SEQ_LEQ(orig_seq, src->seqlo + 1) && ackskew == 0 && + (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)))) { + /* Allow resets to match sequence window if ack is perfect match */ if (dst->scrub || src->scrub) { if (pf_normalize_tcp_stateful(pd, reason, th,