From nobody Sat Oct 31 16:24:40 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jH3G30k5xz6wsSf for ; Sat, 31 Oct 2026 16:24:43 +0000 (UTC) (envelope-from freebsd@omnilan.de) Received: from mx0.gentlemail.de (mx0.gentlemail.de [IPv6:2001:41d0:700:4a43:a25:de0:0:13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jH3G23Q5nz4d3S; Sat, 31 Oct 2026 16:24:42 +0000 (UTC) (envelope-from freebsd@omnilan.de) Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of freebsd@omnilan.de designates 2001:41d0:700:4a43:a25:de0:0:13 as permitted sender) smtp.mailfrom=freebsd@omnilan.de Received: from mh0.gentlemail.de (mh0.gentlemail.de [135.125.173.218]) by mx0.gentlemail.de (8.18.1/8.18.1) with ESMTP id 69VGOeZD074368; Sat, 31 Oct 2026 16:24:40 GMT (envelope-from freebsd@omnilan.de) Received: from [172.21.35.3] (s1.omnilan.de [217.91.127.234]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mh0.gentlemail.de (Postfix) with ESMTPSA id 7C74E1A9A6; Sat, 31 Oct 2026 16:24:40 +0000 (UTC) Message-ID: Date: Sat, 31 Oct 2026 17:24:40 +0100 List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: git: fc63421de9f6 - main - pf: allows TCP RST packets in the backwards window if ACK matches To: Kristof Provost , dev-commits-src-all@FreeBSD.org References: <202509171415.58HEFkFC010352@gitrepo.freebsd.org> Content-Language: en-US, de-DE From: Harry Schmalzbauer Organization: OmniLAN In-Reply-To: <202509171415.58HEFkFC010352@gitrepo.freebsd.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4jH3G23Q5nz4d3S X-Spamd-Bar: / X-Spamd-Result: default: False [-0.30 / 15.00]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_VIA_SMTP_AUTH(0.00)[]; ASN(0.00)[asn:16276, ipnet:2001:41d0::/32, country:FR]; ARC_NA(0.00)[]; HAS_ORG_HEADER(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; R_DKIM_NA(0.00)[]; MLMMJ_DEST(0.00)[dev-commits-src-all@FreeBSD.org]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DMARC_NA(0.00)[omnilan.de]; RCVD_TLS_LAST(0.00)[]; MIME_TRACE(0.00)[0:+] On 2025-09-17 16:15, Kristof Provost wrote: > The branch main has been updated by kp: > > URL: https://cgit.FreeBSD.org/src/commit/?id=fc63421de9f69ed67aad7bae29712fca2f570693 > > commit fc63421de9f69ed67aad7bae29712fca2f570693 > Author: Kristof Provost > AuthorDate: 2025-08-25 13:49:22 +0000 > Commit: Kristof Provost > CommitDate: 2025-09-17 14:15:15 +0000 > > pf: allows TCP RST packets in the backwards window if ACK matches > > TCP reset packets are generated for the sequence numbers that have > been acknowledged. Our pf(4) is quite strict regarding sequence > numbers of reset packets to avoid evil connection drops. It expected > exact match and did not allow a sequence window for resets. As pf > tracks neither gaps in the sequence space nor the acknowledged data, > it does not know where exactly the reset is expected by the TCP > stack. > > Problem was that legit reset packets before a gap but not at the > highest sequence numbers were blocked by pf. Solution is to fix > pf_tcp_track_full(). Now it allows sequence number windows if the > packet has ACK+RST flags set and the acknowlege number matches > perfectly. This still prevents reset number guessing by an attacker. > > Curiously the TCP stack behaves correctly and accepts only resets > before the gap. pf only allowed resets after the final data. So > any reset was ignored by the system. When the other side processed > the challenge ACK, the situation could be fixed. > > bug reported and fix tested by Lucas Aubard with Johan Mazel, Gilles > Guette and Pierre Chifflier; OK sashan@ > > Obtained from: OpenBSD, bluhm , 12e4c257ea > Sponsored by: Rubicon Communications, LLC ("Netgate") Hello, is guess this is a desirable MFC candidate for 15.2, is it? Thanks, -harry