From nobody Mon Nov 02 16:08:18 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jJGpB6Z6gz6xvMs for ; Mon, 02 Nov 2026 16:08:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jJGpB64ZJz4gWD for ; Mon, 02 Nov 2026 16:08:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793635698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deVAtdfIuZQ9eZSBke7pNfB3SEO9hsQa5c57B5dH7w0=; b=OTDCUmGz1OqxiqqCJGFLv92TRue4OOfKx/MWRhZW193OlNL26pYaovEvXYPmFH5sEDC5St IIR4D1HtUhLq2/GdPbNf4dcJh93ngIPHdNXHIy/sBun3nBhPhXMOmCHIpPTk1s1JmLFT8a y7pm+m2v2oGxG7L98HJqiw0ThrgjC1SUloWt4vOQsbrC5Vw+7GpfLI/V64DLXsZZENC6dF 9ANk2eGZUm9JXEbl8EAA0owz6hW0JfP3aDuMKyGWg66PytakkA1vdM0DnV1S2RoEQShBPv 7WDpoVwdPgobZJHGdtFTVOiYKjpf5tKmT9+P8e++jAj0oR1Tndd3R7jUUlWCgw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793635698; b=IEm6IQbfT6kBeot1xXtTtIt/F1jxvHx1Kouj1a0lhRTyzZXE2a/3K427grlFVaAOwO35jH ooQT6f+KLmCwqYvmHR1NzAc4YczBbd55E2T/c3zM/v3ykmRQuFfYO7Whw0IriQbzppPBQe rU0n4o7U8CkIpraTwm8F7B8bPJZBaJHEqlSju56dte0nW95EnnBR9syuwPrkEgCWNLhW83 bO++/sEW9s60VG9Zcd7zDSo7twwD0PtiJYNKzPz94azEWvKcGRsz/CJhTi1zzpuFW8vVcZ gOlVPiE4lWgdgmlyXk2z+W8t8zFmwBLtzO8Ym+6q/qytV6PP+e9Cst9O7QBXtQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793635698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=deVAtdfIuZQ9eZSBke7pNfB3SEO9hsQa5c57B5dH7w0=; b=EFPml999CXqainTHqhUiM8hnVInDcrmV2BWvpxVeTX1DIDk4EynPyRbC/QLNf95XmLSWhB PinVA6Es8ltj7GCOMKJbc51froYut0thth6Pv3SJsbRZnS71sOXJvLbbtUgWGCtLlIlv2D 1q7DJHvs8xtIrhDqo33Cy/+QAQLD7tXuJZDuV6rOqMUyzD0baKw40ueCE+3kTTbFn8Nj+F zyJRfy5Pq7Jkeeq4E7MCfho5zRYbYgSX8G0l35Iq+qdJu+OYac2echs0xKO/wpf/+q+Q0u o42v06DmNLW39yaO3BGQYFr0TPBYtOwFMGwxt+SPv8JcGhCp7VnG9m5taDPDpA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jJGpB5klvzs89 for ; Mon, 02 Nov 2026 16:08:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46d7c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 02 Nov 2026 16:08:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: a94d4deae39b - stable/15 - pf: allows TCP RST packets in the backwards window if ACK matches List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a94d4deae39b56390ad910d4f4adc311ec330b51 Auto-Submitted: auto-generated Date: Mon, 02 Nov 2026 16:08:18 +0000 Message-Id: <6ae8b572.46d7c.6d373d26@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a94d4deae39b56390ad910d4f4adc311ec330b51 commit a94d4deae39b56390ad910d4f4adc311ec330b51 Author: Kristof Provost AuthorDate: 2025-08-25 13:49:22 +0000 Commit: Kristof Provost CommitDate: 2026-11-02 16:05:29 +0000 pf: allows TCP RST packets in the backwards window if ACK matches TCP reset packets are generated for the sequence numbers that have been acknowledged. Our pf(4) is quite strict regarding sequence numbers of reset packets to avoid evil connection drops. It expected exact match and did not allow a sequence window for resets. As pf tracks neither gaps in the sequence space nor the acknowledged data, it does not know where exactly the reset is expected by the TCP stack. Problem was that legit reset packets before a gap but not at the highest sequence numbers were blocked by pf. Solution is to fix pf_tcp_track_full(). Now it allows sequence number windows if the packet has ACK+RST flags set and the acknowlege number matches perfectly. This still prevents reset number guessing by an attacker. Curiously the TCP stack behaves correctly and accepts only resets before the gap. pf only allowed resets after the final data. So any reset was ignored by the system. When the other side processed the challenge ACK, the situation could be fixed. bug reported and fix tested by Lucas Aubard with Johan Mazel, Gilles Guette and Pierre Chifflier; OK sashan@ Obtained from: OpenBSD, bluhm , 12e4c257ea Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit fc63421de9f69ed67aad7bae29712fca2f570693) --- sys/netpfil/pf/pf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 021132e900a5..0f6636381ac9 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -6816,8 +6816,12 @@ pf_tcp_track_full(struct pf_kstate *state, struct pf_pdesc *pd, (ackskew <= (MAXACKWINDOW << sws)) && /* Acking not more than one window forward */ ((tcp_get_flags(th) & TH_RST) == 0 || orig_seq == src->seqlo || - (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) { + (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) || /* Require an exact/+1 sequence match on resets when possible */ + (SEQ_GEQ(orig_seq, src->seqlo - (dst->max_win << dws)) && + SEQ_LEQ(orig_seq, src->seqlo + 1) && ackskew == 0 && + (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)))) { + /* Allow resets to match sequence window if ack is perfect match */ if (dst->scrub || src->scrub) { if (pf_normalize_tcp_stateful(pd, reason, th,