pf: Prevent pf dropping TCP state with crafted reset packet.HEADmain

Revision 1.1212 of pf.c weakened the TCP reset check in stateful
connection tracking to let legitimate resets pass in the backwards
window.  Such a reset is accepted only if its acknowledgment number
matches perfectly.  But as a workaround for broken stacks, pf
replaces an acknowledgment number of 0 in a reset with the tracked
sequence of the peer.  Then the perfect match always succeeds, and
an attacker can spoof resets more easily than intended.  Use the
acknowledgment number from the wire, before the workaround has
modified it.

discovered by Minghao Zhang; OK sashan@

Obtained from:	OpenBSD, bluhm <bluhm@openbsd.org>, 1e0a1f4b82
Sponsored by:	Rubicon Communications, LLC ("Netgate")

0 files changed, 0 insertions, 0 deletions