*** pf.c-DIST Sat Apr 26 13:57:33 2014 --- pf.c Sun May 4 17:52:33 2014 *************** *** 4616,4622 **** struct tcphdr th; u_int32_t seq; struct pf_state_peer *src, *dst; ! u_int8_t dws; int copyback = 0; /* --- 4616,4622 ---- struct tcphdr th; u_int32_t seq; struct pf_state_peer *src, *dst; ! u_int8_t dws, sws; int copyback = 0; /* *************** *** 4650,4661 **** --- 4650,4674 ---- } if (src->wscale && dst->wscale) + { dws = dst->wscale & PF_WSCALE_MASK; + sws = src->wscale & PF_WSCALE_MASK; + } else + { dws = 0; + sws = 0; + } /* Demodulate sequence number */ seq = ntohl(th.th_seq) - src->seqdiff; + + if(icmptype == ICMP6_PACKET_TOO_BIG) + { + printf("th.th_seq=%u, ntohl th.th_seq=%u, src seqdiff=%u\n", + th.th_seq, ntohl(th.th_seq), src->seqdiff); + } + if (src->seqdiff) { pf_change_a(&th.th_seq, icmpsum, htonl(seq), 0); *************** *** 4674,4682 **** printf(" state: "); pf_print_state(*state); printf(" seq=%u\n", seq); } - REASON_SET(reason, PFRES_BADSTATE); - return (PF_DROP); } else { if (V_pf_status.debug >= PF_DEBUG_MISC) { printf("pf: OK ICMP %d:%d ", --- 4687,4702 ---- printf(" state: "); pf_print_state(*state); printf(" seq=%u\n", seq); + printf("src seqhi=%u, src seqlo=%u, dst maxwin=%u, dws=%u, prod=%u\n", + src->seqhi, src->seqlo, dst->max_win, dws, src->seqlo - (dst->max_win << dws)); + printf("src seqhi=%u, src seqlo=%u, src maxwin=%u, sws=%u, prod=%u\n", + src->seqhi, src->seqlo, src->max_win, sws, src->seqlo - (src->max_win << sws)); + } + if(icmptype != ICMP6_PACKET_TOO_BIG) + { + REASON_SET(reason, PFRES_BADSTATE); + return (PF_DROP); } } else { if (V_pf_status.debug >= PF_DEBUG_MISC) { printf("pf: OK ICMP %d:%d ",