Hello,
On Thu, Oct 20, 2016 at 08:45:09PM +0200, Alexander Bluhm wrote:
> On Fri, Sep 30, 2016 at 11:55:48PM +0200, Alexandr Nedvedicky wrote:
> > The patch makes PF to send 'challenge ACK' for SYN packet, which matches
> > session in established state.
>
> regress/sys/net/pf_forward has found a bug in your code. Looks
> like the route-to feature was affected. By splitting the if
> expression and keeping the return (PF_DROP) in the outer block,
> much more packets than before were dropped.
>
thanks for catching that. Now I remember I've deliberately disabled
run-regress-tcp tests. They were failing and failures were standing in
my way to debug challenge_ack.py bits. I've forgot to uncomment them
later in order to investigate those failures.
I've just commit the challenge ACK patch to pf including your fix.
thanks again for catching my bad just in time.
regards
sasha
