>Number:         8604
>Category:       kern
>Synopsis:       ipf prematurely expires connections
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 10 17:18:00 1999
>Last-Modified:
>Originator:     Charles M. Hannum
>Organization:
        The NetBSD Mission
>Release:        -current
>Environment:
        n/a

>Description:
        When ipf adds new state for a TCP connection, it initializes
        the state to TCPS_CLOSED.  This is not changed when an
        ACK-only packet is received; thus, when an ipf `keep state'
        rule is activated while a connection is already active, the
        connection is expired prematurely.

>How-To-Repeat:
        With no ipf rules, establish an outgoing connection.  Then add
        a rule like:

	pass out quick on ppp0 proto tcp/udp all keep state

	Now make the connection non-idle somehow.  With `ipfstat -s',
	note that the state is initialized to `ttl 60 state 0/0'.

>Fix:
        Should be a trivial change to the state machine in
        fr_tcp_age().

>Audit-Trail:
>Unformatted: