Finish the r244185. This fixes ever growing counter of pfsync bad

length packets, which was actually harmless.

Note that peers with different version of head/ may grow this
counter, but it is harmless - all pfsync data is processed.

Reported & tested by:	Anton Yuzhaninov <citrin citrin.ru>
Sponsored by:		Nginx, Inc

2 files changed, 1 insertions, 14 deletions

diff --git a/sys/net/if_pfsync.h b/sys/net/if_pfsync.h
index a84a0b8..29d4b23 100644
--- a/sys/net/if_pfsync.h
+++ b/sys/net/if_pfsync.h
@@ -67,8 +67,6 @@
 #define	PFSYNC_ACT_EOF		12	/* end of frame */
 #define	PFSYNC_ACT_MAX		13
 
-#define	PFSYNC_HMAC_LEN	20
-
 /*
  * A pfsync frame is built from a header followed by several sections which
  * are all prefixed with their own subheaders. Frames must be terminated with
@@ -205,18 +203,8 @@ struct pfsync_tdb {
 	u_int8_t			_pad[2];
 } __packed;
 
-/*
- * EOF
- */
-
-struct pfsync_eof {
-	u_int8_t			hmac[PFSYNC_HMAC_LEN];
-} __packed;
-
 #define	PFSYNC_HDRLEN		sizeof(struct pfsync_header)
 
-
-
 /*
  * Names for PFSYNC sysctl objects
  */
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 141ee6d..93f0729 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -99,8 +99,7 @@ __FBSDID("$FreeBSD$");
 #define PFSYNC_MINPKT ( \
 	sizeof(struct ip) + \
 	sizeof(struct pfsync_header) + \
-	sizeof(struct pfsync_subheader) + \
-	sizeof(struct pfsync_eof))
+	sizeof(struct pfsync_subheader) )
 
 struct pfsync_pkt {
 	struct ip *ip;