diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c index e19f0956fad7..88b2c5e7cc64 100644 --- a/sys/netinet/tcp_syncache.c +++ b/sys/netinet/tcp_syncache.c @@ -906,11 +906,14 @@ syncache_expand(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th, goto failed; } /* - * The SEQ must match the received initial receive sequence - * number + 1 (the SYN) because we didn't ACK any data that - * may have come with the SYN. + * The SEQ must fall in the window starting a the received initial receive + * sequence number + 1 (the SYN). */ - if (th->th_seq != sc->sc_irs + 1 && !TOEPCB_ISSET(sc)) { + + if ((SEQ_LEQ(th->th_seq, sc->sc_irs) || + SEQ_GT(th->th_seq, sc->sc_irs + sc->sc_wnd )) && + !TOEPCB_ISSET(sc)) + { if ((s = tcp_log_addrs(inc, th, NULL, NULL))) log(LOG_DEBUG, "%s; %s: SEQ %u != IRS+1 %u, segment " "rejected\n", s, __func__, th->th_seq, sc->sc_irs);