kernel/2949: pf and modulate state fails with some sites

>Number: 2949
>Category: kernel
net
>Environment:

	System      : OpenBSD 3.1
	Architecture: OpenBSD.i386
	Machine     : i386

>Description:

	A pf ruleset using modulate state worked almost perfectly.  The 
	exceptions were few and far between, which is why this took me
	a little while to figure out.  Some sites (Hotmail.com for example)
	seem to react poorly to whatever modulate state does.  This results
	in a packet that the client sends where the sequence number is out 
	of range.  The corresponding RST is ignored, since it's out of range
	too.  Switching the modulate state to a simple keep state seems to
	have resolved the issue.

>How-To-Repeat:

	use a modulate state rule for outbound tcp traffic.  Sign in to a 
	hotmail.com account.  The signin part (with passport) works, but 
	actually getting into the hotmail pages fails.  (everything times out)

>Fix:

	Sorry, not familiar enough with the pf codebase.  

>Release-Note:
Received on Thu Nov 7 16:55:36 2002