diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 25d08af76ffc..b0391c87f854 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -318,7 +318,7 @@ enum { PF_ICMP_MULTI_NONE, PF_ICMP_MULTI_SOLICITED, PF_ICMP_MULTI_LINK }; #define STATE_LOOKUP(i, k, d, s, pd) \ do { \ (s) = pf_find_state((i), (k), (d)); \ - if ((s) == NULL || (s)->timeout == PFTM_PURGE) \ + if ((s) == NULL) \ return (PF_DROP); \ if (PACKET_LOOPED(pd)) \ return (PF_PASS); \ @@ -1230,11 +1230,11 @@ pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir) if (s->kif == V_pfi_all || s->kif == kif) { PF_STATE_LOCK(s); PF_HASHROW_UNLOCK(kh); - if (s->timeout == PFTM_UNLINKED) { + if (s->timeout >= PFTM_MAX) { /* - * State is being processed - * by pf_unlink_state() in - * an other thread. + * State is either being processed by + * pf_unlink_state() in an other thread, or + * is scheduled for immediate expiry. */ PF_STATE_UNLOCK(s); return (NULL);