The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb
commit c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb Author: Michael Tuexen <[email protected]> AuthorDate: 2026-08-31 13:12:54 +0000 Commit: Michael Tuexen <[email protected]> CommitDate: 2026-08-31 13:12:54 +0000 tcp md5: improve handling of tcps_sig_err_sigopt counter For non listening TCP endpoints, increment the tcps_sig_err_sigopt counter when TCP MD5 is not enabled in the TCP connection, but a segment containing a TCP MD5 option is received. Also increment the counter when using the RACK or BBR stack. Reported by: Hannes Elfert Reviewed by: rrs MFC after: 1 week MFC to: stable/14 MFC to: stable/15 Differential Revision: https://reviews.freebsd.org/D59249 --- sys/netinet/tcp_input.c | 6 ++---- sys/netinet/tcp_stacks/bbr.c | 5 +++++ sys/netinet/tcp_stacks/rack.c | 5 +++++ 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 17d20e5e6401..e79f652bcb54 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -1579,11 +1579,9 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th, to.to_flags &= ~TOF_SACK; } #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) - if ((tp->t_flags & TF_SIGNATURE) != 0 && - (to.to_flags & TOF_SIGNATURE) == 0) { + if ((tp->t_flags & TF_SIGNATURE) == 0 && + (to.to_flags & TOF_SIGNATURE) != 0) TCPSTAT_INC(tcps_sig_err_sigopt); - /* XXX: should drop? */ - } #endif /* * If echoed timestamp is later than the current time, diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c index 6697b6ecc7db..4b8267d6b4ed 100644 --- a/sys/netinet/tcp_stacks/bbr.c +++ b/sys/netinet/tcp_stacks/bbr.c @@ -11349,6 +11349,11 @@ bbr_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th, */ to.to_flags &= ~TOF_SACK; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if ((tp->t_flags & TF_SIGNATURE) == 0 && + (to.to_flags & TOF_SIGNATURE) != 0) + KMOD_TCPSTAT_INC(tcps_sig_err_sigopt); +#endif /* * If timestamps were negotiated during SYN/ACK and a * segment without a timestamp is received, silently drop diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 3a6a374318ca..4fbb4baa8d38 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -16401,6 +16401,11 @@ rack_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th, */ to.to_flags &= ~TOF_SACK; } +#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE) + if ((tp->t_flags & TF_SIGNATURE) == 0 && + (to.to_flags & TOF_SIGNATURE) != 0) + KMOD_TCPSTAT_INC(tcps_sig_err_sigopt); +#endif if ((tp->t_state >= TCPS_FIN_WAIT_1) && (tp->t_flags & TF_GPUTINPROG)) { /*
