git: c6ae11c1b0d9 - main - tcp md5: improve handling of tcps_sig_err_sigopt counter

The branch main has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb

commit c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-08-31 13:12:54 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-08-31 13:12:54 +0000

    tcp md5: improve handling of tcps_sig_err_sigopt counter
    
    For non listening TCP endpoints, increment the tcps_sig_err_sigopt
    counter when TCP MD5 is not enabled in the TCP connection, but a
    segment containing a TCP MD5 option is received.
    Also increment the counter when using the RACK or BBR stack.
    
    Reported by:            Hannes Elfert
    Reviewed by:            rrs
    MFC after:              1 week
    MFC to:                 stable/14
    MFC to:                 stable/15
    Differential Revision:  https://reviews.freebsd.org/D59249
---
 sys/netinet/tcp_input.c       | 6 ++----
 sys/netinet/tcp_stacks/bbr.c  | 5 +++++
 sys/netinet/tcp_stacks/rack.c | 5 +++++
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 17d20e5e6401..e79f652bcb54 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1579,11 +1579,9 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		to.to_flags &= ~TOF_SACK;
 	}
 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
-	if ((tp->t_flags & TF_SIGNATURE) != 0 &&
-	    (to.to_flags & TOF_SIGNATURE) == 0) {
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
 		TCPSTAT_INC(tcps_sig_err_sigopt);
-		/* XXX: should drop? */
-	}
 #endif
 	/*
 	 * If echoed timestamp is later than the current time,
diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c
index 6697b6ecc7db..4b8267d6b4ed 100644
--- a/sys/netinet/tcp_stacks/bbr.c
+++ b/sys/netinet/tcp_stacks/bbr.c
@@ -11349,6 +11349,11 @@ bbr_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		 */
 		to.to_flags &= ~TOF_SACK;
 	}
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
+		KMOD_TCPSTAT_INC(tcps_sig_err_sigopt);
+#endif
 	/*
 	 * If timestamps were negotiated during SYN/ACK and a
 	 * segment without a timestamp is received, silently drop
diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c
index 3a6a374318ca..4fbb4baa8d38 100644
--- a/sys/netinet/tcp_stacks/rack.c
+++ b/sys/netinet/tcp_stacks/rack.c
@@ -16401,6 +16401,11 @@ rack_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		 */
 		to.to_flags &= ~TOF_SACK;
 	}
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
+		KMOD_TCPSTAT_INC(tcps_sig_err_sigopt);
+#endif
 	if ((tp->t_state >= TCPS_FIN_WAIT_1) &&
 	    (tp->t_flags & TF_GPUTINPROG)) {
 		/*