git: 3d5546429b99 - stable/15 - tcp md5: improve handling of tcps_sig_err_sigopt counter

The branch stable/15 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=3d5546429b996626238498da78ebff79580595ee

commit 3d5546429b996626238498da78ebff79580595ee
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-08-31 13:12:54 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-10-23 17:35:37 +0000

    tcp md5: improve handling of tcps_sig_err_sigopt counter
    
    For non listening TCP endpoints, increment the tcps_sig_err_sigopt
    counter when TCP MD5 is not enabled in the TCP connection, but a
    segment containing a TCP MD5 option is received.
    Also increment the counter when using the RACK or BBR stack.
    
    Reported by:            Hannes Elfert
    Reviewed by:            rrs
    Differential Revision:  https://reviews.freebsd.org/D59249
    
    (cherry picked from commit c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb)
---
 sys/netinet/tcp_input.c       | 6 ++----
 sys/netinet/tcp_stacks/bbr.c  | 5 +++++
 sys/netinet/tcp_stacks/rack.c | 5 +++++
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index a1786952741e..f47e60bede8c 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1606,11 +1606,9 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		to.to_flags &= ~TOF_SACK;
 	}
 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
-	if ((tp->t_flags & TF_SIGNATURE) != 0 &&
-	    (to.to_flags & TOF_SIGNATURE) == 0) {
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
 		TCPSTAT_INC(tcps_sig_err_sigopt);
-		/* XXX: should drop? */
-	}
 #endif
 	/*
 	 * If echoed timestamp is later than the current time,
diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c
index f2d7867df9b4..1bd87ad9bc31 100644
--- a/sys/netinet/tcp_stacks/bbr.c
+++ b/sys/netinet/tcp_stacks/bbr.c
@@ -11354,6 +11354,11 @@ bbr_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		 */
 		to.to_flags &= ~TOF_SACK;
 	}
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
+		KMOD_TCPSTAT_INC(tcps_sig_err_sigopt);
+#endif
 	/*
 	 * If timestamps were negotiated during SYN/ACK and a
 	 * segment without a timestamp is received, silently drop
diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c
index 86ea34f46a05..91aa589bce74 100644
--- a/sys/netinet/tcp_stacks/rack.c
+++ b/sys/netinet/tcp_stacks/rack.c
@@ -16336,6 +16336,11 @@ rack_do_segment_nounlock(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 		 */
 		to.to_flags &= ~TOF_SACK;
 	}
+#if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
+	if ((tp->t_flags & TF_SIGNATURE) == 0 &&
+	    (to.to_flags & TOF_SIGNATURE) != 0)
+		KMOD_TCPSTAT_INC(tcps_sig_err_sigopt);
+#endif
 	if ((tp->t_state >= TCPS_FIN_WAIT_1) &&
 	    (tp->t_flags & TF_GPUTINPROG)) {
 		/*