git: 6fa319d8c670 - stable/15 - tcp md5: fix accounting for SYN segments with unexpected signature

The branch stable/15 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=6fa319d8c6702bb7dc01435e8ae8e90a6259b90e

commit 6fa319d8c6702bb7dc01435e8ae8e90a6259b90e
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2026-09-04 07:18:10 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2026-10-23 17:36:36 +0000

    tcp md5: fix accounting for SYN segments with unexpected signature
    
    When receiving a SYN segment with an MD5 option on a listening socket,
    which has not enabled TCP MD5 support, increment the counter for
    unexpected signatures (tcps_sig_err_sigopt).
    
    Reviewed by:            rscheff
    Differential Revision:  https://reviews.freebsd.org/D59303
    
    (cherry picked from commit 5d3e31df7c4fc0e53168bac717bed5f94dab7068)
---
 sys/netinet/tcp_syncache.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index e655b7d9c9f9..7c1c1f95856a 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1497,8 +1497,10 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 			    TCPMD5_INPUT(m, NULL, NULL) != ENOENT)
 				goto done;
 		}
-	} else if (to->to_flags & TOF_SIGNATURE)
+	} else if (to->to_flags & TOF_SIGNATURE) {
+		TCPSTAT_INC(tcps_sig_err_sigopt);
 		goto done;
+	}
 #endif	/* TCP_SIGNATURE */
 	/*
 	 * See if we already have an entry for this connection.