diff options
| author | tuexen <tuexen@FreeBSD.org> | 2017-06-01 08:29:08 +0000 |
|---|---|---|
| committer | tuexen <tuexen@FreeBSD.org> | 2017-06-01 08:29:08 +0000 |
| commit | 8b0c82adf5d60712da23781672d64d5f29c88aca (patch) | |
| tree | 6249d1f2655a267f625e6854c68ef739ec34173e /sys/netinet/tcp_input.c | |
| parent | 5e0e121be6212d776d98e80ff2df076a1f543b5c (diff) | |
| download | FreeBSD-src-8b0c82adf5d60712da23781672d64d5f29c88aca.zip FreeBSD-src-8b0c82adf5d60712da23781672d64d5f29c88aca.tar.gz | |
MFC r316743:
The sysctl variable net.inet.tcp.drop_synfin is not honored in all states,
for example not in SYN-SENT.
This patch adds code to check the sysctl variable in other states than
LISTEN.
Thanks to ae and gnn for providing comments.
Reviewed by: gnn
Differential Revision: https://reviews.freebsd.org/D9894
Diffstat (limited to 'sys/netinet/tcp_input.c')
| -rw-r--r-- | sys/netinet/tcp_input.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 1423796..be461dc 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -1596,6 +1596,16 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so, tcp_pcap_add(th, m, &(tp->t_inpkts)); #endif + if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) { + if ((s = tcp_log_addrs(inc, th, NULL, NULL))) { + log(LOG_DEBUG, "%s; %s: " + "SYN|FIN segment ignored (based on " + "sysctl setting)\n", s, __func__); + free(s, M_TCPLOG); + } + goto drop; + } + /* * Segment received on connection. * Reset idle time and keep-alive timer. |
