Page MenuHomeFreeBSD
Files F105531751

D9894.id27387.diff
No OneTemporary
Actions

D9894.id27387.diff
View Options

Index: head/sys/netinet/tcp_input.c
===================================================================
--- head/sys/netinet/tcp_input.c
+++ head/sys/netinet/tcp_input.c
@@ -1613,6 +1613,16 @@
tcp_pcap_add(th, m, &(tp->t_inpkts));
#endif
+ if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
+ if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
+ log(LOG_DEBUG, "%s; %s: "
+ "SYN|FIN segment ignored (based on "
+ "sysctl setting)\n", s, __func__);
+ free(s, M_TCPLOG);
+ }
+ goto drop;
+ }
+
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.
Index: head/sys/netinet/tcp_stacks/fastpath.c
===================================================================
--- head/sys/netinet/tcp_stacks/fastpath.c
+++ head/sys/netinet/tcp_stacks/fastpath.c
@@ -132,6 +132,8 @@
#define V_tcp_insecure_rst VNET(tcp_insecure_rst)
VNET_DECLARE(int, tcp_insecure_syn);
#define V_tcp_insecure_syn VNET(tcp_insecure_syn)
+VNET_DECLARE(int, drop_synfin);
+#define V_drop_synfin VNET(drop_synfin)
static void tcp_do_segment_fastslow(struct mbuf *, struct tcphdr *,
struct socket *, struct tcpcb *, int, int, uint8_t,
@@ -1729,7 +1731,6 @@
struct tcpopt to;
thflags = th->th_flags;
- tp->sackhint.last_sack_ack = 0;
inc = &tp->t_inpcb->inp_inc;
nsegs = max(1, m->m_pkthdr.lro_nsegs);
/*
@@ -1760,6 +1761,23 @@
KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
__func__));
+ if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
+ if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
+ log(LOG_DEBUG, "%s; %s: "
+ "SYN|FIN segment ignored (based on "
+ "sysctl setting)\n", s, __func__);
+ free(s, M_TCPLOG);
+ }
+ if (ti_locked == TI_RLOCKED) {
+ INP_INFO_RUNLOCK(&V_tcbinfo);
+ }
+ INP_WUNLOCK(tp->t_inpcb);
+ m_freem(m);
+ return;
+ }
+
+ tp->sackhint.last_sack_ack = 0;
+
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.
@@ -2175,7 +2193,6 @@
struct tcpopt to;
thflags = th->th_flags;
- tp->sackhint.last_sack_ack = 0;
inc = &tp->t_inpcb->inp_inc;
/*
* If this is either a state-changing packet or current state isn't
@@ -2205,6 +2222,23 @@
KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
__func__));
+ if ((thflags & TH_SYN) && (thflags & TH_FIN) && V_drop_synfin) {
+ if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
+ log(LOG_DEBUG, "%s; %s: "
+ "SYN|FIN segment ignored (based on "
+ "sysctl setting)\n", s, __func__);
+ free(s, M_TCPLOG);
+ }
+ if (ti_locked == TI_RLOCKED) {
+ INP_INFO_RUNLOCK(&V_tcbinfo);
+ }
+ INP_WUNLOCK(tp->t_inpcb);
+ m_freem(m);
+ return;
+ }
+
+ tp->sackhint.last_sack_ack = 0;
+
/*
* Segment received on connection.
* Reset idle time and keep-alive timer.

File Metadata

Mime Type
text/plain
Expires
Wed, Dec 18, 8:36 AM (14 h, 59 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
15480089
Default Alt Text
D9894.id27387.diff (2 KB)

Event Timeline