From owner-svn-src-all@freebsd.org  Tue Jun 25 13:28:20 2019
Return-Path: <owner-svn-src-all@freebsd.org>
Delivered-To: svn-src-all@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7E82115CCA65;
 Tue, 25 Jun 2019 13:28:20 +0000 (UTC)
 (envelope-from freebsd@gndrsh.dnsmgr.net)
Received: from gndrsh.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id EFA738B304;
 Tue, 25 Jun 2019 13:28:19 +0000 (UTC)
 (envelope-from freebsd@gndrsh.dnsmgr.net)
Received: from gndrsh.dnsmgr.net (localhost [127.0.0.1])
 by gndrsh.dnsmgr.net (8.13.3/8.13.3) with ESMTP id x5PDSIEb049621;
 Tue, 25 Jun 2019 06:28:18 -0700 (PDT)
 (envelope-from freebsd@gndrsh.dnsmgr.net)
Received: (from freebsd@localhost)
 by gndrsh.dnsmgr.net (8.13.3/8.13.3/Submit) id x5PDSIZV049620;
 Tue, 25 Jun 2019 06:28:18 -0700 (PDT) (envelope-from freebsd)
From: "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net>
Message-Id: <201906251328.x5PDSIZV049620@gndrsh.dnsmgr.net>
Subject: Re: svn commit: r349366 - head/sys/netpfil/ipfw
In-Reply-To: <201906251140.x5PBectm030416@repo.freebsd.org>
To: "Andrey V. Elsukov" <ae@freebsd.org>
Date: Tue, 25 Jun 2019 06:28:18 -0700 (PDT)
CC: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Reply-To: rgrimes@freebsd.org
X-Mailer: ELM [version 2.4ME+ PL121h (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
X-Rspamd-Queue-Id: EFA738B304
X-Spamd-Bar: ------
Authentication-Results: mx1.freebsd.org
X-Spamd-Result: default: False [-6.93 / 15.00];
 NEURAL_HAM_MEDIUM(-1.00)[-1.000,0];
 NEURAL_HAM_SHORT(-0.93)[-0.929,0]; REPLY(-4.00)[];
 NEURAL_HAM_LONG(-1.00)[-1.000,0]
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all/>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Jun 2019 13:28:20 -0000

> Author: ae
> Date: Tue Jun 25 11:40:37 2019
> New Revision: 349366
> URL: https://svnweb.freebsd.org/changeset/base/349366
> 
> Log:
>   Follow the RFC 3128 and drop short TCP fragments with offset = 1.
>   
>   Reported by:	emaste
>   MFC after:	1 week

Can we get a counter or something so that the dropping of these
is not totally silent and invisible?

Thanks,
Rod

> Modified:
>   head/sys/netpfil/ipfw/ip_fw2.c
> 
> Modified: head/sys/netpfil/ipfw/ip_fw2.c
> ==============================================================================
> --- head/sys/netpfil/ipfw/ip_fw2.c	Tue Jun 25 09:11:22 2019	(r349365)
> +++ head/sys/netpfil/ipfw/ip_fw2.c	Tue Jun 25 11:40:37 2019	(r349366)
> @@ -1719,6 +1719,11 @@ do {								\
>  			default:
>  				break;
>  			}
> +		} else {
> +			if (offset == 1 && proto == IPPROTO_TCP) {
> +				/* RFC 3128 */
> +				goto pullup_failed;
> +			}
>  		}
>  
>  		UPDATE_POINTERS();
> 
> 

-- 
Rod Grimes                                                 rgrimes@freebsd.org