https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=253476
--- Comment #12 from Richard Scheffenegger <rsch...@freebsd.org> --- We discussed this behavior in the #transport call today. The stack behaves according to RFC73232 with the default options. The consensus of the groups was that the TCP stack default should not be changed. The current behavior of ipfw with the injected keepalive would break with other (non-fbsd) stacks which adhere to RFC7323 just the same. Two other remediation options were discussed: a) retain more state in ipfw when a timestamp option is present, and use the most recent TSval / ecr combination observed when injecting the keepalive b) intercept the 3WHS and remove the timestamp option there. Option a) was preferred heavily - option b) fails when the firewall only gets to see an ongoing session (e.g. rerouting events) but not the syn, and reduces the information available to the TCP endpoints to run a number of mechanisms designed to improve performance and enhance data integrity at high speeds. option a) could still fail, for example if ipfw does not see the most recent segment in the direction, where the keepalive is to be injected - as per RFC7323, old timestamp values render the segment not acceptable. But in the vast majority of instances, that approach will make ipfw compliant with RFC7323. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. _______________________________________________ freebsd-ipfw@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"