Fenrir fixes 2026 08 17 - #153

Open

danielinux wants to merge 21 commits into

wolfSSL:masterfrom

danielinux:fenrir-fixes-2026-08-17

Commits on Aug 17, 2026

F-8513: pin datagram IP header to enqueue-time destination
danielinux
committed
bf0c0c9
F-8514: keep accept socket seq at the ISN while in SYN_RCVD
danielinux
committed
ffa9c1c
F-8557: reject TCP connect to broadcast and multicast destinations
danielinux
committed
64879f1
F-8563: keep peer-advertised TCP MSS verbatim
danielinux
committed
a528fdf
F-8565: run PAWS before the segment acceptability test
danielinux
committed
72cd518
F-6472: count only pure ACKs with unchanged window as duplicate ACKs
danielinux
committed
dc521b4
F-6938: cap the backed-off TCP RTO at 64 seconds
danielinux
committed
07fcef0
F-8564: extend control-segment retry budget to meet the 3-minute R2 floor
danielinux
committed
2ae0fa2
F-8516: forward transit packets using the static route table
danielinux
committed
8714895
F-8558: drop and clamp forwarding on the declared IP total length
danielinux
committed
69f0bae
F-8517: recompute the IP header checksum after the IP_HDRINCL destination override
danielinux
committed
632eeaa
F-8515: roll back the armed DNS query when name encoding fails
danielinux
committed
f97f172
F-8569: reject zero-length DNS labels in the query encoder
danielinux
committed
e2322a1
F-8570: require an exact 4-byte RDATA for DNS A records
danielinux
committed
792c766
F-8567: honor the DHCP option overload option (RFC 2132 §9.3)
danielinux
committed
664cb34
F-8568: schedule the first DHCPDISCOVER retry at 4 s ± 1 s
danielinux
committed
c8bcb31
F-6941: consult a freshly registered filter callback for all reasons
danielinux
committed
11ff613
F-8513: keep IP_MULTICAST_IF pinned egress at flush time
danielinux
committed
16f2eb2
F-6941: honor explicit mask configuration made before installing the callback
danielinux
committed
8c23611
F-8568: guard the discover retry jitter window against small bases
danielinux
committed
36f82fd
addressed 3 skoll suggestions:
danielinux
committed
58345d8

Navigation Menu

Uh oh!

Fenrir fixes 2026 08 17 - #153

Fenrir fixes 2026 08 17#153
danielinux wants to merge 21 commits into
wolfSSL:masterfrom
danielinux:fenrir-fixes-2026-08-17

Commits on Aug 17, 2026

F-8513: pin datagram IP header to enqueue-time destination

F-8514: keep accept socket seq at the ISN while in SYN_RCVD

F-8557: reject TCP connect to broadcast and multicast destinations

F-8563: keep peer-advertised TCP MSS verbatim

F-8565: run PAWS before the segment acceptability test

F-6472: count only pure ACKs with unchanged window as duplicate ACKs

F-6938: cap the backed-off TCP RTO at 64 seconds

F-8564: extend control-segment retry budget to meet the 3-minute R2 floor

F-8516: forward transit packets using the static route table

F-8558: drop and clamp forwarding on the declared IP total length

F-8517: recompute the IP header checksum after the IP_HDRINCL destination override

F-8515: roll back the armed DNS query when name encoding fails

F-8569: reject zero-length DNS labels in the query encoder

F-8570: require an exact 4-byte RDATA for DNS A records

F-8567: honor the DHCP option overload option (RFC 2132 §9.3)

F-8568: schedule the first DHCPDISCOVER retry at 4 s ± 1 s

F-6941: consult a freshly registered filter callback for all reasons

F-8513: keep IP_MULTICAST_IF pinned egress at flush time

F-6941: honor explicit mask configuration made before installing the callback

F-8568: guard the discover retry jitter window against small bases

addressed 3 skoll suggestions: