Page MenuHomeFreeBSD

Fix sending of TCP segments when IP level options are specified
ClosedPublic

Authored by tuexen on May 20 2021, 10:41 AM.

Details

Summary

When bringing in TCP over UDP support, the length of IP level options was considered when locating the transport header. This was incorrect and is fixed by this patch.

This issue was detected by syzkaller.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

Where are the ip options accounted for, then? Is the mbuf already adjusted to no longer contain ipoptions by that time (not familiar with IP level processing).

Where are the ip options accounted for, then? Is the mbuf already adjusted to no longer contain ipoptions by that time (not familiar with IP level processing).

It is used to ensure that the TCP/IP packet honours the MSS.

This revision is now accepted and ready to land.May 20 2021, 2:18 PM

Seems ok to me.

sys/netinet/tcp_output.c
1166

This code is duplicated 6 times across the various TCP stacks. Could we lift it into a subroutine as a follow-up change?

sys/netinet/tcp_output.c
1166

This is true for more than this. For RACK/BBR there are common functions, but not so much for the base stack and the optional ones.