tcp: prevent spurious empty segments and fix uncommon panic

[rscheff]

Summary

When receiving pure ACKs for previously sent data,
but no more data is available in the send buffer,
an spurious empty ACK would frequently be sent instead.

In the case of a retransmitted SYN not being sent due to
an internal error, the snd_una/snd_nxt accounting could
be off, leading to a panic. Pulling snd_nxt up to snd_una
prevents this from happening.

Reported by: [e-mail]

[cc]

Good catch!

sys/netinet/tcp_input.c

#endif
                                 else if (acked > 1)
                                         tp->t_acktime = ticks;
                                 if (tp->snd_una == tp->snd_max)
                                         tcp_timer_activate(tp, TT_REXMT, 0);
                                 else if (!tcp_timer_active(tp, TT_PERSIST))
                                         tcp_timer_activate(tp, TT_REXMT,
                                             TP_RXTCUR(tp));
                                 sowwakeup(so);
-                                if (sbavail(&so->so_snd))
+                                /*
+                                 * Only call tcp_output when there
+                                 * is new data available to be sent
+                                 * or we need to send an ACK.
+                                 */
+                                if (SEQ_GT(tp->snd_una + sbavail(&so->so_snd),
+                                    tp->snd_max) || tp->t_flags & TF_ACKNOW)
                                         (void) tcp_output(tp);
                                 goto check_delack;
                         }
                 } else if (th->th_ack == tp->snd_una &&
                     tlen <= sbspace(&so->so_rcv)) {
                         int newsize = 0;        /* automatic sockbuf scaling */
 
                         /*
#endif
                         /* Do window scaling on this connection? */
                         if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
                                 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
                                 tp->rcv_scale = tp->request_r_scale;
                         }
                         tp->rcv_adv += min(tp->rcv_wnd,
                             TCP_MAXWIN << tp->rcv_scale);
                         tp->snd_una++;               /* SYN is acked */
+                        if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                                tp->snd_nxt = tp->snd_una;
                         /*
                          * If not all the data that was sent in the TFO SYN
                          * has been acked, resend the remainder right away.
                          */
                         if (IS_FASTOPEN(tp->t_flags) &&
                             (tp->snd_una != tp->snd_max)) {
                                 tp->snd_nxt = th->th_ack;
                                 tfo_partial_ack = 1;