According to the fifth step in SEGMENT ARRIVES, send a RST segment in response to an ACK segment which fails the SEG.ACK check, but leave the endpoint state unchanged.
FreeBSD handles this correctly when entering the SYN-RECEIVED state via the SYN-SENT state, but not in the SYN-cache code, which handles the SYN-RECEIVED state via the LISTEN state.
This also fixes a panic reported by Alexander Leidinger.
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
| sys/netinet/tcp_syncache.c | ||
|---|---|---|
| 1287 | Is there a reason to free() while holding the lock? The conditional right before this one drops the lock before calling free(). | |
| 1318 | At this point, I think you can either delete this or turn it into an assert that sc == &scs. (I think you can now only reach this from the syncookie portion of the code and not from the syncache code.) | |
| sys/netinet/tcp_syncache.c | ||
|---|---|---|
| 1287 | This is one of the things I want to do consistently. In several other places it calls free in the if statement, at the end it checks if s is not NULL. I plan to do it in a consistent way in all places. Doing it after releasing the lock is better, I agree. I can do that right now. | |
| 1318 | Yes, this is also one of the cleanup steps. Right now my plan is to remove the synchache_free() call, move the free(s, M_TCPLOG) up to the remaining three places and finally remove the three instances of goto failed by using return (0) directly. | |
Comment Actions
I can confirm that this fixes the crash I've seen. Instead of crashing after a few minutes, it now is still humming happily with 16 minutes of uptime.
| sys/netinet/tcp_syncache.c | ||
|---|---|---|
| 1289 | ';' in front and after the comment... | |
Comment Actions
Thanks for testing and reporting.
| sys/netinet/tcp_syncache.c | ||
|---|---|---|
| 1289 | Fix. Not sure why these come up. I guess my editor has changed its behavior. | |