Page MenuHomeFreeBSD

tcp: improve SEG.SEQ validation for RST segments
ClosedPublic

Authored by tuexen on Mon, Aug 3, 7:22 AM.
Tags
None
Referenced Files
F165181753: D58594.id183256.diff
Thu, Aug 6, 2:32 PM
F165178104: D58594.id183257.diff
Thu, Aug 6, 2:17 PM
F165160850: D58594.diff
Thu, Aug 6, 11:57 AM
F165143940: D58594.id183256.diff
Thu, Aug 6, 9:27 AM
F165098224: D58594.id183257.diff
Thu, Aug 6, 12:48 AM
Unknown Object (File)
Wed, Aug 5, 8:53 AM
Unknown Object (File)
Wed, Aug 5, 2:21 AM

Details

Summary

A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.
The SEG.SEQ validation consists of two checks: the in-window check of SEG.SEQ and the exact match check of SEG.SEQ.
For the in-window check, the left edge of the window needs to be based on tp->last_ack_sent to cover the delayed ACK case, where as the right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both assumes that tp->rcv_wnd is not zero. For the special case of tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). This applies to all TCP stacks.
When the exact match of SEG.SEQ is performed, it should be based on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both, check for both. Add this to the base stack, since the RACK and BBR stack already did this.

This fixes PR 296594.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

tuexen requested review of this revision.Mon, Aug 3, 7:22 AM

Looks like you do modify the BBR/RACK stack too, unlike the high level description. In both places the same checks used to be done in a mirror image - and this again mirrors each other.

This revision is now accepted and ready to land.Mon, Aug 3, 7:50 AM

Looks like you do modify the BBR/RACK stack too, unlike the high level description. In both places the same checks used to be done in a mirror image - and this again mirrors each other.

My description was bad. The in-window check is fix in both stacks, only the exact match check was already correct for the RACK and BBR stacks.