svn commit: r340782 - head/sys/netinet/tcp_stacks

[Michael Tuexen]

Author: tuexen
Date: Thu Nov 22 20:05:57 2018
New Revision: 340782
URL: https://svnweb.freebsd.org/changeset/base/340782

Log:
  A TCP stack is required to check SEG.ACK first, when processing a
  segment in the SYN-SENT state as stated in Section 3.9 of RFC 793,
  page 66. Ensure this is also done by the TCP RACK stack.
  
  Reviewed by:		rrs@
  MFC after:		1 week
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18034

Modified:
  head/sys/netinet/tcp_stacks/rack.c

Modified: head/sys/netinet/tcp_stacks/rack.c
==============================================================================
--- head/sys/netinet/tcp_stacks/rack.c	Thu Nov 22 20:02:39 2018	(r340781)
+++ head/sys/netinet/tcp_stacks/rack.c	Thu Nov 22 20:05:57 2018	(r340782)
@@ -6533,6 +6533,15 @@ rack_hpts_do_segment(struct mbuf *m, struct tcphdr *th
 		goto done_with_input;
 	}
 	/*
+	 * If a segment with the ACK-bit set arrives in the SYN-SENT state
+	 * check SEQ.ACK first as described on page 66 of RFC 793, section 3.9.
+	 */
+	if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) &&
+	    (SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) {
+		rack_do_dropwithreset(m, tp, th, BANDLIM_RST_OPENPORT, tlen);
+		return;
+	}
+	/*
 	 * Segment received on connection. Reset idle time and keep-alive
 	 * timer. XXX: This should be done after segment validation to
 	 * ignore broken/spoofed segs.