From nobody Mon Aug 3 11:16:18 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hDDdN0nzYz6n8pJ for ; Mon, 03 Aug 2026 11:16:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hDDdM2fqYz3Kmr for ; Mon, 03 Aug 2026 11:16:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785755783; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zOBdaCMHuQ06DZ4KlLT/42jTyMT1quOQ/w7Qx18e2kU=; b=QcYcbquk1ob0iP0veRSjk5ODGoanPEYM3SEhHJcTKxEyqLAiAVMwirOoSYvn4/cumMVqH9 OCIXrDvBRB6nShY+idhv/9SK6UeK6cT/+dk8jMjlX0J1jkKDN9dnyrYsdPqh9rNst4LVUy vHIbMw3iVn1qLv2lgonlcIVdlLpAclVNvQ6pivVcRsA55Ifa4SAGCQ/kFj6iKeSe8IOhPA xamuW+8UNn9PHhRKkSy/u7gDtwoJ3wiH6jmViAACRyA3iipUtsJ/U2u4kchoZVIYLOMmmp v5JiNtG/MpLyMJFMbySG5+F330/+T/RFQhFJR9mBIMKhGtHIWIbbRMwVqTl75w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785755783; a=rsa-sha256; cv=none; b=P92HEwi+fSHfyJTY/xRKPbyGLBwNBVo7S7mOQR15KZNMObU2A/XvIU6gfYdAQ31r22BdOx pJUKgvuLz8XjqDZypQPSyTSuoI9vTN4AXy6EIz0a0nv+cDQt9w77Imu5mzLcoWwNDkDqLt uTVYRmIuh3noz+77VMfAL2mRTgdb6b3cukyy9SwvIFpgyR+Fu0bKUO2cT/x8FdSQ9vfXsz r0ONGuAQVwo11dH0GmHD+q3EV4UK0f+DK30nmsfxQjcHYbHPuQimazT2sAZicL6diYL7yG oOb1ASegDSH2uoLkGCctjkP6YXDxu/HK8ui4dMc4KqZpzBxO34S6cd7c2tc+QQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785755783; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zOBdaCMHuQ06DZ4KlLT/42jTyMT1quOQ/w7Qx18e2kU=; b=rwFeFdtn9iyzvYvUSkLehmObzZdX4K97Zhs0VFn8wgDQrFNpDjINT3YaEtryc4eDxHNWcC UuvGjrhayRwKogHYEIvSv8DRLPhFq328to4Ji2ePcAl76czHMbAaL02MrstzzLfD9TU8bj y28kgfQJxsB7oyxZT7QeWM1VpRo9m471b+FPYGdBrjtXe6Vfm0puBdTNee5nrNPRZN01iW KYeQmHsCugxNDkujRSqg4Cbxwd8tqrcL75Y348raFaVhf5GUbFX8FfQ3oHZiJa393MyqI7 k6+2jvnhUdYPg/qOnJmMFV1HmkU7G0WtxJi68p3rfxrhVLMeK6DP8PBmLt3pDQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hDDdM1DgWzyQV for ; Mon, 03 Aug 2026 11:16:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 188a3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 03 Aug 2026 11:16:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: c9df1a6cf9be - main - tcp: improve SEG.SEQ validation for RST segments List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c9df1a6cf9be9d44eacc8616ebba1cd19010c7fc Auto-Submitted: auto-generated Date: Mon, 03 Aug 2026 11:16:18 +0000 Message-Id: <6a707882.188a3.505d6563@gitrepo.freebsd.org> The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=c9df1a6cf9be9d44eacc8616ebba1cd19010c7fc commit c9df1a6cf9be9d44eacc8616ebba1cd19010c7fc Author: Michael Tuexen AuthorDate: 2026-08-03 11:07:32 +0000 Commit: Michael Tuexen CommitDate: 2026-08-03 11:07:32 +0000 tcp: improve SEG.SEQ validation for RST segments A RST segment can be sent in response to (a) received segment or (b) by the upper layer protocol. The SEG.SEQ validation consists of two checks: (1) the in-window check of SEG.SEQ and (2) the exact match check of SEG.SEQ. For the in-window check (1), the left edge of the window needs to be based on tp->last_ack_sent to cover the delayed ACK case, whereas the right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both assumes that tp->rcv_wnd is not zero. For the special case of tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). This applies to all TCP stacks. When the exact match (2) of SEG.SEQ is performed, it should be based on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both, check for both. Add this only to the base stack, since the RACK and BBR stacks already do this. PR: 296594 Reviewed by: rscheff MFC after: 3 days MFC to: stable/14 MFC to: stable/15 Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D58594 --- sys/netinet/tcp_input.c | 18 ++++++++++++------ sys/netinet/tcp_stacks/rack_bbr_common.c | 22 ++++++++++++++-------- 2 files changed, 26 insertions(+), 14 deletions(-) diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index bfef374af2d9..1e60774b3fb0 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -2125,20 +2125,26 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th, * - RST drops connection only if SEG.SEQ == RCV.NXT. * - If RST is in window, we send challenge ACK. * - * Note: to take into account delayed ACKs, we should - * test against last_ack_sent instead of rcv_nxt. + * Note 1: to take into account delayed ACKs, we should + * test against last_ack_sent in addition to rcv_nxt. * Note 2: we handle special case of closed window, not * covered by the RFC. + * Note 3 (XXXMT): check against rcv_adv instead of + * tp->rcv_nxt + tp->rcv_wnd. */ - if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) && - SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) || - (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) { + if ((tp->rcv_wnd > 0 && + SEQ_GEQ(th->th_seq, tp->last_ack_sent) && + SEQ_LT(th->th_seq, tp->rcv_nxt + tp->rcv_wnd)) || + (tp->rcv_wnd == 0 && + (tp->last_ack_sent == th->th_seq || + tp->rcv_nxt == th->th_seq))) { KASSERT(tp->t_state != TCPS_SYN_SENT, ("%s: TH_RST for TCPS_SYN_SENT th %p tp %p", __func__, th, tp)); if (V_tcp_insecure_rst || - tp->last_ack_sent == th->th_seq) { + tp->last_ack_sent == th->th_seq || + tp->rcv_nxt == th->th_seq) { TCPSTAT_INC(tcps_drops); /* Drop the connection. */ switch (tp->t_state) { diff --git a/sys/netinet/tcp_stacks/rack_bbr_common.c b/sys/netinet/tcp_stacks/rack_bbr_common.c index 51120f96ebce..2022aeb7233e 100644 --- a/sys/netinet/tcp_stacks/rack_bbr_common.c +++ b/sys/netinet/tcp_stacks/rack_bbr_common.c @@ -697,18 +697,24 @@ ctf_process_rst(struct mbuf *m, struct tcphdr *th, struct socket *so, /* * RFC5961 Section 3.2 * - * - RST drops connection only if SEG.SEQ == RCV.NXT. - If RST is in - * window, we send challenge ACK. + * - RST drops connection only if SEG.SEQ == RCV.NXT. + * - If RST is in window, we send challenge ACK. * - * Note: to take into account delayed ACKs, we should test against - * last_ack_sent instead of rcv_nxt. Note 2: we handle special case - * of closed window, not covered by the RFC. + * Note 1: to take into account delayed ACKs, we should + * test against last_ack_sent in addition to rcv_nxt. + * Note 2: we handle special case of closed window, not + * covered by the RFC. + * Note 3 (XXXMT): check against rcv_adv instead of + * tp->rcv_nxt + tp->rcv_wnd. */ int dropped = 0; - if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) && - SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) || - (tp->rcv_wnd == 0 && tp->last_ack_sent == th->th_seq)) { + if ((tp->rcv_wnd > 0 && + SEQ_GEQ(th->th_seq, tp->last_ack_sent) && + SEQ_LT(th->th_seq, tp->rcv_nxt + tp->rcv_wnd)) || + (tp->rcv_wnd == 0 && + (tp->last_ack_sent == th->th_seq || + tp->rcv_nxt == th->th_seq))) { KASSERT(tp->t_state != TCPS_SYN_SENT, ("%s: TH_RST for TCPS_SYN_SENT th %p tp %p", __func__, th, tp));